phemedrone | 81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 17:16

Target

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Size

144KB
MD5

9260f5e80678b6490676270838c08941
SHA1

2a01024380703d67bc59b47c109f255e59a1554b
SHA256

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7
SHA512

53b2999b1e3aec6cc6b58f7f3845f180060cea68f055a0632f325a3c28e7232a9362ea112ade2ca1a178e621187bf3200d9e5b531361f7f1f938f28a6fd4f32c
SSDEEP

3072:nywhuhNC38S7gzQ/cGD4UdYs2sbyYtLt/w/HOWJbG5vcX+1kwEKEAm31D1:+zQ/FnbyIw/uWJbGF1REKQ1

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Modifies registry class 5 IoCs

Processes:

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open\command	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\ms-settings\shell\open\command\	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe

C:\Users\Admin\AppData\Local\Temp\81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
"C:\Users\Admin\AppData\Local\Temp\81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe"
1⤵
- Modifies registry class
PID:884

memory/884-1-0x00007FFECB833000-0x00007FFECB835000-memory.dmp

Filesize
8KB

Download
memory/884-0-0x000002B4446C0000-0x000002B4446EA000-memory.dmp

Filesize
168KB

Download
memory/884-2-0x00007FFECB830000-0x00007FFECC2F1000-memory.dmp

Filesize
10.8MB

Download
memory/884-3-0x00007FFECB830000-0x00007FFECC2F1000-memory.dmp

Filesize
10.8MB

Download