phemedrone | 3fb1c3589b3a7636337ae5284974f79f99e4c015977a4fa1eeeeb42d79590181 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 01:35

Sharing

Report Analysis Logs

General

Target

Jefutyl.exe
Size

84KB
MD5

823791a9bfed88b3af85698e8f019254
SHA1

506803fd5335f75862e0ea271716a6e97cd66b13
SHA256

58b525579968cba0c68e8f7ae12e51e0b5542acc2c14a2e75fa6df44556e373f
SHA512

40f3dfc08ba7868b1d6310418fc799ea6266e3d70ee098d1ab77213eb4451578a316de0f347101b5b83ac393a793442cd748f8ced56dac71c4de607c0f07da26
SSDEEP

1536:zhu9D+Oy/Dn/hP8PGTzBwZ6YWKSO5T3rZvSwEKSK99jzpma:zhu9WL/hEPeGU5S5TbZawEKSK99jVH

Score

10^/10

phemedrone stealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot6421901210:AAErC913wmPS9T_-XJrvOWFdTxw2TkS248A/sendMessage?chat_id=5896425070

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Jefutyl.exe

description	pid	process	target process
PID 1792 wrote to memory of 2920	1792	Jefutyl.exe	WerFault.exe
PID 1792 wrote to memory of 2920	1792	Jefutyl.exe	WerFault.exe
PID 1792 wrote to memory of 2920	1792	Jefutyl.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Jefutyl.exe
"C:\Users\Admin\AppData\Local\Temp\Jefutyl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1792 -s 520
  2⤵
  PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-0-0x0000000000A20000-0x0000000000A3C000-memory.dmp

Filesize
112KB

Download
memory/1792-1-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download
memory/1792-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download