phemedrone | 16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 11:44

Target

16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe
Size

4.2MB
MD5

0e400e6ed80197205ccdc0646f651724
SHA1

5eb32b8777042808031b230b56c90219aac14e9b
SHA256

16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb
SHA512

a78d2a04b44eaa30714077c0ef5022cdfd13174dec75c70836ed634792ffddcf00b87107d43348eae19501bc5ed37051e66fe1eb45d45d4cb507684123c3ddf8
SSDEEP

49152:Jrp0RTvLDh8gKs11AJJyL6BcV7gF19Bdt+7SvU9Sp5vK:shqLB5IS1K

Score

10^/10

Family

phemedrone

10.5.0.2

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1184 set thread context of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3428	3420	WerFault.exe	90

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\ms-settings\shell\open\command\	regsvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\ms-settings\shell\open\command	regsvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\ms-settings	regsvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\ms-settings\shell	regsvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\ms-settings\shell\open	regsvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4744	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	86
PID 1184 wrote to memory of 4744	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	86
PID 1184 wrote to memory of 4744	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	86
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90
PID 1184 wrote to memory of 3420	1184	16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe	90

C:\Users\Admin\AppData\Local\Temp\16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe
"C:\Users\Admin\AppData\Local\Temp\16816b6027e02cce55c0712baab6171eb9d90d0aebc3fc79b441d63c1c68dabb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:4744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Modifies registry class
  PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1048
    3⤵
    - Program crash
    PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3420 -ip 3420
1⤵
PID:4308

memory/3420-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3420-1-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download
memory/3420-2-0x0000000005C50000-0x00000000061F4000-memory.dmp

Filesize
5.6MB

Download
memory/3420-3-0x0000000005730000-0x0000000005740000-memory.dmp

Filesize
64KB

Download
memory/3420-4-0x0000000074BD0000-0x0000000075380000-memory.dmp

Filesize
7.7MB

Download