Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2023 15:55
Static task
static1
Behavioral task
behavioral1
Sample
Ofepari_ct.exe
Resource
win10v2004-20230915-en
General
-
Target
Ofepari_ct.exe
-
Size
230KB
-
MD5
c55569ef6fcf3608aa4e328549085fb6
-
SHA1
fea1b19b30ca3cdd73080098d2a76bd11e9d4266
-
SHA256
c18fb59b7cd6b7bb35bff64f646b39979bf42143097d40950e72b3dbde1b6e4f
-
SHA512
6df8fe4698cf3cf10e4153e35cd172322ef7d3f74f870414b2248a09c086d83a4750e360c5dac230f5220b150b198df5f78445def86dd0a3396192a5237f0358
-
SSDEEP
6144:h/yJnrNsp6+xCCPfWQORHyAT2lMtAIGh074D8yf:Jy5r6p6oZPfWQORHfTc83Gh0sD8yf
Malware Config
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
Ofepari_ct.exepid process 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe 2756 Ofepari_ct.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Ofepari_ct.exedescription pid process Token: SeDebugPrivilege 2756 Ofepari_ct.exe