Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/05/2026, 12:49
General
- Target 2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe
- Size 1.6MB
- Sample260516-p2cxtagy9p
- SHA256 806513fe44c1b86fc6ea44d1904cfd6d0e260ec65fb3fe61eb0848c6aa224610
Score
10/10
Malware Config
Extracted
Family
-
phemedrone
C2
-
http://127.0.0.1/gate.php
Signatures
- Family: Phemedrone
An information and wallet stealer written in C#.
- Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects executables Discord URL observed in first stage droppers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\msedge_broker_46e261.exe"C:\Users\Admin\Desktop\msedge_broker_46e261.exe" --output-path "C:\Users\Admin\Desktop\chabe_c1db78a9" all2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe" --watch2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cookies.json
msedge_broker_46e261.exe
net_diag.txt
memory/5016-0-0x000002357F000000-0x000002357F19A000-memory.dmp
memory/5016-1-0x000002357F500000-0x000002357F512000-memory.dmp
memory/5016-2-0x000002351A200000-0x000002351A210000-memory.dmp
memory/5016-26-0x000002357F520000-0x000002357F532000-memory.dmp
memory/5016-27-0x000002357F580000-0x000002357F5BC000-memory.dmp