Analysis

  • max time kernel
    92s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 21:35

General

  • Target

    6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88.exe

  • Size

    138KB

  • MD5

    67c60845c275b4c27e958c31b2129001

  • SHA1

    9cda03f7fb8b88ac08d61325712a55c34fa3ca86

  • SHA256

    6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88

  • SHA512

    72831fd0a4522bcacd03ca1dff78844240aeed2a2f430aaa2f290cb06427d42c03f9b546c980e3331f48156f9b8404daaa6ddfbb16e294006b2f22ebb9e21bb1

  • SSDEEP

    3072:pGyxO6HAjmjaa8OPkVw36ieKn5I3UQ8X/L:FOeAija0kVw9

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7399565450:AAHi_hMDEnRAdqS1R6s83tRv7BKyLi6xLyE/sendDocument

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88.exe
    "C:\Users\Admin\AppData\Local\Temp\6f9f9973dc9c24d10c4a5678b48d57780b6399408f20bc8c074a73f86fc0fd88.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2388-0-0x00007FFD47823000-0x00007FFD47825000-memory.dmp

    Filesize

    8KB

  • memory/2388-1-0x00000219617C0000-0x00000219617E8000-memory.dmp

    Filesize

    160KB

  • memory/2388-2-0x00007FFD47820000-0x00007FFD482E1000-memory.dmp

    Filesize

    10.8MB

  • memory/2388-3-0x00007FFD47820000-0x00007FFD482E1000-memory.dmp

    Filesize

    10.8MB