phemedrone | 81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7

Analysis

max time kernel
90s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
18-06-2024 17:16

Target

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Size

144KB
MD5

9260f5e80678b6490676270838c08941
SHA1

2a01024380703d67bc59b47c109f255e59a1554b
SHA256

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7
SHA512

53b2999b1e3aec6cc6b58f7f3845f180060cea68f055a0632f325a3c28e7232a9362ea112ade2ca1a178e621187bf3200d9e5b531361f7f1f938f28a6fd4f32c
SSDEEP

3072:nywhuhNC38S7gzQ/cGD4UdYs2sbyYtLt/w/HOWJbG5vcX+1kwEKEAm31D1:+zQ/FnbyIw/uWJbGF1REKQ1

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Modifies registry class 5 IoCs

Processes:

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\ms-settings	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\ms-settings\shell	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\ms-settings\shell\open	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\ms-settings\shell\open\command\	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
Key created	\REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\ms-settings\shell\open\command	81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe

C:\Users\Admin\AppData\Local\Temp\81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe
"C:\Users\Admin\AppData\Local\Temp\81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7.exe"
1⤵
- Modifies registry class
PID:1916

memory/1916-1-0x0000026C8A150000-0x0000026C8A17A000-memory.dmp

Filesize
168KB

Download
memory/1916-0-0x00007FFB728F3000-0x00007FFB728F5000-memory.dmp

Filesize
8KB

Download
memory/1916-2-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmp

Filesize
10.8MB

Download
memory/1916-3-0x00007FFB728F0000-0x00007FFB733B2000-memory.dmp

Filesize
10.8MB

Download