Analysis
-
max time kernel
63s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 10:26
Behavioral task
behavioral1
Sample
system.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
system.exe
-
Size
102KB
-
MD5
0ceb0be41ead02c760f6f7b3e64c65c0
-
SHA1
9375b6dbd0176882db2bb1b5cc37e8e97f810fc5
-
SHA256
72a5aa555bdd7de1bdc6fc47a39c50191f8ddba1f4445c0444f6f3c4e95122ec
-
SHA512
2641f11a2801d40932d2e972320d3e50a3b10c5537543dbe57cca6a22dfb0f6e5b5f1b24479d1bf9c26c9b62835a0b7c2e6ede2f41fa4facbf0cde88c6b4274c
-
SSDEEP
3072:c1y3CkjNR6+ueZ04+cZ5Q5yZ53wEKnuf:tSkj36+u94W5EK
Score
10/10
Malware Config
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot7329972286:AAEOM1j7YMzqyniSmjEDT3zUq-fyt1rbFgA/sendMessage?chat_id=6732975817
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3304 taskmgr.exe Token: SeSystemProfilePrivilege 3304 taskmgr.exe Token: SeCreateGlobalPrivilege 3304 taskmgr.exe Token: 33 3304 taskmgr.exe Token: SeIncBasePriorityPrivilege 3304 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe 3304 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"1⤵PID:2136
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3304