Overview
overview
10Static
static
10COMPILED/P...ls.exe
windows7-x64
1COMPILED/P...ls.exe
windows10-2004-x64
1SRC/Phemed...em.exe
windows7-x64
10SRC/Phemed...em.exe
windows10-2004-x64
10SRC/Phemed...ess.js
windows7-x64
3SRC/Phemed...ess.js
windows10-2004-x64
3SRC/Phemed...ble.js
windows7-x64
3SRC/Phemed...ble.js
windows10-2004-x64
3SRC/Phemed...ker.js
windows7-x64
3SRC/Phemed...ker.js
windows10-2004-x64
3SRC/Phemed...ram.js
windows7-x64
3SRC/Phemed...ram.js
windows10-2004-x64
3SRC/Phemed...ver.js
windows7-x64
3SRC/Phemed...ver.js
windows10-2004-x64
3SRC/Phemed...el.exe
windows7-x64
1SRC/Phemed...el.exe
windows10-2004-x64
1SRC/Phemed...st.exe
windows7-x64
1SRC/Phemed...st.exe
windows10-2004-x64
1SRC/Phemed...st.exe
windows7-x64
1SRC/Phemed...st.exe
windows10-2004-x64
1SRC/Phemed...el.exe
windows7-x64
1SRC/Phemed...el.exe
windows10-2004-x64
1SRC/Phemed...el.exe
windows7-x64
1SRC/Phemed...el.exe
windows10-2004-x64
1SRC/Phemed...ger.js
windows7-x64
3SRC/Phemed...ger.js
windows10-2004-x64
3SRC/Phemed...ion.js
windows7-x64
3SRC/Phemed...ion.js
windows10-2004-x64
3SRC/Phemed...ase.js
windows7-x64
3SRC/Phemed...ase.js
windows10-2004-x64
3SRC/Phemed...ues.js
windows7-x64
3SRC/Phemed...ues.js
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 16:35
Behavioral task
behavioral1
Sample
COMPILED/Phemedrone.Tools.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
COMPILED/Phemedrone.Tools.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
SRC/Phemedrone-Stealer/obj/Release/system.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
SRC/Phemedrone-Stealer/obj/Release/system.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
SRC/Phemedrone.Panel/ComparableIpAddress.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
SRC/Phemedrone.Panel/ComparableIpAddress.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
SRC/Phemedrone.Panel/ConsoleTable.js
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
SRC/Phemedrone.Panel/ConsoleTable.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
SRC/Phemedrone.Panel/DatabaseWorker.js
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
SRC/Phemedrone.Panel/DatabaseWorker.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
SRC/Phemedrone.Panel/Program.js
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
SRC/Phemedrone.Panel/Program.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
SRC/Phemedrone.Panel/TcpServer.js
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
SRC/Phemedrone.Panel/TcpServer.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
SRC/Phemedrone.Panel/obj/Debug/net7.0/Phemedrone.Panel.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
SRC/Phemedrone.Panel/obj/Debug/net7.0/Phemedrone.Panel.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
SRC/Phemedrone.Panel/obj/Debug/net7.0/apphost.exe
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
SRC/Phemedrone.Panel/obj/Debug/net7.0/apphost.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
SRC/Phemedrone.Panel/obj/Release/net7.0/apphost.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
SRC/Phemedrone.Panel/obj/Release/net7.0/apphost.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
SRC/Phemedrone.Panel/obj/Release/net7.0/ref/Phemedrone.Panel.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
SRC/Phemedrone.Panel/obj/Release/net7.0/ref/Phemedrone.Panel.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
SRC/Phemedrone.Panel/obj/Release/net7.0/refint/Phemedrone.Panel.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
SRC/Phemedrone.Panel/obj/Release/net7.0/refint/Phemedrone.Panel.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
SRC/Phemedrone.Tools/Builder/ConstantChanger.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
SRC/Phemedrone.Tools/Builder/ConstantChanger.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
SRC/Phemedrone.Tools/Builder/Injection.js
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
SRC/Phemedrone.Tools/Builder/Injection.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
SRC/Phemedrone.Tools/Builder/Phase.js
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
SRC/Phemedrone.Tools/Builder/Phase.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
SRC/Phemedrone.Tools/Builder/RandomValues.js
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
SRC/Phemedrone.Tools/Builder/RandomValues.js
Resource
win10v2004-20240426-en
General
-
Target
SRC/Phemedrone.Panel/obj/Debug/net7.0/Phemedrone.Panel.exe
-
Size
31KB
-
MD5
55a0c6b4690ba8fae321d2b1c8939141
-
SHA1
f210cad92ffeccd68ab2e02b7d1ce9c12e2194ee
-
SHA256
2092b040b58a6f18784c3f141e24a8203cdae241c52322b08818531a9f0952cc
-
SHA512
01f25519012d2bf97a7290949e161b7daded77d6e4bf9e046c51df43aaf6b33aab2fc659e611cbcaa44a5ce0312fd398603b2dd3803fc4d39fd232ce1ff5578e
-
SSDEEP
768:+5mBvLDW+km1UgPZqXwFXju+e3LoTUTHe:5HRkwxEyXjuvLCUT+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Phemedrone.Panel.exedescription pid process target process PID 2908 wrote to memory of 2160 2908 Phemedrone.Panel.exe WerFault.exe PID 2908 wrote to memory of 2160 2908 Phemedrone.Panel.exe WerFault.exe PID 2908 wrote to memory of 2160 2908 Phemedrone.Panel.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SRC\Phemedrone.Panel\obj\Debug\net7.0\Phemedrone.Panel.exe"C:\Users\Admin\AppData\Local\Temp\SRC\Phemedrone.Panel\obj\Debug\net7.0\Phemedrone.Panel.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2908 -s 5082⤵PID:2160
-