phemedrone | 81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7

Analysis

max time kernel
132s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 08:44

Target

Xujamon_LetThereBeNightingale.exe
Size

144KB
MD5

9260f5e80678b6490676270838c08941
SHA1

2a01024380703d67bc59b47c109f255e59a1554b
SHA256

81e99ca58577796d708d682e7a3807f507d9f650307a15033835116c28b149f7
SHA512

53b2999b1e3aec6cc6b58f7f3845f180060cea68f055a0632f325a3c28e7232a9362ea112ade2ca1a178e621187bf3200d9e5b531361f7f1f938f28a6fd4f32c
SSDEEP

3072:nywhuhNC38S7gzQ/cGD4UdYs2sbyYtLt/w/HOWJbG5vcX+1kwEKEAm31D1:+zQ/FnbyIw/uWJbGF1REKQ1

Score

10^/10

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone

Modifies registry class 5 IoCs

Processes:

Xujamon_LetThereBeNightingale.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell\open	Xujamon_LetThereBeNightingale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell\open\command\	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell\open\command	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings	Xujamon_LetThereBeNightingale.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\ms-settings\shell	Xujamon_LetThereBeNightingale.exe

C:\Users\Admin\AppData\Local\Temp\Xujamon_LetThereBeNightingale.exe
"C:\Users\Admin\AppData\Local\Temp\Xujamon_LetThereBeNightingale.exe"
1⤵
- Modifies registry class
PID:3296

memory/3296-0-0x00007FFB523E3000-0x00007FFB523E5000-memory.dmp

Filesize
8KB

Download
memory/3296-1-0x0000028329E30000-0x0000028329E5A000-memory.dmp

Filesize
168KB

Download
memory/3296-2-0x00007FFB523E0000-0x00007FFB52EA1000-memory.dmp

Filesize
10.8MB

Download
memory/3296-3-0x00007FFB523E0000-0x00007FFB52EA1000-memory.dmp

Filesize
10.8MB

Download