phemedrone | 81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 08:44

Target

Xujamon_LetThereBeNightingale.exe
Size

144KB
MD5

9260f5e80678b6490676270838c08941
SHA1

2a01024380703d67bc59b47c109f255e59a1554b
SHA256

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7
SHA512

53b2999b1e3aec6cc6b58f7f3845f180060cea68f055a0632f325a3c28e7232a9362ea112ade2ca1a178e621187bf3200d9e5b531361f7f1f938f28a6fd4f32c
SSDEEP

3072:nywhuhNC38S7gzQ/cGD4UdYs2sbyYtLt/w/HOWJbG5vcX+1kwEKEAm31D1:+zQ/FnbyIw/uWJbGF1REKQ1

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Modifies registry class 5 IoCs

Processes:

Xujamon_LetThereBeNightingale.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\ms-settings\shell\open\command	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\ms-settings	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\ms-settings\shell	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\ms-settings\shell\open	Xujamon_LetThereBeNightingale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\ms-settings\shell\open\command\	Xujamon_LetThereBeNightingale.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Xujamon_LetThereBeNightingale.exe

description	pid	process	target process
PID 2072 wrote to memory of 2608	2072	Xujamon_LetThereBeNightingale.exe	WerFault.exe
PID 2072 wrote to memory of 2608	2072	Xujamon_LetThereBeNightingale.exe	WerFault.exe
PID 2072 wrote to memory of 2608	2072	Xujamon_LetThereBeNightingale.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2072 -s 636
2⤵
PID:2608

memory/2072-0-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000001320000-0x000000000134A000-memory.dmp

Filesize
168KB

Download
memory/2072-2-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2072-3-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

Filesize
4KB

Download
memory/2072-4-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download