phemedrone | c93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433

Analysis

max time kernel
153s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 18:08

Target

NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe
Size

159KB
MD5

8993b5ec83aa894aea936c3a268bcad1
SHA1

7848e3a3155c386c069495ce0bf0806453d6a338
SHA256

c93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433
SHA512

cbff3880c90a6b5a6c5f763fe1603627c56911d96395aa92eb81d6ae2b3c27a44040b1e70d2ecac78f02991329b5a7428d4828bc8ee2cf90a5bbf3c573efb487
SSDEEP

3072:RuipBBsGzDvh07fs4RyPB2pMPVlfV9YUVhxPYKBYXylPW9Y/:RhpBBs+DJ07kagV2KYtg

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1768	4420	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASc93d28e89af52917c466181f07f704b19501d876b43788af4e89ea5e3e9bc433exeexeexe_JC.exe"
1⤵
PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 928
  2⤵
  - Program crash
  PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4420 -ip 4420
1⤵
PID:3872

memory/4420-0-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/4420-1-0x00000000008D0000-0x00000000008FE000-memory.dmp

Filesize
184KB

Download
memory/4420-2-0x0000000002B60000-0x0000000002B7E000-memory.dmp

Filesize
120KB

Download
memory/4420-3-0x0000000002DA0000-0x0000000002DBC000-memory.dmp

Filesize
112KB

Download
memory/4420-4-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download