Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2023 08:20
Behavioral task
behavioral1
Sample
823791a9bfed88b3af85698e8f019254.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
823791a9bfed88b3af85698e8f019254.exe
Resource
win10v2004-20230915-en
General
-
Target
823791a9bfed88b3af85698e8f019254.exe
-
Size
84KB
-
MD5
823791a9bfed88b3af85698e8f019254
-
SHA1
506803fd5335f75862e0ea271716a6e97cd66b13
-
SHA256
58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f
-
SHA512
40f3dfc08ba7868b1d6310418fc799ea6266e3d70ee098d1ab77213eb4451578a316de0f347101b5b83ac393a793442cd748f8ced56dac71c4de607c0f07da26
-
SSDEEP
1536:zhu9D+Oy/Dn/hP8PGTzBwZ6YWKSO5T3rZvSwEKSK99jzpma:zhu9WL/hEPeGU5S5TbZawEKSK99jVH
Malware Config
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
823791a9bfed88b3af85698e8f019254.exepid process 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe 704 823791a9bfed88b3af85698e8f019254.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
823791a9bfed88b3af85698e8f019254.exesvchost.exedescription pid process Token: SeDebugPrivilege 704 823791a9bfed88b3af85698e8f019254.exe Token: SeManageVolumePrivilege 2316 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\823791a9bfed88b3af85698e8f019254.exe"C:\Users\Admin\AppData\Local\Temp\823791a9bfed88b3af85698e8f019254.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5000
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:756
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316