phemedrone | 3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 01:14

Target

3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Size

144KB
MD5

319218e4eb0d6637a76668a228e32de3
SHA1

20523303d722a7747deb6154a5d4401e1b932d56
SHA256

3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358
SHA512

db3d1637c178bdf3c8c5b754fe72c388a3da176b2d0a7727e89f2c257bcb93b1574eda1de7f6ea25e493949f47157c07637fbe1169fe6c9481cc42d925293fe6
SSDEEP

3072:HGNhvhNC38S7gzQ/cmD4ULz82nyLOLt/w/HOWJbG5vcX+skwEKEAm31D5:EzQ/2my2w/uWJbGFsREKQ1

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Modifies registry class 5 IoCs

Processes:

3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell\open\command	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell\open	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\ms-settings\shell\open\command\	3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe

C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
"C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe"
1⤵
- Modifies registry class
PID:1612

memory/1612-0-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/1612-2-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download
memory/1612-3-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/1612-4-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download