phemedrone | c93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433

Analysis

max time kernel
161s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 01:58

Target

togo.exe
Size

159KB
MD5

8993b5ec83aa894aea936c3a268bcad1
SHA1

7848e3a3155c386c069495ce0bf0806453d6a338
SHA256

c93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433
SHA512

cbff3880c90a6b5a6c5f763fe1603627c56911d96395aa92eb81d6ae2b3c27a44040b1e70d2ecac78f02991329b5a7428d4828bc8ee2cf90a5bbf3c573efb487
SSDEEP

3072:RuipBBsGzDvh07fs4RyPB2pMPVlfV9YUVhxPYKBYXylPW9Y/:RhpBBs+DJ07kagV2KYtg

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1232 3684 WerFault.exe togo.exe

pid	pid_target	process	target process
1232	3684	WerFault.exe	togo.exe

C:\Users\Admin\AppData\Local\Temp\togo.exe
"C:\Users\Admin\AppData\Local\Temp\togo.exe"
1⤵
PID:3684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 924
  2⤵
  - Program crash
  PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3684 -ip 3684
1⤵
PID:776

memory/3684-0-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/3684-1-0x0000000000570000-0x000000000059E000-memory.dmp

Filesize
184KB

Download
memory/3684-2-0x0000000004800000-0x000000000481E000-memory.dmp

Filesize
120KB

Download
memory/3684-3-0x0000000004D40000-0x0000000004D5C000-memory.dmp

Filesize
112KB

Download
memory/3684-4-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/3684-5-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download