Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02-10-2023 08:20
Behavioral task
behavioral1
Sample
823791a9bfed88b3af85698e8f019254.exe
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
823791a9bfed88b3af85698e8f019254.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
823791a9bfed88b3af85698e8f019254.exe
-
Size
84KB
-
MD5
823791a9bfed88b3af85698e8f019254
-
SHA1
506803fd5335f75862e0ea271716a6e97cd66b13
-
SHA256
58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f
-
SHA512
40f3dfc08ba7868b1d6310418fc799ea6266e3d70ee098d1ab77213eb4451578a316de0f347101b5b83ac393a793442cd748f8ced56dac71c4de607c0f07da26
-
SSDEEP
1536:zhu9D+Oy/Dn/hP8PGTzBwZ6YWKSO5T3rZvSwEKSK99jzpma:zhu9WL/hEPeGU5S5TbZawEKSK99jVH
Score
10/10
Malware Config
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
823791a9bfed88b3af85698e8f019254.exedescription pid process target process PID 2932 wrote to memory of 1716 2932 823791a9bfed88b3af85698e8f019254.exe WerFault.exe PID 2932 wrote to memory of 1716 2932 823791a9bfed88b3af85698e8f019254.exe WerFault.exe PID 2932 wrote to memory of 1716 2932 823791a9bfed88b3af85698e8f019254.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\823791a9bfed88b3af85698e8f019254.exe"C:\Users\Admin\AppData\Local\Temp\823791a9bfed88b3af85698e8f019254.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2932 -s 5202⤵PID:1716