Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
01-12-2023 05:09
General
-
Target
AllParse_Log/codec-library.exe
-
Size
84KB
-
MD5
889a77ec865cef4310258ba20e980302
-
SHA1
554cec7ecef4d6f12ab787fa4673fc9aab24051d
-
SHA256
eebdeac6e6bca0a720c047291a85dbb4e0c17f18af0e20b8a0c645360ae66626
-
SHA512
1bf5b559c6091eac1b1f616f28ed2159fb32af57de6a965d659d1df235442a0bf578cb1ab3e6af95acb966f0197a5305608d3c1ba6c049a2f20f3805a8989c40
-
SSDEEP
1536:4cZc9o6ieQnPou2PGTeR7CfoWKSO5T3rZfvSwEKSKt9jzpmO:4ci9MnPo3PHtmpS5TbZfawEKSKt9jVb
Malware Config
Extracted
phemedrone
https://api.telegram.org/bot6546988438:AAF4CYLITzgov4BI5_0csUsC5C49FDi5D6Y/sendMessage?chat_id=554005447
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AllParse_Log\codec-library.exe"C:\Users\Admin\AppData\Local\Temp\AllParse_Log\codec-library.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB