Analysis
-
max time kernel
73s -
max time network
78s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
04-10-2023 15:57
Static task
static1
Behavioral task
behavioral1
Sample
tcpview.exe
Resource
win10-20230915-en
General
-
Target
tcpview.exe
-
Size
3.8MB
-
MD5
4c51b62c9ee7a37ddc010e48b516c243
-
SHA1
77b6f4ce0867078a8d7c02fa1254912b6f4c0d00
-
SHA256
255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c
-
SHA512
8e292a6125309ad8e26606b4682001a8cfa8038818a9b28e4070a5133b73083bac608c48f00ae30e38fea170186de7e5da9c3528f8a55685c44d923c029e1adb
-
SSDEEP
49152:T+eKofn4V0kl/gaMHqAwl6hXsM75LwV71pG7XPQx7PtwlSr+Ucbf3QC3aLVeolcB:
Malware Config
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Executes dropped EXE 2 IoCs
Processes:
CCJBAEUO.exe7ZHSQ2JA.exepid process 5008 CCJBAEUO.exe 3036 7ZHSQ2JA.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
7ZHSQ2JA.exepid process 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe 3036 7ZHSQ2JA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7ZHSQ2JA.exedescription pid process Token: SeDebugPrivilege 3036 7ZHSQ2JA.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
CCJBAEUO.exepid process 5008 CCJBAEUO.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
tcpview.exedescription pid process target process PID 4532 wrote to memory of 5008 4532 tcpview.exe CCJBAEUO.exe PID 4532 wrote to memory of 5008 4532 tcpview.exe CCJBAEUO.exe PID 4532 wrote to memory of 5008 4532 tcpview.exe CCJBAEUO.exe PID 4532 wrote to memory of 3036 4532 tcpview.exe 7ZHSQ2JA.exe PID 4532 wrote to memory of 3036 4532 tcpview.exe 7ZHSQ2JA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tcpview.exe"C:\Users\Admin\AppData\Local\Temp\tcpview.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Roaming\Adobe\CCJBAEUO.exe"C:\Users\Admin\AppData\Roaming\Adobe\CCJBAEUO.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5008 -
C:\Users\Admin\AppData\Roaming\Adobe\7ZHSQ2JA.exe"C:\Users\Admin\AppData\Roaming\Adobe\7ZHSQ2JA.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5051c8b584ffde2a373d4a54d038bc46c
SHA1d58abcb0d3875094b51e6836036bf65ff96b8b40
SHA256711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801
SHA5128f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063
-
Filesize
83KB
MD5051c8b584ffde2a373d4a54d038bc46c
SHA1d58abcb0d3875094b51e6836036bf65ff96b8b40
SHA256711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801
SHA5128f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063
-
Filesize
1.3MB
MD5126d1dba7efc0faed18afa036fb0468b
SHA1fe58c79cc3b5d11d9c1fbf53db1e0d726c94c491
SHA256adb8b6cfb9633759f3a08ecb160790aaa6a733d5671991c21a5a28deafbeef26
SHA512a3c32b7b4961c13c4fafb1b71b123bf4d0ecdfc4087912429019fb63aaf17f132ae2c58135f2ea8d64643966e99a28c89fc67c6256e9dafcb310049ab6951ad9