Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-12-2024 06:23
General
-
Target
a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c.exe
-
Size
523KB
-
MD5
e116baef037ea6fc036c7e7c1a7ee0af
-
SHA1
538a99f12bc452adf4597333efa59e34ae734d02
-
SHA256
a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c
-
SHA512
cfbb4f1caf8b4ed8ac912f09800e91580d53c4f4690c079afcdbc9f54e0d0c15a90f14663ec9aad9b7b070d397dcf6299604b5ea8078b87e42d87bfb50bd0bc7
-
SSDEEP
12288:xXkv+IDc/5I93t7RjTdE+ijuiq3NlHKF0G5LopjF00gQngB57U4zMiR5Z3oc2rcV:xyrwq9dNRlHKF0G5LopjF0qM5TMiR5ZR
Malware Config
Extracted
phemedrone
https://api.telegram.org/bot7604180600:AAHwr2u1ZveiHzQQ_yVoPYP2QNFw1punco0/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Phemedrone family
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c.exe"C:\Users\Admin\AppData\Local\Temp\a64d873eb3e1c8a7b8d24ae4c672184feebc77a097477512a6e1c6a513d7ce9c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
552KB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB