phemedrone | b31185a0d4d7d84a3beb7f81f545ddfb057d6047d022b69d9fa69aaba1fafca2

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 21:55

Target

2924-2-0x000000001C0B0000-0x000000001C366000-memory.exe
Size

2.7MB
MD5

4fea4fd8afbe4909250caee983b1ed76
SHA1

4b188640b0a52b097d8f916de3a4ab688578deae
SHA256

b31185a0d4d7d84a3beb7f81f545ddfb057d6047d022b69d9fa69aaba1fafca2
SHA512

3fdab7744642469dfe80418fa652d6c953c52243cd4bcf36d69bd4b1640525ae37184168f614bae947c542a9e20e966f55686bc8d1a719e25203cb44a71293f0
SSDEEP

49152:BdqjjjwCbjOHImjYjjj0j2jjjjjjjjjj9jjjJNm3djjQ9y2LrWipiCp8WqxZsq4U:BdqjjjwCbjOHImjYjjj0j2jjjjjjjjj2

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2304	2436	2924-2-0x000000001C0B0000-0x000000001C366000-memory.exe	28
PID 2436 wrote to memory of 2304	2436	2924-2-0x000000001C0B0000-0x000000001C366000-memory.exe	28
PID 2436 wrote to memory of 2304	2436	2924-2-0x000000001C0B0000-0x000000001C366000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2924-2-0x000000001C0B0000-0x000000001C366000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2924-2-0x000000001C0B0000-0x000000001C366000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2436 -s 528
  2⤵
  PID:2304

memory/2436-0-0x000000013FE50000-0x0000000140106000-memory.dmp

Filesize
2.7MB

Download
memory/2436-1-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download
memory/2436-2-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download