Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-11-2024 03:26

General

  • Target

    6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe

  • Size

    246KB

  • MD5

    bcb323eb0cfd10d58cf134bc7bdc8d67

  • SHA1

    c34a8c428b715b67b696819fc1d172708a23d3f3

  • SHA256

    6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3

  • SHA512

    bac5411c794a1b473b628c5b261bef5a830a6fed5a797c785ac3f3370def8f91db2368db8ea13d91ece0b89ab6109b64e3ecddcd27d15b2d7cc6f29216a57255

  • SSDEEP

    3072:YlXc8ISCQhQzh6OVoWlq5OiUG5QivXsP1zpKHDkO7UN2ET:yUSbSzh6OzgOiUOvrU0

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot8091768794:AAFZsJ1h-6BiszgyLm-eH6c-uITQ7Z99Wbc/sendDocument

Signatures

  • Phemedrone

    An information and wallet stealer written in C#.

  • Phemedrone family
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe
    "C:\Users\Admin\AppData\Local\Temp\6d1a5864d641f2da852bfced96a305a41b6464dc12a944883985a4c305a9d8c3.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2656 -s 888
      2⤵
        PID:2012

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2656-0-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

      Filesize

      4KB

    • memory/2656-1-0x00000000010D0000-0x0000000001114000-memory.dmp

      Filesize

      272KB

    • memory/2656-2-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

      Filesize

      9.9MB

    • memory/2656-3-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

      Filesize

      9.9MB