phemedrone | 6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4

General

Target

steam.exe
Size

1005KB
MD5

d393fb1b159fdc35e135960a8f8b2928
SHA1

74f27229a212ceb1be49b6f1ae9093c9af5fe0c2
SHA256

6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4
SHA512

bda698fc1d1c8893fe688ea82f83bddcb56a009fd1155cfe25683bd87d71c6f1232059e4d5f6c7f17865c3fd8bd5aa32b306b63aa59c78a82776f69e772d0b98
SSDEEP

6144:d4lrV3oawRMA8RixB9+5FUd0f1Ky5xg+GIIIIIIIhIIIIIIIIIIIIIIIU:qlVoawO5Qj9+5FdfEy/

Score

10^/10

phemedrone xworm discovery rat stealer trojan

Malware Config

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7602843389:AAE9dcCKuyUGx9HUNQf9KbsZDhME6HwC10g/sendMessage?chat_id=1745421249

Extracted

Family

xworm

C2

127.0.0.1:2727

dnsdeerrorlehaxor.ddns.net:2727

Attributes

Install_directory
%Public%
install_file
Discord.exe
telegram
https://api.telegram.org/bot5964175002:AAFK1mpStrMUWwegniLJuryZjOhVavZhSGo/sendMessage?chat_id=1745421249

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023d27-6.dat	family_xworm
behavioral2/memory/468-26-0x0000000000590000-0x00000000005EC000-memory.dmp	family_xworm

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3932017190-1449707826-1445630-1000\Control Panel\International\Geo\Nation	steam.exe

Executes dropped EXE 2 IoCs

pid	Process
468	Discord.exe
836	Steam.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2404	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	Discord.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 468	4576	steam.exe	87
PID 4576 wrote to memory of 468	4576	steam.exe	87
PID 4576 wrote to memory of 836	4576	steam.exe	88
PID 4576 wrote to memory of 836	4576	steam.exe	88

C:\Users\Admin\AppData\Local\Temp\steam.exe
"C:\Users\Admin\AppData\Local\Temp\steam.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Public\Discord.exe
  "C:\Users\Public\Discord.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Users\Public\Steam.exe
  "C:\Users\Public\Steam.exe"
  2⤵
  - Executes dropped EXE
  PID:836

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUFGQ0Y3MzgtRTg0OS00QUJBLUI5NDItMDAyMTg0RUE1MUYzfSIgdXNlcmlkPSJ7RUE4NUIyNDQtQzhDNC00RjM5LTk5NkItNDdGMDQyRTI4RjZCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTRDNDlBODItMUMxQy00NUZELUI5NTktQzU0QzNEODY4ODZGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODU1OTMzOTcwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Discord.exe

Filesize
340KB

MD5
93a84f8e3c8e40aa764215d360a89064

SHA1
5bf84da9f34ec2fd38bc175a8a890244409edca1

SHA256
18ebb82690ab22e2b00016bbd44df0ab1bd522d7231abe23e11cb56d33bbbe3f

SHA512
da313755609442286062a9be8754399c606c0071812ad7dfb9289d37e9b24ee8cc8688e6563f192dff9552355f917f25ee2ffe735a5e1fc876cfe4ce778cce34

Download Submit
C:\Users\Public\Steam.exe

Filesize
385KB

MD5
d5e9ca906c2366c7878fe7ff36587f6a

SHA1
be89988a517effb21f2e3a0c680f890708d95410

SHA256
25c49795584b8bd3dc5dc2be6e26cecf9dd0cef2323aa71089c1de01ac81dacc

SHA512
ec864f1fa9b7efac08baf3c1feb6626fa4832f76336921ec133aed1d4cfbe9fe8a05a70c0997e831383894d51d05bd4a8335d03353310808fd301bf112cf00ae

Download Submit
memory/468-26-0x0000000000590000-0x00000000005EC000-memory.dmp

Filesize
368KB

Download
memory/468-27-0x00007FF947530000-0x00007FF947FF1000-memory.dmp

Filesize
10.8MB

Download
memory/468-29-0x00007FF947530000-0x00007FF947FF1000-memory.dmp

Filesize
10.8MB

Download
memory/836-25-0x000001C800950000-0x000001C8009B6000-memory.dmp

Filesize
408KB

Download
memory/836-28-0x00007FF947530000-0x00007FF947FF1000-memory.dmp

Filesize
10.8MB

Download
memory/4576-0-0x00007FF947533000-0x00007FF947535000-memory.dmp

Filesize
8KB

Download
memory/4576-1-0x0000000000F00000-0x0000000001002000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads