phemedrone | 0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-12-2023 03:23

Target

eea34c5712ef820615cf10066f19ee96.exe
Size

9.5MB
MD5

eea34c5712ef820615cf10066f19ee96
SHA1

edf3b9962a80ec88254f9f40b1727064b34c6060
SHA256

0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c
SHA512

4c58bda7dad1c62a6cf900c1a0098f7786a9120dcec3fc4576230a8ca724f1921cf3a1ba16bb75ef180b6df3630bf5645d367edb673aaf87cfe340febc9f4770
SSDEEP

1536:ZDXYk5HMeaSnGT27QYd/exySO5T3rZaSwEKSKe9TzpmJ:ZzYk5HMebnzddmxa5TbZTwEKSKe9TVE

Score

10^/10

Family

phemedrone

http://mail.moscow-post.su/blog/wp-content/rss.php

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2660	1192	eea34c5712ef820615cf10066f19ee96.exe	28
PID 1192 wrote to memory of 2660	1192	eea34c5712ef820615cf10066f19ee96.exe	28
PID 1192 wrote to memory of 2660	1192	eea34c5712ef820615cf10066f19ee96.exe	28

C:\Users\Admin\AppData\Local\Temp\eea34c5712ef820615cf10066f19ee96.exe
"C:\Users\Admin\AppData\Local\Temp\eea34c5712ef820615cf10066f19ee96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1192 -s 524
  2⤵
  PID:2660

memory/1192-0-0x00000000008D0000-0x00000000008EC000-memory.dmp

Filesize
112KB

Download
memory/1192-1-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/1192-2-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download