Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2024 17:36

General

  • Target

    WW7WS_Loader.exe

  • Size

    116KB

  • MD5

    9957ff72b98d2fd3819a1c3a5bb7c266

  • SHA1

    27ee49406e1eaaf4ca84e9119baf83d79e199df3

  • SHA256

    103b15ed69b33225af3886c39dca69d542aba6907567bea4f4854a80fe9ca34e

  • SHA512

    52e8cb098534a39b7ad5c251db05fed8b414012f824ced61ba6dd53e29cb8f08e870c19a74906112f2fa3ba60abfcd1d7f3170ac27481a918b1b818bebcb251c

  • SSDEEP

    1536:RVJmqFbDs4TsmZn3RAFtVS+8IdO52M68XiNL5iDNifNJa7sxRlXKfsfzudtBE:D5FbNTsGmcxoO5K8Xe5iK07swfs

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7250665686:AAHW0YznZP8w-6An0q8-OF3zVVfXyjQuxLM/sendDocument

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\WW7WS_Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\WW7WS_Loader.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3184-0-0x00007FF8BE393000-0x00007FF8BE395000-memory.dmp

    Filesize

    8KB

  • memory/3184-1-0x0000000000AB0000-0x0000000000AD4000-memory.dmp

    Filesize

    144KB

  • memory/3184-2-0x00007FF8BE390000-0x00007FF8BEE51000-memory.dmp

    Filesize

    10.8MB

  • memory/3184-3-0x00007FF8BE390000-0x00007FF8BEE51000-memory.dmp

    Filesize

    10.8MB