Analysis
-
max time kernel
54s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2025 14:51
Behavioral task
behavioral1
Sample
vanish.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
vanish.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
vanish.exe
-
Size
137KB
-
MD5
ac59764dee7fcebe61b0a9d70f87c1e1
-
SHA1
4faba8946b946a6eeb121561417ae13e4ec8c606
-
SHA256
c6487e1da77c82d40628312680ad43343cff5b92462ffeeffed30f46b23625ab
-
SHA512
b71f1dbc069ee6612b0d6a136d77080f919958e7a6bcdf65260e04ac5efc484042aca0716dda8199970bf7f2d0f4864a4888e3b0dcfd1ef858c615f839c3ac65
-
SSDEEP
3072:hOH2azx18xzWYlZ/naX58QBJmD5XXt8yVmiKoQk2s:Q109va9BMMyQ
Score
10/10
Malware Config
Extracted
Family
phemedrone
C2
https://api.telegram.org/bot7213845603:AAFFyxsyId9av6CCDVB1BCAM5hKLby41Dr8/sendDocument
Signatures
-
Phemedrone
An information and wallet stealer written in C#.
-
Phemedrone family
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 vanish.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1820 vanish.exe Token: SeDebugPrivilege 3492 taskmgr.exe Token: SeSystemProfilePrivilege 3492 taskmgr.exe Token: SeCreateGlobalPrivilege 3492 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe 3492 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vanish.exe"C:\Users\Admin\AppData\Local\Temp\vanish.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3492
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:952
-
C:\Windows\System32\ovufcs.exe"C:\Windows\System32\ovufcs.exe"1⤵PID:2608