phemedrone | 0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-01-2024 15:18

Target

0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c.exe
Size

9.5MB
MD5

eea34c5712ef820615cf10066f19ee96
SHA1

edf3b9962a80ec88254f9f40b1727064b34c6060
SHA256

0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c
SHA512

4c58bda7dad1c62a6cf900c1a0098f7786a9120dcec3fc4576230a8ca724f1921cf3a1ba16bb75ef180b6df3630bf5645d367edb673aaf87cfe340febc9f4770
SSDEEP

1536:ZDXYk5HMeaSnGT27QYd/exySO5T3rZaSwEKSKe9TzpmJ:ZzYk5HMebnzddmxa5TbZTwEKSKe9TVE

Score

10^/10

Family

phemedrone

http://mail.moscow-post.su/blog/wp-content/rss.php

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2424	1716	0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c.exe	28
PID 1716 wrote to memory of 2424	1716	0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c.exe	28
PID 1716 wrote to memory of 2424	1716	0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c.exe	28

C:\Users\Admin\AppData\Local\Temp\0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c.exe
"C:\Users\Admin\AppData\Local\Temp\0f9e01f100f9cd8db400504d5994f5c8232c318578bb33b807710289d9ef480c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1716 -s 520
  2⤵
  PID:2424

memory/1716-0-0x0000000000830000-0x000000000084C000-memory.dmp

Filesize
112KB

Download
memory/1716-1-0x000007FEF52C0000-0x000007FEF5CAC000-memory.dmp

Filesize
9.9MB

Download
memory/1716-2-0x000007FEF52C0000-0x000007FEF5CAC000-memory.dmp

Filesize
9.9MB

Download