Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
06-10-2023 13:47
General
-
Target
255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c.exe
-
Size
3.8MB
-
MD5
4c51b62c9ee7a37ddc010e48b516c243
-
SHA1
77b6f4ce0867078a8d7c02fa1254912b6f4c0d00
-
SHA256
255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c
-
SHA512
8e292a6125309ad8e26606b4682001a8cfa8038818a9b28e4070a5133b73083bac608c48f00ae30e38fea170186de7e5da9c3528f8a55685c44d923c029e1adb
-
SSDEEP
49152:T+eKofn4V0kl/gaMHqAwl6hXsM75LwV71pG7XPQx7PtwlSr+Ucbf3QC3aLVeolcB:
Malware Config
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c.exe"C:\Users\Admin\AppData\Local\Temp\255d887e4aee44b4a811fd99c76d7df6ce442316125d236f9b3891bd56b82f8c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\GXLRF289.exe"C:\Users\Admin\AppData\Roaming\Adobe\GXLRF289.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Adobe\EHYL9INA.exe"C:\Users\Admin\AppData\Roaming\Adobe\EHYL9INA.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5051c8b584ffde2a373d4a54d038bc46c
SHA1d58abcb0d3875094b51e6836036bf65ff96b8b40
SHA256711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801
SHA5128f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063
-
Filesize
83KB
MD5051c8b584ffde2a373d4a54d038bc46c
SHA1d58abcb0d3875094b51e6836036bf65ff96b8b40
SHA256711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801
SHA5128f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063
-
Filesize
83KB
MD5051c8b584ffde2a373d4a54d038bc46c
SHA1d58abcb0d3875094b51e6836036bf65ff96b8b40
SHA256711de934bbdb56f4335d776819d4059222f8b3376fcb4a72ac2fca0a38e45801
SHA5128f28ce2467b8accba63be5a4983df4c8faed25a7f79c1f04560f47009969cbf84fc2afe4e08c2903c17f895afe29e397a91ed579d012f68fe08f0b4261552063
-
Filesize
1.3MB
MD5126d1dba7efc0faed18afa036fb0468b
SHA1fe58c79cc3b5d11d9c1fbf53db1e0d726c94c491
SHA256adb8b6cfb9633759f3a08ecb160790aaa6a733d5671991c21a5a28deafbeef26
SHA512a3c32b7b4961c13c4fafb1b71b123bf4d0ecdfc4087912429019fb63aaf17f132ae2c58135f2ea8d64643966e99a28c89fc67c6256e9dafcb310049ab6951ad9
-
Filesize
1.3MB
MD5126d1dba7efc0faed18afa036fb0468b
SHA1fe58c79cc3b5d11d9c1fbf53db1e0d726c94c491
SHA256adb8b6cfb9633759f3a08ecb160790aaa6a733d5671991c21a5a28deafbeef26
SHA512a3c32b7b4961c13c4fafb1b71b123bf4d0ecdfc4087912429019fb63aaf17f132ae2c58135f2ea8d64643966e99a28c89fc67c6256e9dafcb310049ab6951ad9
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
3.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB