Overview
overview
10Static
static
3Imperium.exe
windows7-x64
10Imperium.exe
windows10-2004-x64
10advpack.dll
windows10-2004-x64
1aeevts.dll
windows10-2004-x64
1aeinv.dll
windows10-2004-x64
1aeinvext.dll
windows10-2004-x64
1aemarebackup.dll
windows10-2004-x64
1aepic.dll
windows10-2004-x64
1agentactiv...me.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 15:04
Static task
static1
Behavioral task
behavioral1
Sample
Imperium.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Imperium.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
advpack.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
aeevts.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
aeinv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
aeinvext.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
aemarebackup.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
aepic.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
agentactivationruntime.dll
Resource
win10v2004-20241007-en
General
-
Target
Imperium.exe
-
Size
895KB
-
MD5
2e627886f546dec55fd0243de22f966e
-
SHA1
32bcbfd80baef07a2e05b8ed673a469741b74828
-
SHA256
fe21d4c63aa2ec21a4311955decfcf4d8dd7ec73bc9fa07655e14de6762489e7
-
SHA512
9642e596de2c2f2995180d5c4ec87619b10aaad1ca846eff55ed9c32c513b6994f47d87b3dc52e7a9f5990c4bac019d57dc8bcb3ea6381a43a176169067fdb3d
-
SSDEEP
12288:Wh1Lk70TnvjcQexF/3hr9mvqXO/bW8/1Ci9uJ41I8opwxcHXi2jlXWnbkQ:6k70Trc7F/3aWO98PZUqXieXWnb
Malware Config
Extracted
phemedrone
https://www.plufferr.com/api/send.php
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Phemedrone family
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/880-1-0x0000000005250000-0x0000000005464000-memory.dmp net_reactor behavioral2/memory/880-4-0x0000000005030000-0x0000000005244000-memory.dmp net_reactor behavioral2/memory/880-13-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-29-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-58-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-70-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-68-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-66-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-64-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-62-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-54-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-52-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-50-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-46-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-44-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-42-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-40-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-60-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-56-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-48-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-37-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-35-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-33-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-31-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-27-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-25-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-23-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-21-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-19-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-17-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-16-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-11-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-9-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-7-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor behavioral2/memory/880-6-0x0000000005030000-0x000000000523D000-memory.dmp net_reactor -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 880 set thread context of 372 880 Imperium.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Imperium.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 372 MSBuild.exe 372 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 880 Imperium.exe Token: SeDebugPrivilege 372 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82 PID 880 wrote to memory of 372 880 Imperium.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Imperium.exe"C:\Users\Admin\AppData\Local\Temp\Imperium.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372
-