Analysis
- max time kernel
92s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
04/12/2024, 15:04
General
- Target Imperium.exe
- Size 895KB
- Sample241204-sfl55strgm
- SHA256 fe21d4c63aa2ec21a4311955decfcf4d8dd7ec73bc9fa07655e14de6762489e7
Malware Config
Extracted
-
phemedrone
-
https://www.plufferr.com/api/send.php
Signatures
- Phemedrone
An information and wallet stealer written in C#.
- Phemedrone family
- .NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Imperium.exe"C:\Users\Admin\AppData\Local\Temp\Imperium.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-1669-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/372-1674-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/372-1672-0x0000000005870000-0x0000000005902000-memory.dmp
memory/372-1671-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/372-1670-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/372-1667-0x0000000000400000-0x0000000000428000-memory.dmp
memory/880-60-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-33-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-39-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/880-58-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-70-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-68-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-66-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-64-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-62-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-54-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-52-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-50-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-46-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-44-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-42-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-40-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-0-0x000000007470E000-0x000000007470F000-memory.dmp
memory/880-56-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-48-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-37-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-35-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-29-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-31-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-27-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-25-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-23-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-21-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-19-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-17-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-16-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-11-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-9-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-7-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-6-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-1668-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/880-13-0x0000000005030000-0x000000000523D000-memory.dmp
memory/880-5-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/880-4-0x0000000005030000-0x0000000005244000-memory.dmp
memory/880-3-0x0000000005460000-0x0000000005A04000-memory.dmp
memory/880-2-0x0000000074700000-0x0000000074EB0000-memory.dmp
memory/880-1-0x0000000005250000-0x0000000005464000-memory.dmp