phemedrone | 6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215

Resubmissions

26-10-2023 15:52

13-10-2023 16:56

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
26-10-2023 15:52

Target

NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe
Size

83KB
MD5

22c2e9caea842dcd382cffa8fe73fff6
SHA1

009b40f13a1ff4622e9524fb99ebc4582e1980b5
SHA256

6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215
SHA512

7544b88ccd363231434d0442cc7c6920b66366a641ec52fd1fefae5242540b3545bf2ae0556480de1159b85bc4d2bf907834663ef1746caadd3a83694d69ca94
SSDEEP

1536:rsVbnk209AnGTYNgYd/exySO5T3rZMSwEKSKO9Tzpmd:rIjk202nBNdmxa5TbZVwEKSKO9TVI

Score

10^/10

Family

phemedrone

162.213.251.134:228

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2000	2188	NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe	28
PID 2188 wrote to memory of 2000	2188	NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe	28
PID 2188 wrote to memory of 2000	2188	NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS6bccfdbe392cf2eef8a337fbb8af90a662773d8cd73cec1ac1e0f51686840215exeexeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 520
  2⤵
  PID:2000

memory/2188-0-0x0000000000F00000-0x0000000000F1C000-memory.dmp

Filesize
112KB

Download
memory/2188-1-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download
memory/2188-2-0x000007FEF5350000-0x000007FEF5D3C000-memory.dmp

Filesize
9.9MB

Download