Analysis
-
max time kernel
49s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 12:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
drivers.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
300 seconds
General
-
Target
drivers.exe
-
Size
307KB
-
MD5
4028f53201134a9ce886357e569f5fab
-
SHA1
bc97afdebdd005ccf07e017f48afaf2c8d6cad92
-
SHA256
87f5963e12c463e17b55f438065192ebca205f3dab10a6d5f99af1af4bae777f
-
SHA512
2190b22c2ad6ad879d76c8e50f035f2aa6c18f1a23521e92700e6208fe26c39dc0aff618640f55623332cc631ce9c3eea782dcf66f35b0cb815c943632d057f9
-
SSDEEP
6144:dbnC5SDnkBYmgrG6Ci+cm466MnBdnVawCZkb:lCgDnkB7o4566BdktZq
Score
10/10
Malware Config
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot7112551293:AAGZhRTgYJ4a8RYnU6UgUDOchJ72jMEo2t0/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4392 set thread context of 4184 4392 drivers.exe 87 -
Program crash 1 IoCs
pid pid_target Process procid_target 4660 4184 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drivers.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4264 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4264 taskmgr.exe Token: SeSystemProfilePrivilege 4264 taskmgr.exe Token: SeCreateGlobalPrivilege 4264 taskmgr.exe Token: 33 4264 taskmgr.exe Token: SeIncBasePriorityPrivilege 4264 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe 4264 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87 PID 4392 wrote to memory of 4184 4392 drivers.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\drivers.exe"C:\Users\Admin\AppData\Local\Temp\drivers.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 10963⤵
- Program crash
PID:4660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4184 -ip 41841⤵PID:4160
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4264