phemedrone | c39552926a046eca64dab7cafbc9002ae22d592cba749fa03b6416b4a299431d

General

Target

VanishRaider-main.rar
Size

61KB
MD5

3d15d9b5d05223d0b812f1f51eb05ecb
SHA1

7f0f19e7128f546193685be6efe39a2ec61d8175
SHA256

c39552926a046eca64dab7cafbc9002ae22d592cba749fa03b6416b4a299431d
SHA512

7c65b4fddf10687c119718d136e45c570c4a5f9bb2ddbb23731813b5975d79a91ec062d7722909ede8ced4ac5a6fdb654ca9f1780546f50400f5de095f088ef1
SSDEEP

1536:Dr1IdvkMfDOHKq7eATVeBN/zsGellftYnXHRsPgmVzfLmB:Dr1bcwDe7MHVYnXHRpiz0

Score

10^/10

phemedrone credential_access spyware stealer

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7213845603:AAFFyxsyId9av6CCDVB1BCAM5hKLby41Dr8/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Executes dropped EXE 3 IoCs

pid	Process
2820	vanish.exe
1036	vanish.exe
2588	vanish.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1272	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2628	7zFM.exe
2820	vanish.exe
2628	7zFM.exe
2628	7zFM.exe
2628	7zFM.exe
2628	7zFM.exe
2588	vanish.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	7zFM.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2628	7zFM.exe
Token: 35	2628	7zFM.exe
Token: SeSecurityPrivilege	2628	7zFM.exe
Token: SeSecurityPrivilege	2628	7zFM.exe
Token: SeDebugPrivilege	2820	vanish.exe
Token: SeSecurityPrivilege	2628	7zFM.exe
Token: SeSecurityPrivilege	2628	7zFM.exe
Token: SeDebugPrivilege	2588	vanish.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2628	7zFM.exe
2628	7zFM.exe
2628	7zFM.exe
2628	7zFM.exe
2628	7zFM.exe
2628	7zFM.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1272	2628	7zFM.exe	31
PID 2628 wrote to memory of 1272	2628	7zFM.exe	31
PID 2628 wrote to memory of 1272	2628	7zFM.exe	31
PID 2628 wrote to memory of 2820	2628	7zFM.exe	32
PID 2628 wrote to memory of 2820	2628	7zFM.exe	32
PID 2628 wrote to memory of 2820	2628	7zFM.exe	32
PID 2628 wrote to memory of 1036	2628	7zFM.exe	34
PID 2628 wrote to memory of 1036	2628	7zFM.exe	34
PID 2628 wrote to memory of 1036	2628	7zFM.exe	34
PID 2820 wrote to memory of 956	2820	vanish.exe	35
PID 2820 wrote to memory of 956	2820	vanish.exe	35
PID 2820 wrote to memory of 956	2820	vanish.exe	35
PID 2628 wrote to memory of 2588	2628	7zFM.exe	36
PID 2628 wrote to memory of 2588	2628	7zFM.exe	36
PID 2628 wrote to memory of 2588	2628	7zFM.exe	36

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VanishRaider-main.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO44A375F6\requirements.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\7zO44AAAC17\vanish.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44AAAC17\vanish.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2820 -s 628
    3⤵
    PID:956
- C:\Users\Admin\AppData\Local\Temp\7zO44A4F367\vanish.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44A4F367\vanish.exe"
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\7zO44A69177\vanish.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO44A69177\vanish.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO44AAAC17\vanish.exe

Filesize
137KB

MD5
ac59764dee7fcebe61b0a9d70f87c1e1

SHA1
4faba8946b946a6eeb121561417ae13e4ec8c606

SHA256
c6487e1da77c82d40628312680ad43343cff5b92462ffeeffed30f46b23625ab

SHA512
b71f1dbc069ee6612b0d6a136d77080f919958e7a6bcdf65260e04ac5efc484042aca0716dda8199970bf7f2d0f4864a4888e3b0dcfd1ef858c615f839c3ac65

Download Submit
memory/1036-23-0x00000000013C0000-0x00000000013E8000-memory.dmp

Filesize
160KB

Download
memory/2588-35-0x0000000000910000-0x0000000000938000-memory.dmp

Filesize
160KB

Download
memory/2820-11-0x00000000002D0000-0x00000000002F8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing