phemedrone | 0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c | Triage

Analysis

max time kernel
49s
max time network
17s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 22:04

Sharing

Report Analysis Logs

General

Target

WHuK.exe
Size

9.5MB
MD5

eea34c5712ef820615cf10066f19ee96
SHA1

edf3b9962a80ec88254f9f40b1727064b34c6060
SHA256

0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c
SHA512

4c58bda7dad1c62a6cf900c1a0098f7786a9120dcec3fc4576230a8ca724f1921cf3a1ba16bb75ef180b6df3630bf5645d367edb673aaf87cfe340febc9f4770
SSDEEP

1536:ZDXYk5HMeaSnGT27QYd/exySO5T3rZaSwEKSKe9TzpmJ:ZzYk5HMebnzddmxa5TbZTwEKSKe9TVE

Score

10^/10

phemedrone stealer

Malware Config

Extracted

Family

phemedrone

C2

http://mail.moscow-post.su/blog/wp-content/rss.php

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WHuK.exe

description	pid	process	target process
PID 2936 wrote to memory of 1584	2936	WHuK.exe	WerFault.exe
PID 2936 wrote to memory of 1584	2936	WHuK.exe	WerFault.exe
PID 2936 wrote to memory of 1584	2936	WHuK.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\WHuK.exe
"C:\Users\Admin\AppData\Local\Temp\WHuK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2936 -s 524
  2⤵
  PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000000910000-0x000000000092C000-memory.dmp

Filesize
112KB

Download
memory/2936-1-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-2-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download