Analysis

  • max time kernel
    30s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-08-2024 12:33

General

  • Target

    Nursultan Alpha (prem)_protected.exe

  • Size

    3.3MB

  • MD5

    668f721351918eb28387e2a7eeb3cb38

  • SHA1

    abd6a58f5a63ab5e0ef5b5c53b049eff6f9c03f7

  • SHA256

    3e8bb255ae08068c909c67d331dfdd92e5ea0b572145d6f7dd7eb67b236b80c0

  • SHA512

    7760b9c8f8e0ba3085d2533822a083706e02d3b14c7d46de02905e65fbc96e65c8b42e4c3e97f3fa7cd2f9547ab14953202f7173f4f3360cb2bbb673cc7a53ef

  • SSDEEP

    98304:LC32Ejo4Phne5FyzECFk8l0o2r4aGYpzgJT:LcKq5e5kvFT0/4ah0N

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7322165665:AAFyOklLwRDgUWXVHyXw6ZlECDoQ6pM7WQ0/sendDocument

Signatures

  • Phemedrone

    An information and wallet stealer written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha (prem)_protected.exe
    "C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha (prem)_protected.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4468
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 1028
      2⤵
      • Program crash
      PID:4832
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4468 -ip 4468
    1⤵
      PID:2952
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1592
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1100

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1592-22-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-24-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-25-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-20-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-23-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-13-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-14-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-15-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-21-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/1592-19-0x0000028D6B9B0000-0x0000028D6B9B1000-memory.dmp

        Filesize

        4KB

      • memory/4468-9-0x0000000005710000-0x0000000005776000-memory.dmp

        Filesize

        408KB

      • memory/4468-8-0x0000000000420000-0x0000000000CFA000-memory.dmp

        Filesize

        8.9MB

      • memory/4468-7-0x0000000000420000-0x0000000000CFA000-memory.dmp

        Filesize

        8.9MB

      • memory/4468-1-0x0000000076B16000-0x0000000076B17000-memory.dmp

        Filesize

        4KB

      • memory/4468-4-0x0000000076B00000-0x0000000076BF0000-memory.dmp

        Filesize

        960KB

      • memory/4468-0-0x0000000000420000-0x0000000000CFA000-memory.dmp

        Filesize

        8.9MB

      • memory/4468-3-0x0000000076B00000-0x0000000076BF0000-memory.dmp

        Filesize

        960KB

      • memory/4468-12-0x0000000076B00000-0x0000000076BF0000-memory.dmp

        Filesize

        960KB

      • memory/4468-2-0x0000000076B00000-0x0000000076BF0000-memory.dmp

        Filesize

        960KB

      • memory/4468-11-0x0000000000420000-0x0000000000CFA000-memory.dmp

        Filesize

        8.9MB