Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2023 16:03

General

  • Target

    tcpview.exe

  • Size

    3.8MB

  • MD5

    4c51b62c9ee7a37ddc010e48b516c243

  • SHA1

    77b6f4ce0867078a8d7c02fa1254912b6f4c0d00

  • SHA256

    255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c

  • SHA512

    8e292a6125309ad8e26606b4682001a8cfa8038818a9b28e4070a5133b73083bac608c48f00ae30e38fea170186de7e5da9c3528f8a55685c44d923c029e1adb

  • SSDEEP

    49152:T+eKofn4V0kl/gaMHqAwl6hXsM75LwV71pG7XPQx7PtwlSr+Ucbf3QC3aLVeolcB:

Malware Config

Signatures

  • Phemedrone

    An information and wallet stealer written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tcpview.exe
    "C:\Users\Admin\AppData\Local\Temp\tcpview.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\7CFWVPWU.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\7CFWVPWU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:864
    • C:\ProgramData\Start Menu\9HBYJW52.exe
      "C:\ProgramData\Start Menu\9HBYJW52.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4092
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:4328
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:420
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4324

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Windows\Start Menu\9HBYJW52.exe

        Filesize

        83KB

        MD5

        051c8b584ffde2a373d4a54d038bc46c

        SHA1

        d58abcb0d3875094b51e6836036bf65ff96b8b40

        SHA256

        711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801

        SHA512

        8f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063

      • C:\ProgramData\Microsoft\Windows\Start Menu\9HBYJW52.exe

        Filesize

        83KB

        MD5

        051c8b584ffde2a373d4a54d038bc46c

        SHA1

        d58abcb0d3875094b51e6836036bf65ff96b8b40

        SHA256

        711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801

        SHA512

        8f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063

      • C:\ProgramData\Start Menu\9HBYJW52.exe

        Filesize

        83KB

        MD5

        051c8b584ffde2a373d4a54d038bc46c

        SHA1

        d58abcb0d3875094b51e6836036bf65ff96b8b40

        SHA256

        711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801

        SHA512

        8f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063

      • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

        Filesize

        16KB

        MD5

        d448d88f3c4f994e05c0a0653c6634ee

        SHA1

        f30a448188a5620dce19c1bd464e47924e36ee55

        SHA256

        fe2ceb0ec8e8908ccf4cc6c025d36e649e1c78e985cc47f9268049b2f7826556

        SHA512

        8f484298ccfd01833ce25ba61cfbb8f92c50ecde92f5d8e2d75a4a0b247dc2b2c938620abf5ea2712e0e684fbee7d3b22208f025b494137a7e5c71e2f68566a1

      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\7CFWVPWU.exe

        Filesize

        1.3MB

        MD5

        126d1dba7efc0faed18afa036fb0468b

        SHA1

        fe58c79cc3b5d11d9c1fbf53db1e0d726c94c491

        SHA256

        adb8b6cfb9633759f3a08ecb160790aaa6a733d5671991c21a5a28deafbeef26

        SHA512

        a3c32b7b4961c13c4fafb1b71b123bf4d0ecdfc4087912429019fb63aaf17f132ae2c58135f2ea8d64643966e99a28c89fc67c6256e9dafcb310049ab6951ad9

      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\7CFWVPWU.exe

        Filesize

        1.3MB

        MD5

        126d1dba7efc0faed18afa036fb0468b

        SHA1

        fe58c79cc3b5d11d9c1fbf53db1e0d726c94c491

        SHA256

        adb8b6cfb9633759f3a08ecb160790aaa6a733d5671991c21a5a28deafbeef26

        SHA512

        a3c32b7b4961c13c4fafb1b71b123bf4d0ecdfc4087912429019fb63aaf17f132ae2c58135f2ea8d64643966e99a28c89fc67c6256e9dafcb310049ab6951ad9

      • memory/864-29-0x000000006DF70000-0x000000006DF80000-memory.dmp

        Filesize

        64KB

      • memory/3400-1-0x00007FFFC3280000-0x00007FFFC3D41000-memory.dmp

        Filesize

        10.8MB

      • memory/3400-0-0x00000000009D0000-0x0000000000DA6000-memory.dmp

        Filesize

        3.8MB

      • memory/3400-27-0x00007FFFC3280000-0x00007FFFC3D41000-memory.dmp

        Filesize

        10.8MB

      • memory/4092-25-0x00007FFFC3280000-0x00007FFFC3D41000-memory.dmp

        Filesize

        10.8MB

      • memory/4092-28-0x000000001BF80000-0x000000001BF90000-memory.dmp

        Filesize

        64KB

      • memory/4092-30-0x00007FFFC3280000-0x00007FFFC3D41000-memory.dmp

        Filesize

        10.8MB

      • memory/4092-31-0x000000001BF80000-0x000000001BF90000-memory.dmp

        Filesize

        64KB

      • memory/4092-32-0x00007FFFC3280000-0x00007FFFC3D41000-memory.dmp

        Filesize

        10.8MB

      • memory/4092-24-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

        Filesize

        112KB

      • memory/4324-66-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-75-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-49-0x0000029548440000-0x0000029548450000-memory.dmp

        Filesize

        64KB

      • memory/4324-67-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-68-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-69-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-70-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-71-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-72-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-73-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-74-0x0000029550A20000-0x0000029550A21000-memory.dmp

        Filesize

        4KB

      • memory/4324-65-0x00000295509F0000-0x00000295509F1000-memory.dmp

        Filesize

        4KB

      • memory/4324-76-0x0000029550640000-0x0000029550641000-memory.dmp

        Filesize

        4KB

      • memory/4324-77-0x0000029550630000-0x0000029550631000-memory.dmp

        Filesize

        4KB

      • memory/4324-79-0x0000029550640000-0x0000029550641000-memory.dmp

        Filesize

        4KB

      • memory/4324-82-0x0000029550630000-0x0000029550631000-memory.dmp

        Filesize

        4KB

      • memory/4324-85-0x0000029550570000-0x0000029550571000-memory.dmp

        Filesize

        4KB

      • memory/4324-33-0x0000029548340000-0x0000029548350000-memory.dmp

        Filesize

        64KB

      • memory/4324-97-0x0000029550770000-0x0000029550771000-memory.dmp

        Filesize

        4KB

      • memory/4324-99-0x0000029550780000-0x0000029550781000-memory.dmp

        Filesize

        4KB

      • memory/4324-100-0x0000029550780000-0x0000029550781000-memory.dmp

        Filesize

        4KB

      • memory/4324-101-0x0000029550890000-0x0000029550891000-memory.dmp

        Filesize

        4KB