phemedrone | 6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe
Size

1005KB
MD5

d393fb1b159fdc35e135960a8f8b2928
SHA1

74f27229a212ceb1be49b6f1ae9093c9af5fe0c2
SHA256

6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4
SHA512

bda698fc1d1c8893fe688ea82f83bddcb56a009fd1155cfe25683bd87d71c6f1232059e4d5f6c7f17865c3fd8bd5aa32b306b63aa59c78a82776f69e772d0b98
SSDEEP

6144:d4lrV3oawRMA8RixB9+5FUd0f1Ky5xg+GIIIIIIIhIIIIIIIIIIIIIIIU:qlVoawO5Qj9+5FdfEy/

Score

10^/10

phemedrone xworm rat stealer trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:2727

dnsdeerrorlehaxor.ddns.net:2727

Attributes

Install_directory
%Public%
install_file
Discord.exe
telegram
https://api.telegram.org/bot5964175002:AAFK1mpStrMUWwegniLJuryZjOhVavZhSGo/sendMessage?chat_id=1745421249

Extracted

Family

phemedrone

https://api.telegram.org/bot7602843389:AAE9dcCKuyUGx9HUNQf9KbsZDhME6HwC10g/sendMessage?chat_id=1745421249

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016ace-6.dat	family_xworm
behavioral1/memory/856-9-0x00000000009D0000-0x0000000000A2C000-memory.dmp	family_xworm

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 2 IoCs

pid	Process
856	Discord.exe
2364	Steam.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	Discord.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 856	1764	6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe	31
PID 1764 wrote to memory of 856	1764	6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe	31
PID 1764 wrote to memory of 856	1764	6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe	31
PID 1764 wrote to memory of 2364	1764	6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe	32
PID 1764 wrote to memory of 2364	1764	6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe	32
PID 1764 wrote to memory of 2364	1764	6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe	32
PID 2364 wrote to memory of 2844	2364	Steam.exe	34
PID 2364 wrote to memory of 2844	2364	Steam.exe	34
PID 2364 wrote to memory of 2844	2364	Steam.exe	34

C:\Users\Admin\AppData\Local\Temp\6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe
"C:\Users\Admin\AppData\Local\Temp\6cb5005a2a43e0ca027de531c844c00935940df89d797b67f47d4399b89d3bf4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Public\Discord.exe
  "C:\Users\Public\Discord.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Users\Public\Steam.exe
  "C:\Users\Public\Steam.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2364 -s 640
    3⤵
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Discord.exe

Filesize
340KB

MD5
93a84f8e3c8e40aa764215d360a89064

SHA1
5bf84da9f34ec2fd38bc175a8a890244409edca1

SHA256
18ebb82690ab22e2b00016bbd44df0ab1bd522d7231abe23e11cb56d33bbbe3f

SHA512
da313755609442286062a9be8754399c606c0071812ad7dfb9289d37e9b24ee8cc8688e6563f192dff9552355f917f25ee2ffe735a5e1fc876cfe4ce778cce34

Download Submit
C:\Users\Public\Steam.exe

Filesize
385KB

MD5
d5e9ca906c2366c7878fe7ff36587f6a

SHA1
be89988a517effb21f2e3a0c680f890708d95410

SHA256
25c49795584b8bd3dc5dc2be6e26cecf9dd0cef2323aa71089c1de01ac81dacc

SHA512
ec864f1fa9b7efac08baf3c1feb6626fa4832f76336921ec133aed1d4cfbe9fe8a05a70c0997e831383894d51d05bd4a8335d03353310808fd301bf112cf00ae

Download Submit
memory/856-9-0x00000000009D0000-0x0000000000A2C000-memory.dmp

Filesize
368KB

Download
memory/856-14-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/856-15-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/1764-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/1764-1-0x00000000011F0000-0x00000000012F2000-memory.dmp

Filesize
1.0MB

Download
memory/2364-13-0x00000000009D0000-0x0000000000A36000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads