phemedrone | c93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 18:08

Target

NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe
Size

159KB
MD5

8993b5ec83aa894aea936c3a268bcad1
SHA1

7848e3a3155c386c069495ce0bf0806453d6a338
SHA256

c93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433
SHA512

cbff3880c90a6b5a6c5f763fe1603627c56911d96395aa92eb81d6ae2b3c27a44040b1e70d2ecac78f02991329b5a7428d4828bc8ee2cf90a5bbf3c573efb487
SSDEEP

3072:RuipBBsGzDvh07fs4RyPB2pMPVlfV9YUVhxPYKBYXylPW9Y/:RhpBBs+DJ07kagV2KYtg

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	1720	WerFault.exe	17

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27
PID 1720 wrote to memory of 3044	1720	NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 752
  2⤵
  - Program crash
  PID:3044

memory/1720-0-0x0000000000EB0000-0x0000000000EDE000-memory.dmp

Filesize
184KB

Download
memory/1720-1-0x0000000000390000-0x00000000003AE000-memory.dmp

Filesize
120KB

Download
memory/1720-2-0x00000000005F0000-0x000000000060C000-memory.dmp

Filesize
112KB

Download