phemedrone | b0c22f4878dacf6fcbbc585599aa5685f06646958d2f41afa237eed18e99e2ab

Analysis

max time kernel
140s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 02:03

Target

1684-1-0x0000000000460000-0x000000000047E000-memory.exe
Size

120KB
MD5

a98612096908dc10ddfb8b7d39037547
SHA1

fd1e2fd5bea052b016c876dbe88d94af8e4a977a
SHA256

b0c22f4878dacf6fcbbc585599aa5685f06646958d2f41afa237eed18e99e2ab
SHA512

30b2c89e47b2cefc4f58e914042835e2efcafef2e330c645d24b1fc14b548dbaec3c3a7428b75c4e7382ff7a1779ea30f159ed97243a43d5b2ce86fbcc4c7429
SSDEEP

3072:oFM13HiPeK2hS5TbZuwEKSKe9jVQPnkk+:De2hExEKy9jV

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3932 1856 WerFault.exe 1684-1-0x0000000000460000-0x000000000047E000-memory.exe

pid	pid_target	process	target process
3932	1856	WerFault.exe	1684-1-0x0000000000460000-0x000000000047E000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1684-1-0x0000000000460000-0x000000000047E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1684-1-0x0000000000460000-0x000000000047E000-memory.exe"
1⤵
PID:1856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 812
  2⤵
  - Program crash
  PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1856 -ip 1856
1⤵
PID:624

memory/1856-0-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/1856-1-0x0000000000DB0000-0x0000000000DCE000-memory.dmp

Filesize
120KB

Download
memory/1856-2-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/1856-3-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download