Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 12:49
General
- Target 2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe
- Size 1.6MB
- Sample260516-p2cxtagy9p
- SHA256 806513fe44c1b86fc6ea44d1904cfd6d0e260ec65fb3fe61eb0848c6aa224610
Score
10/10
Malware Config
Extracted
Family
-
phemedrone
C2
-
http://127.0.0.1/gate.php
Signatures
- Family: Phemedrone
An information and wallet stealer written in C#.
- Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects executables Discord URL observed in first stage droppers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\msedge_broker_6d6d49.exe"C:\Users\Admin\Desktop\msedge_broker_6d6d49.exe" --output-path "C:\Users\Admin\Desktop\chabe_4cc3eb6e" all2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_9bc63364494b4a2fa5be28eef859cc05_glassworm_icedid_luca-stealer_njrat_phemedrone-stealer_redline-stealer.exe" --watch2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cookies.json
msedge_broker_6d6d49.exe
net_diag.txt
memory/4348-0-0x000002A036940000-0x000002A036ADA000-memory.dmp
memory/4348-1-0x000002A036F30000-0x000002A036F42000-memory.dmp
memory/4348-2-0x000002A052770000-0x000002A052780000-memory.dmp
memory/4348-26-0x000002A036F90000-0x000002A036FA2000-memory.dmp
memory/4348-27-0x000002A0387D0000-0x000002A03880C000-memory.dmp