Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
03/10/2023, 14:28
General
- Target 58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe
- Size 84KB
- Sample231003-rtgxxade76
- SHA256 58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f
Malware Config
Signatures
- Phemedrone
An information and wallet stealer written in C#.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe"C:\Users\Admin\AppData\Local\Temp\58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/1124-0-0x0000000000670000-0x000000000068C000-memory.dmp
memory/1124-1-0x00007FFBE56A0000-0x00007FFBE6161000-memory.dmp
memory/1124-2-0x000000001B610000-0x000000001B620000-memory.dmp
memory/1124-3-0x00007FFBE56A0000-0x00007FFBE6161000-memory.dmp
memory/1124-4-0x000000001B610000-0x000000001B620000-memory.dmp
memory/1124-6-0x00007FFBE56A0000-0x00007FFBE6161000-memory.dmp
memory/2420-45-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-49-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-40-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-41-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-42-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-43-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-44-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-23-0x000001D92BA60000-0x000001D92BA70000-memory.dmp
memory/2420-46-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-47-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-48-0x000001D933F80000-0x000001D933F81000-memory.dmp
memory/2420-39-0x000001D933F50000-0x000001D933F51000-memory.dmp
memory/2420-50-0x000001D933CA0000-0x000001D933CA1000-memory.dmp
memory/2420-51-0x000001D933C90000-0x000001D933C91000-memory.dmp
memory/2420-53-0x000001D933CA0000-0x000001D933CA1000-memory.dmp
memory/2420-56-0x000001D933C90000-0x000001D933C91000-memory.dmp
memory/2420-59-0x000001D933BD0000-0x000001D933BD1000-memory.dmp
memory/2420-7-0x000001D92B960000-0x000001D92B970000-memory.dmp
memory/2420-71-0x000001D933DD0000-0x000001D933DD1000-memory.dmp
memory/2420-73-0x000001D933DE0000-0x000001D933DE1000-memory.dmp
memory/2420-74-0x000001D933DE0000-0x000001D933DE1000-memory.dmp
memory/2420-75-0x000001D933EF0000-0x000001D933EF1000-memory.dmp