Analysis
-
max time kernel
96s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09-10-2023 21:50
General
-
Target
Jefutyl.zip
-
Size
38KB
-
MD5
46ad12d7699b3f9a0ce5f70b08324677
-
SHA1
4b3950b2a378661310472427acaf26272373ed21
-
SHA256
3fb1c3589b3a7636337ae5284974f79f99e4c015977a4fa1eeeeb42d79590181
-
SHA512
d455cd28d8365380494f2ed8f59cf99fcd17dba3b94efe558d307b95abf7e232e5b17ad47f1fb068d4e3bec7214fa88e71fbb8203d1728cfe0371c5013d8d5ef
-
SSDEEP
768:Q6cNV9G4WCsEimmJFLzW/6/RDFC+cPn22xHoMvBhw1gFakQdloivG/ERKjT:ZC1WlFw6/pPUxTw1cakQd6ivbRKjT
Malware Config
Extracted
phemedrone
https://api.telegram.org/bot6421901210:AAErC913wmPS9T_-XJrvOWFdTxw2TkS248A/sendMessage?chat_id=5896425070
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 34 IoCs
-
Suspicious use of SendNotifyMessage 34 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Jefutyl.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Jefutyl.exe"C:\Users\Admin\Desktop\Jefutyl.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\Jefutyl.exe"C:\Users\Admin\Desktop\Jefutyl.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e7e9d20a33eb36c35560d47fcbcd083e
SHA141df6fa9f9e3b543b957105617670aaaceed2aad
SHA256ee8eb47f8eaa8fea61d4561eda2d4fb42b93cd51d24778651dae82f4254a082d
SHA5129f9ab0b3d56e4f13837b6d2b77730d847a816eec4f1e606e82a101b4bea3f2b20f69e1e8eb6e2e80f175e8c26a4ba7b8d078f79029f9bb1500f115188da32d3e
-
Filesize
38KB
MD546ad12d7699b3f9a0ce5f70b08324677
SHA14b3950b2a378661310472427acaf26272373ed21
SHA2563fb1c3589b3a7636337ae5284974f79f99e4c015977a4fa1eeeeb42d79590181
SHA512d455cd28d8365380494f2ed8f59cf99fcd17dba3b94efe558d307b95abf7e232e5b17ad47f1fb068d4e3bec7214fa88e71fbb8203d1728cfe0371c5013d8d5ef
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB