phemedrone | 9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05-10-2023 17:44

Target

9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe
Size

83KB
MD5

82f85b726de92d4eb9923d087b0845ea
SHA1

50cb73f3eaabd48988a3b7f04fff4eda01e351e2
SHA256

9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4
SHA512

13e44bdbde9b43c90d0a88da871e25e2a47392ad7438d667bb7bead0006210f4c1481bb68cb1c181b5b946d59a5855468490c0a95133d22a069fcf12b20e991e
SSDEEP

1536:YMthu5yZ5Ua8PGTtMwZ6YWKSO5T3rZxSwEKSKe9jzpmV:YMtrZ5UFP0hU5S5TbZ0wEKSKe9jVA

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe

description	pid	process	target process
PID 1728 wrote to memory of 1448	1728	9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe	WerFault.exe
PID 1728 wrote to memory of 1448	1728	9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe	WerFault.exe
PID 1728 wrote to memory of 1448	1728	9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9aa89ac25459a7910489f306a1ad36af2c0ebe66a1eed7f749d53a8162b157b4exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 524
  2⤵
  PID:1448

memory/1728-0-0x0000000000FF0000-0x000000000100C000-memory.dmp

Filesize
112KB

Download
memory/1728-1-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/1728-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download