Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-es -
resource tags
arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
14-08-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
csc.exe
Resource
win10-20240404-es
Behavioral task
behavioral2
Sample
csc.exe
Resource
win7-20240729-es
Behavioral task
behavioral3
Sample
csc.exe
Resource
win10v2004-20240802-es
General
-
Target
csc.exe
-
Size
140KB
-
MD5
7b537e9227a6f54d1b58a304476c776b
-
SHA1
9b0c1f9335b49a9b08d512c2cabd9aea2c38a315
-
SHA256
53d6a18ea5f6ee799a163937a8feeb7da1f80480f610241b140233b0d9875c4c
-
SHA512
299ab11911012c8c1b38e17cb2d27d4019d5b77723f89b5e864d049dfce9ee086f39a2e6dda56a756a2e4a783c9118f28f8f0b5bfc38e7554df12416e1bf94d2
-
SSDEEP
3072:ZNl8ENz25WGNx23FTuHqW8hsn0kg0+T77qCGKLhN8IxX51:dhNz28GNU3JAh8h60kpM72ohNRx
Malware Config
Extracted
phemedrone
https://api.telegram.org/bot7253527125:AAG2zbXlkuY33BxLSZk2mcohhToET22xkTM/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
csc.exedescription pid process target process PID 2212 set thread context of 4788 2212 csc.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3628 4788 WerFault.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
csc.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
csc.exedescription pid process target process PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe PID 2212 wrote to memory of 4788 2212 csc.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\csc.exe"C:\Users\Admin\AppData\Local\Temp\csc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 10923⤵
- Program crash
PID:3628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4788 -ip 47881⤵PID:412