phemedrone | 58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03-10-2023 14:28

Target

58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe
Size

84KB
MD5

823791a9bfed88b3af85698e8f019254
SHA1

506803fd5335f75862e0ea271716a6e97cd66b13
SHA256

58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f
SHA512

40f3dfc08ba7868b1d6310418fc799ea6266e3d70ee098d1ab77213eb4451578a316de0f347101b5b83ac393a793442cd748f8ced56dac71c4de607c0f07da26
SSDEEP

1536:zhu9D+Oy/Dn/hP8PGTzBwZ6YWKSO5T3rZvSwEKSK99jzpma:zhu9WL/hEPeGU5S5TbZawEKSK99jVH

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe

description	pid	process	target process
PID 3052 wrote to memory of 2624	3052	58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe	WerFault.exe
PID 3052 wrote to memory of 2624	3052	58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe	WerFault.exe
PID 3052 wrote to memory of 2624	3052	58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3052 -s 524
  2⤵
  PID:2624

memory/3052-0-0x0000000001070000-0x000000000108C000-memory.dmp

Filesize
112KB

Download
memory/3052-1-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-2-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download