Analysis
-
max time kernel
30s -
max time network
143s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-08-2024 12:33
General
-
Target
Nursultan Alpha (prem)_protected.exe
-
Size
3.3MB
-
MD5
668f721351918eb28387e2a7eeb3cb38
-
SHA1
abd6a58f5a63ab5e0ef5b5c53b049eff6f9c03f7
-
SHA256
3e8bb255ae08068c909c67d331dfdd92e5ea0b572145d6f7dd7eb67b236b80c0
-
SHA512
7760b9c8f8e0ba3085d2533822a083706e02d3b14c7d46de02905e65fbc96e65c8b42e4c3e97f3fa7cd2f9547ab14953202f7173f4f3360cb2bbb673cc7a53ef
-
SSDEEP
98304:LC32Ejo4Phne5FyzECFk8l0o2r4aGYpzgJT:LcKq5e5kvFT0/4ah0N
Malware Config
Extracted
phemedrone
https://api.telegram.org/bot7322165665:AAFyOklLwRDgUWXVHyXw6ZlECDoQ6pM7WQ0/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Nursultan Alpha (prem)_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Nursultan Alpha (prem)_protected.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Nursultan Alpha (prem)_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Nursultan Alpha (prem)_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Nursultan Alpha (prem)_protected.exe -
Processes:
resource yara_rule behavioral1/memory/4468-7-0x0000000000420000-0x0000000000CFA000-memory.dmp themida behavioral1/memory/4468-8-0x0000000000420000-0x0000000000CFA000-memory.dmp themida behavioral1/memory/4468-11-0x0000000000420000-0x0000000000CFA000-memory.dmp themida -
Processes:
Nursultan Alpha (prem)_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nursultan Alpha (prem)_protected.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Nursultan Alpha (prem)_protected.exepid process 4468 Nursultan Alpha (prem)_protected.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4832 4468 WerFault.exe Nursultan Alpha (prem)_protected.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Nursultan Alpha (prem)_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nursultan Alpha (prem)_protected.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Nursultan Alpha (prem)_protected.exetaskmgr.exepid process 4468 Nursultan Alpha (prem)_protected.exe 4468 Nursultan Alpha (prem)_protected.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1592 taskmgr.exe Token: SeSystemProfilePrivilege 1592 taskmgr.exe Token: SeCreateGlobalPrivilege 1592 taskmgr.exe Token: 33 1592 taskmgr.exe Token: SeIncBasePriorityPrivilege 1592 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
Processes:
taskmgr.exepid process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
Processes:
taskmgr.exepid process 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe 1592 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha (prem)_protected.exe"C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha (prem)_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 10282⤵
- Program crash
PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4468 -ip 44681⤵PID:2952
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1592
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1100