phemedrone | d72578ccb2cd7c5ae739c9cc4baf43fcf6635724bbf4cd181dc9e16a694aae42

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2024 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

opendriversetup.exe
Size

3.1MB
MD5

0de0995c98d8a1a3f7602704863321ad
SHA1

35d5f356ffd9701b91a7542497b877f30bdcf9fe
SHA256

d72578ccb2cd7c5ae739c9cc4baf43fcf6635724bbf4cd181dc9e16a694aae42
SHA512

3cdfa564adc14ed14b8bab4beacecd78aac6dc24ca4c4c10b2f3c49be808547ef3ebc01e253e983669e02d0cee3fcf3a0ad91e795e47e60ee250dc592fa3ce23
SSDEEP

6144:y3Gv0T1wpv5GIzhZSaaXVtxzS1yaUAbncSBpUYYQBHSJIUJuR:Sh1wpv5GSPS7txzS1yaUWPdVBHSI

Score

10^/10

phemedrone spyware stealer

Malware Config

Extracted

Family

phemedrone

https://rakishevkenes.com/wp-load.php

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	opendriversetup.exe

Executes dropped EXE 1 IoCs

pid	Process
2200	LDYZPLN0BSGAW.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe
2200	LDYZPLN0BSGAW.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	LDYZPLN0BSGAW.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2200	3160	opendriversetup.exe	85
PID 3160 wrote to memory of 2200	3160	opendriversetup.exe	85

C:\Users\Admin\AppData\Local\Temp\opendriversetup.exe
"C:\Users\Admin\AppData\Local\Temp\opendriversetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3160
- C:\ProgramData\USOShared\LDYZPLN0BSGAW.exe
  "C:\ProgramData\USOShared\LDYZPLN0BSGAW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOShared\LDYZPLN0BSGAW.exe

Filesize
83KB

MD5
8e599ca55f93962d2c84fc31f08d51e0

SHA1
b5a3ccb19c29763389d23a0e88c1006d4a7cb9ea

SHA256
f28445cbcbc182e67d4418726490fbc89ce5ce4ab5e2aeb73becb9f0f17e1afe

SHA512
80ac70bd065dfd5c331200b189495414fbb0fcc8f69dff7b3e056d252657e1e6e8f4a8fed043d44186120e02cc1534a6635ef3266bffb281d9e625a8d1c9b3d4

Download Submit
memory/2200-14-0x0000000000D80000-0x0000000000D9C000-memory.dmp

Filesize
112KB

Download
memory/2200-17-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

Filesize
64KB

Download
memory/2200-16-0x00007FF9CD030000-0x00007FF9CDAF1000-memory.dmp

Filesize
10.8MB

Download
memory/2200-19-0x00007FF9CD030000-0x00007FF9CDAF1000-memory.dmp

Filesize
10.8MB

Download
memory/3160-0-0x00000000001A0000-0x000000000021A000-memory.dmp

Filesize
488KB

Download
memory/3160-1-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/3160-15-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download