Overview

overview

10

Static

static

10

3bb41473ee...58.exe

windows7-x64

10

3bb41473ee...58.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 15:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe

  • Size

    144KB

  • MD5

    319218e4eb0d6637a76668a228e32de3

  • SHA1

    20523303d722a7747deb6154a5d4401e1b932d56

  • SHA256

    3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358

  • SHA512

    db3d1637c178bdf3c8c5b754fe72c388a3da176b2d0a7727e89f2c257bcb93b1574eda1de7f6ea25e493949f47157c07637fbe1169fe6c9481cc42d925293fe6

  • SSDEEP

    3072:HGNhvhNC38S7gzQ/cmD4ULz82nyLOLt/w/HOWJbG5vcX+skwEKEAm31D5:EzQ/2my2w/uWJbGFsREKQ1

Score
10/10
phemedroneexecutionpersistencespywarestealer

Malware Config

Signatures

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
    "C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\3bb41473ee7e39b74fc96fadc0551780dbb08190c540c690e11b492952b33358.exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:532
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3588
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:4308

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      64B

      MD5

      7274a07d1b80de6f66290b47588cee3b

      SHA1

      d926b384806c755fe6b9d03f68852765aabb5703

      SHA256

      5eba7517357473e4d5d7ede75c3768069c578d2b0023473fd67f76b373430de8

      SHA512

      b7813fea9091298d48c87b259b0d4473ddc4480667f82ed6b5f8bdfa600590dcbfb1d62cbaca649dcf321d85cb786bf62d48826ab04297a22b7c88439b94bcf3

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yt4vm1ly.ymz.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit
    • memory/1864-0-0x000001EA57C80000-0x000001EA57CAA000-memory.dmp
      Filesize

      168KB

      Download
    • memory/1864-2-0x00007FFEE3D80000-0x00007FFEE4841000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/1864-1-0x00007FFEE3D83000-0x00007FFEE3D85000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1864-31-0x00007FFEE3D83000-0x00007FFEE3D85000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1864-32-0x00007FFEE3D80000-0x00007FFEE4841000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3588-3-0x00007FFEE3D80000-0x00007FFEE4841000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3588-14-0x00007FFEE3D80000-0x00007FFEE4841000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3588-13-0x0000017A6FA20000-0x0000017A6FA42000-memory.dmp
      Filesize

      136KB

      Download
    • memory/3588-15-0x00007FFEE3D80000-0x00007FFEE4841000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/3588-27-0x00007FFEE3D80000-0x00007FFEE4841000-memory.dmp
      Filesize

      10.8MB

      Download