Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
07-07-2024 22:31
General
-
Target
ad9c3a743ab48629ef8b02e26c82cb0f497669d8ae3b236758f997f695e78c73.exe
-
Size
111KB
-
MD5
6c2c7ef5b5716d674991e364750ff233
-
SHA1
abce149b0532326458909c21e6e13063a92f3251
-
SHA256
ad9c3a743ab48629ef8b02e26c82cb0f497669d8ae3b236758f997f695e78c73
-
SHA512
cf673f324030bb23bfce9e09d3c8d10ceb108fb962557a141f1200d31e89ec4e4c1654d3d6c0657eb38ba4942ab0cc6a7bfffd6159c8d989214c6b94350113ea
-
SSDEEP
1536:L66Cxsr7any9okBEO623Dnii5/u/TMhDLLUfmK5eR+2yMV:Qx6any1EO623/5G/Q1LQmK5eRFt
Score
10/10
Malware Config
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot6861530662:AAFueJRxaIZGz_oVT2-CVuuL9N0MRsh-5_Y/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad9c3a743ab48629ef8b02e26c82cb0f497669d8ae3b236758f997f695e78c73.exe"C:\Users\Admin\AppData\Local\Temp\ad9c3a743ab48629ef8b02e26c82cb0f497669d8ae3b236758f997f695e78c73.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB