phemedrone | 711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-10-2023 16:03

Sharing

Report Analysis Logs

General

Target

0x000700000001afb1-10.exe
Size

83KB
MD5

051c8b584ffde2a373d4a54d038bc46c
SHA1

d58abcb0d3875094b51e6836036bf65ff96b8b40
SHA256

711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801
SHA512

8f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063
SSDEEP

1536:pB/y6CymnGTmsYd/exySO5T3rZmSwEKSKe9TzpmF:pB/y6CPn7pdmxa5TbZPwEKSKe9TVw

Score

10^/10

phemedrone stealer

Malware Config

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0x000700000001afb1-10.exe

description	pid	process	target process
PID 3052 wrote to memory of 2604	3052	0x000700000001afb1-10.exe	WerFault.exe
PID 3052 wrote to memory of 2604	3052	0x000700000001afb1-10.exe	WerFault.exe
PID 3052 wrote to memory of 2604	3052	0x000700000001afb1-10.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0x000700000001afb1-10.exe
"C:\Users\Admin\AppData\Local\Temp\0x000700000001afb1-10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3052 -s 520
  2⤵
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-0-0x0000000000810000-0x000000000082C000-memory.dmp

Filesize
112KB

Download
memory/3052-1-0x000007FEF6140000-0x000007FEF6B2C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-2-0x000007FEF6140000-0x000007FEF6B2C000-memory.dmp

Filesize
9.9MB

Download