Analysis
- max time kernel
94s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
26/08/2024, 00:18
General
- Target SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe
- Size 5.3MB
- Sample240826-allsfstejd
- SHA256 8586e26ad8c071ae7aed383edf5bef7e1d48f6e019c05b90eaa0a24e592fafd9
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/JouxJo2/Fps-Boost/raw/main/Boost.exe
Extracted
-
phemedrone
-
https://api.telegram.org/bot6402323442:AAFWbeqB_G8dGNlKcdmB4xeKrL6UBjOz4fg/sendDocument
Signatures
- Phemedrone
An information and wallet stealer written in C#.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpwtif6tcj.ps13⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Boost.exe"C:\Users\Admin\AppData\Local\Temp\Boost.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Boost.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
libffi-7.dll
python310.dll
__PSScriptPolicyTest_k4vqrqcu.ucz.ps1
tmpwtif6tcj.ps1
memory/1348-56-0x00000000007F0000-0x0000000000814000-memory.dmp
memory/1348-58-0x00007FFD7C2E0000-0x00007FFD7CDA1000-memory.dmp
memory/1348-59-0x00007FFD7C2E0000-0x00007FFD7CDA1000-memory.dmp
memory/1348-61-0x00007FFD7C2E0000-0x00007FFD7CDA1000-memory.dmp
memory/2732-40-0x00007FFD7C2E0000-0x00007FFD7CDA1000-memory.dmp
memory/2732-41-0x00007FFD7C2E0000-0x00007FFD7CDA1000-memory.dmp
memory/2732-30-0x0000029E64780000-0x0000029E647A2000-memory.dmp
memory/2732-29-0x00007FFD7C2E3000-0x00007FFD7C2E5000-memory.dmp
memory/2732-57-0x00007FFD7C2E0000-0x00007FFD7CDA1000-memory.dmp