phemedrone | 6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215

Resubmissions

26/10/2023, 15:52

13/10/2023, 16:56

max time kernel
120s
max time network
148s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 16:56

Target

NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe
Size

83KB
MD5

22c2e9caea842dcd382cffa8fe73fff6
SHA1

009b40f13a1ff4622e9524fb99ebc4582e1980b5
SHA256

6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215
SHA512

7544b88ccd363231434d0442cc7c6920b66366a641ec52fd1fefae5242540b3545bf2ae0556480de1159b85bc4d2bf907834663ef1746caadd3a83694d69ca94
SSDEEP

1536:rsVbnk209AnGTYNgYd/exySO5T3rZMSwEKSKO9Tzpmd:rIjk202nBNdmxa5TbZVwEKSKO9TVI

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2596	2316	NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe	28
PID 2316 wrote to memory of 2596	2316	NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe	28
PID 2316 wrote to memory of 2596	2316	NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2316 -s 524
  2⤵
  PID:2596

memory/2316-0-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Filesize
112KB

Download
memory/2316-1-0x000007FEF5180000-0x000007FEF5B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2316-2-0x000007FEF5180000-0x000007FEF5B6C000-memory.dmp

Filesize
9.9MB

Download