Analysis
-
max time kernel
6s -
max time network
10s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
-
submitted
15-07-2024 14:18
General
-
Target
Orebina.exe
-
Size
115KB
-
MD5
31089248441686da3544ef1350ec2faf
-
SHA1
5aa6dd8292d6d0833ea534fe09027c091b6fe63a
-
SHA256
c6042dd27158b9a6a562fa1a3ba404ffae2c730ee456045085180630d9ae86de
-
SHA512
2914fb9341a2eb8f3f2d84f0bf24d896c0bf7ca91911a2acfa15010f16d262daa5aa041029dd3f155efa72132a5e58c9376f992711f30ab22d30026d24522252
-
SSDEEP
1536:IB0vtXMLiZV3RXYo/qR8jjjjejs6j49P5HKGbO0zde40tTjm:AatX/Vh/qRxjljQ5qwVzdv0k
Score
10/10
Malware Config
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot7019725350:AAEhQbYUNpUyzR9x63JtjaQkZtA0YVPYtN4/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Orebina.exe"C:\Users\Admin\AppData\Local\Temp\Orebina.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
144KB
-
Filesize
1.7MB