phemedrone | f22347457dcc1547a18a9aa2526dc2d355b4af14ebc468c0ac56ba1f1084041f

General

Target

Resource.zip
Size

137KB
MD5

de4eaf5a4da426a0bbfbbe0eb2dd0985
SHA1

61a2fb33f2611dd8d884b7525d85c7ac5f121b1c
SHA256

b5d297464944d519b49b2cf83916b390a7f43f3a7f8bb17b793640b042aaaa43
SHA512

6b585a725954ebba297d3373eca061a43f13b507607f8d2350f2d783a8047c7295354ac65b2c2549d0370255bcfa4e58fd44401c131bcfdc3c133d628041046c
SSDEEP

3072:eLykyx2xrZAoxRwUMlhFoi95j3pyI69Nr3tg+xy:4yKrZAwRwtHFB9Z3pyr3thw

Score

10^/10

phemedrone credential_access spyware stealer

Malware Config

Extracted

Family

phemedrone

C2

https://mined.to/gate.php

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Executes dropped EXE 4 IoCs

pid	Process
396	Resource.exe
116	Resource.exe
2928	Resource.exe
4856	Resource.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
396	Resource.exe
4324	7zFM.exe
4324	7zFM.exe
4324	7zFM.exe
4324	7zFM.exe
4324	7zFM.exe
4324	7zFM.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
2928	Resource.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4324	7zFM.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	4324	7zFM.exe
Token: 35	4324	7zFM.exe
Token: SeSecurityPrivilege	4324	7zFM.exe
Token: SeDebugPrivilege	396	Resource.exe
Token: SeSecurityPrivilege	4324	7zFM.exe
Token: SeDebugPrivilege	4204	taskmgr.exe
Token: SeSystemProfilePrivilege	4204	taskmgr.exe
Token: SeCreateGlobalPrivilege	4204	taskmgr.exe
Token: 33	4204	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4204	taskmgr.exe
Token: SeSecurityPrivilege	4324	7zFM.exe
Token: SeDebugPrivilege	2928	Resource.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4324	7zFM.exe
4324	7zFM.exe
4324	7zFM.exe
4324	7zFM.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4324	7zFM.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe
4204	taskmgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 396	4324	7zFM.exe	85
PID 4324 wrote to memory of 396	4324	7zFM.exe	85
PID 4324 wrote to memory of 116	4324	7zFM.exe	91
PID 4324 wrote to memory of 116	4324	7zFM.exe	91

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Resource.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\7zO4E0B8BC7\Resource.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4E0B8BC7\Resource.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Users\Admin\AppData\Local\Temp\7zO4E068A87\Resource.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO4E068A87\Resource.exe"
  2⤵
  - Executes dropped EXE
  PID:116

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4204

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Users\Admin\Desktop\Resource.exe
"C:\Users\Admin\Desktop\Resource.exe"
1⤵
- Executes dropped EXE
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Resource.exe.log

Filesize
1KB

MD5
bd147fb589a67207c08c07ccb0b2991c

SHA1
ca95f9cb042c95e9b89b55f76a411e7324ce8f0f

SHA256
cfb433e98e44829cb9824f1197568887d8c6ab7c36dd87a7bad0a1e829a0849a

SHA512
ad0f6c98011e46abe322f61cda2265714b6b058806876bf36b13be15d9e6e178fd18d059b7d705040e17fe61aed62c3654c3adf28abdd9f51288ffe5a30add7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4E0B8BC7\Resource.exe

Filesize
137KB

MD5
4f38c635b15d7f9087a758baca7c6662

SHA1
0cbfe507872829dc19e63436fb8e9759dfb42271

SHA256
0404b9addf506f9b143521aed1b3a1003c2c8f16828221946a4d06dac6e85bfd

SHA512
dde8048dc7add02f03196438f171c52e6bd04fe099be061c6f2adcb8ed893d4e9279a823d8bd1c6d506d6f1e1857bb1ff5f5a41292e643db8aa6f025f4a8fddb

Download Submit
memory/396-12-0x00007FFEFAA93000-0x00007FFEFAA95000-memory.dmp

Filesize
8KB

Download
memory/396-13-0x000001420ED30000-0x000001420ED58000-memory.dmp

Filesize
160KB

Download
memory/396-14-0x00007FFEFAA90000-0x00007FFEFB551000-memory.dmp

Filesize
10.8MB

Download
memory/396-28-0x00007FFEFAA90000-0x00007FFEFB551000-memory.dmp

Filesize
10.8MB

Download
memory/4204-41-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-31-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-30-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-40-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-39-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-38-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-37-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-36-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-35-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download
memory/4204-29-0x000001D866A60000-0x000001D866A61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing