phemedrone | 0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c | Triage

Analysis

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/12/2023, 21:59

Sharing

Report Analysis Logs

General

Target

GH Injector - x64.exe
Size

9.5MB
MD5

eea34c5712ef820615cf10066f19ee96
SHA1

edf3b9962a80ec88254f9f40b1727064b34c6060
SHA256

0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c
SHA512

4c58bda7dad1c62a6cf900c1a0098f7786a9120dcec3fc4576230a8ca724f1921cf3a1ba16bb75ef180b6df3630bf5645d367edb673aaf87cfe340febc9f4770
SSDEEP

1536:ZDXYk5HMeaSnGT27QYd/exySO5T3rZaSwEKSKe9TzpmJ:ZzYk5HMebnzddmxa5TbZTwEKSKe9TVE

Score

10^/10

phemedrone stealer

Malware Config

Extracted

Family

phemedrone

C2

http://mail.moscow-post.su/blog/wp-content/rss.php

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2288	2756	GH Injector - x64.exe	28
PID 2756 wrote to memory of 2288	2756	GH Injector - x64.exe	28
PID 2756 wrote to memory of 2288	2756	GH Injector - x64.exe	28

C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe
"C:\Users\Admin\AppData\Local\Temp\GH Injector - x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2756 -s 520
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x0000000000020000-0x000000000003C000-memory.dmp

Filesize
112KB

Download
memory/2756-1-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/2756-2-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download