phemedrone | 95ddb8a73ba1d02c13735fe21f335599e0659b3da7b42e23654650b89d4ddf60 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09-10-2023 17:43

Sharing

Report Analysis Logs

General

Target

0x001a000000015c3e-10.exe
Size

83KB
MD5

e025c7bfa143c476a648e9daa3cfda2f
SHA1

d4f90ae2727cd20c19802eeee5589fc4e7b36ec3
SHA256

95ddb8a73ba1d02c13735fe21f335599e0659b3da7b42e23654650b89d4ddf60
SHA512

f9812370e7855acaa15f70a5ee71fa2b78040be72553cc4109276429731ab3a10924fd8e08b8ff91e9c3b0dc57c4bc32168c29416e4a401208fd2574dbd9b8f3
SSDEEP

1536:YNHNY8knGTS8Yd/exySO5T3rZlSwEKSKO9Tzpmp:YNHNYfnrZdmxa5TbZYwEKSKO9TVk

Score

10^/10

phemedrone stealer

Malware Config

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0x001a000000015c3e-10.exe

description	pid	process	target process
PID 2320 wrote to memory of 2616	2320	0x001a000000015c3e-10.exe	WerFault.exe
PID 2320 wrote to memory of 2616	2320	0x001a000000015c3e-10.exe	WerFault.exe
PID 2320 wrote to memory of 2616	2320	0x001a000000015c3e-10.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0x001a000000015c3e-10.exe
"C:\Users\Admin\AppData\Local\Temp\0x001a000000015c3e-10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 520
  2⤵
  PID:2616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-0-0x00000000012F0000-0x000000000130C000-memory.dmp

Filesize
112KB

Download
memory/2320-1-0x000007FEF5D60000-0x000007FEF674C000-memory.dmp

Filesize
9.9MB

Download
memory/2320-2-0x000007FEF5D60000-0x000007FEF674C000-memory.dmp

Filesize
9.9MB

Download