phemedrone | 6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215 | Triage

Analysis

max time kernel
118s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:05

Sharing

Report Analysis Logs

General

Target

Fekubiv.exe
Size

83KB
MD5

22c2e9caea842dcd382cffa8fe73fff6
SHA1

009b40f13a1ff4622e9524fb99ebc4582e1980b5
SHA256

6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215
SHA512

7544b88ccd363231434d0442cc7c6920b66366a641ec52fd1fefae5242540b3545bf2ae0556480de1159b85bc4d2bf907834663ef1746caadd3a83694d69ca94
SSDEEP

1536:rsVbnk209AnGTYNgYd/exySO5T3rZMSwEKSKO9Tzpmd:rIjk202nBNdmxa5TbZVwEKSKO9TVI

Score

10^/10

phemedrone stealer

Malware Config

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Fekubiv.exe

description	pid	process	target process
PID 3064 wrote to memory of 2656	3064	Fekubiv.exe	WerFault.exe
PID 3064 wrote to memory of 2656	3064	Fekubiv.exe	WerFault.exe
PID 3064 wrote to memory of 2656	3064	Fekubiv.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Fekubiv.exe
"C:\Users\Admin\AppData\Local\Temp\Fekubiv.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3064 -s 520
  2⤵
  PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-0-0x0000000000190000-0x00000000001AC000-memory.dmp

Filesize
112KB

Download
memory/3064-1-0x000007FEF6140000-0x000007FEF6B2C000-memory.dmp

Filesize
9.9MB

Download
memory/3064-2-0x000007FEF6140000-0x000007FEF6B2C000-memory.dmp

Filesize
9.9MB

Download