Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
25-10-2020 22:56
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe
Resource
win7
General
-
Target
SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe
-
Size
75KB
-
MD5
fcbb520e5c66b1f024440e4eea650686
-
SHA1
710a7bd0d4791edc0f75d8d778c173c981120b5d
-
SHA256
f2af7f2de72d42d045309ea26b6c19076a42b4e6703fb15b5d40416ab37a8052
-
SHA512
0be757dd903f53394cfd46869e3694aa68f95efe1fcfba24649e9fdc33c489a4095fe0a22a5a50da4ae9cba35251790b0943365bf02fb52d7f6de3fa5173a733
Malware Config
Signatures
-
Phorphiex Payload 8 IoCs
Processes:
resource yara_rule C:\113201624230781\svchost.exe family_phorphiex C:\113201624230781\svchost.exe family_phorphiex C:\Users\Admin\AppData\Local\Temp\2600214963.exe family_phorphiex C:\Users\Admin\AppData\Local\Temp\2600214963.exe family_phorphiex C:\252222727722946\svchost.exe family_phorphiex C:\252222727722946\svchost.exe family_phorphiex C:\Users\Admin\AppData\Local\Temp\1230638365.exe family_phorphiex C:\Users\Admin\AppData\Local\Temp\1230638365.exe family_phorphiex -
Executes dropped EXE 10 IoCs
Processes:
svchost.exe2600214963.exe2729311810.exe1652022234.exesvchost.exe3406732252.exe1230638365.exe3164236024.exe3902419604.exe3427929040.exepid process 3784 svchost.exe 3508 2600214963.exe 728 2729311810.exe 2140 1652022234.exe 3216 svchost.exe 1544 3406732252.exe 3992 1230638365.exe 188 3164236024.exe 4440 3902419604.exe 4956 3427929040.exe -
Processes:
svchost.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe2600214963.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\113201624230781\\svchost.exe" SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\113201624230781\\svchost.exe" SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\252222727722946\\svchost.exe" 2600214963.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\252222727722946\\svchost.exe" 2600214963.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 26 icanhazip.com -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exesvchost.exe2600214963.exesvchost.exedescription pid process target process PID 3512 wrote to memory of 3784 3512 SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe svchost.exe PID 3512 wrote to memory of 3784 3512 SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe svchost.exe PID 3512 wrote to memory of 3784 3512 SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe svchost.exe PID 3784 wrote to memory of 3508 3784 svchost.exe 2600214963.exe PID 3784 wrote to memory of 3508 3784 svchost.exe 2600214963.exe PID 3784 wrote to memory of 3508 3784 svchost.exe 2600214963.exe PID 3784 wrote to memory of 728 3784 svchost.exe 2729311810.exe PID 3784 wrote to memory of 728 3784 svchost.exe 2729311810.exe PID 3784 wrote to memory of 728 3784 svchost.exe 2729311810.exe PID 3784 wrote to memory of 2140 3784 svchost.exe 1652022234.exe PID 3784 wrote to memory of 2140 3784 svchost.exe 1652022234.exe PID 3784 wrote to memory of 2140 3784 svchost.exe 1652022234.exe PID 3508 wrote to memory of 3216 3508 2600214963.exe svchost.exe PID 3508 wrote to memory of 3216 3508 2600214963.exe svchost.exe PID 3508 wrote to memory of 3216 3508 2600214963.exe svchost.exe PID 3784 wrote to memory of 1544 3784 svchost.exe 3406732252.exe PID 3784 wrote to memory of 1544 3784 svchost.exe 3406732252.exe PID 3784 wrote to memory of 1544 3784 svchost.exe 3406732252.exe PID 3216 wrote to memory of 3992 3216 svchost.exe 1230638365.exe PID 3216 wrote to memory of 3992 3216 svchost.exe 1230638365.exe PID 3216 wrote to memory of 3992 3216 svchost.exe 1230638365.exe PID 3216 wrote to memory of 188 3216 svchost.exe 3164236024.exe PID 3216 wrote to memory of 188 3216 svchost.exe 3164236024.exe PID 3216 wrote to memory of 188 3216 svchost.exe 3164236024.exe PID 3216 wrote to memory of 4440 3216 svchost.exe 3902419604.exe PID 3216 wrote to memory of 4440 3216 svchost.exe 3902419604.exe PID 3216 wrote to memory of 4440 3216 svchost.exe 3902419604.exe PID 3216 wrote to memory of 4956 3216 svchost.exe 3427929040.exe PID 3216 wrote to memory of 4956 3216 svchost.exe 3427929040.exe PID 3216 wrote to memory of 4956 3216 svchost.exe 3427929040.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen10.14421.6375.30290.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\113201624230781\svchost.exeC:\113201624230781\svchost.exe2⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2600214963.exeC:\Users\Admin\AppData\Local\Temp\2600214963.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\252222727722946\svchost.exeC:\252222727722946\svchost.exe4⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1230638365.exeC:\Users\Admin\AppData\Local\Temp\1230638365.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3164236024.exeC:\Users\Admin\AppData\Local\Temp\3164236024.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3902419604.exeC:\Users\Admin\AppData\Local\Temp\3902419604.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3427929040.exeC:\Users\Admin\AppData\Local\Temp\3427929040.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2729311810.exeC:\Users\Admin\AppData\Local\Temp\2729311810.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1652022234.exeC:\Users\Admin\AppData\Local\Temp\1652022234.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3406732252.exeC:\Users\Admin\AppData\Local\Temp\3406732252.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\113201624230781\svchost.exeMD5
fcbb520e5c66b1f024440e4eea650686
SHA1710a7bd0d4791edc0f75d8d778c173c981120b5d
SHA256f2af7f2de72d42d045309ea26b6c19076a42b4e6703fb15b5d40416ab37a8052
SHA5120be757dd903f53394cfd46869e3694aa68f95efe1fcfba24649e9fdc33c489a4095fe0a22a5a50da4ae9cba35251790b0943365bf02fb52d7f6de3fa5173a733
-
C:\113201624230781\svchost.exeMD5
fcbb520e5c66b1f024440e4eea650686
SHA1710a7bd0d4791edc0f75d8d778c173c981120b5d
SHA256f2af7f2de72d42d045309ea26b6c19076a42b4e6703fb15b5d40416ab37a8052
SHA5120be757dd903f53394cfd46869e3694aa68f95efe1fcfba24649e9fdc33c489a4095fe0a22a5a50da4ae9cba35251790b0943365bf02fb52d7f6de3fa5173a733
-
C:\252222727722946\svchost.exeMD5
9ad727a371a0afc80274b2ae22f83abf
SHA10b4423282135f4df6647f194446474053b0b31da
SHA25653f9ec1ef40ed5b55673e49fc4c8c72a372d53c93a10a94b72b5d7c8470d8306
SHA51240bb2584538dabc0cea5e2c93275ad9244fd3e9b5ec0b2952a36d9b6ef46fec943a2a639112e6f8a8725066593807c9d0df9ecd86afd698ed7c5e6150756e731
-
C:\252222727722946\svchost.exeMD5
9ad727a371a0afc80274b2ae22f83abf
SHA10b4423282135f4df6647f194446474053b0b31da
SHA25653f9ec1ef40ed5b55673e49fc4c8c72a372d53c93a10a94b72b5d7c8470d8306
SHA51240bb2584538dabc0cea5e2c93275ad9244fd3e9b5ec0b2952a36d9b6ef46fec943a2a639112e6f8a8725066593807c9d0df9ecd86afd698ed7c5e6150756e731
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2QPYE0A1\1[1]MD5
bd8681538e4af5e2397ef9ec18a45d64
SHA156b5e62dcf8090c67519677e0c59a5a28bb8c525
SHA2566ebb791c1925feb9b29ddb282d411114ca2156e153a028155e766614376a443e
SHA512640904244c21d4b57708d45046c75812f4e211a65c5af2c2c4d264a7a72a0a435de627bd538934e7e1bfe16fff801fb7fa7f14d3db5a1a9e2f22a35fdc155b26
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2QPYE0A1\3[1]MD5
324a703ec18e8649d5f578d9a67223fc
SHA1bcbd27442bde2ba710bb992ad224d8a1ba910480
SHA256b633e8e885133595d0db50b247210896b3ccf2e8dee3b5f10f96471329641ec4
SHA512b2506dbb54db9324451b633aabff849b91f4674a2f06c22777a80276b59b1dd023bb886bd16ebe04b9f3ba2fd8a1cd79700697f0c59f7ab9ef79b5f740c17ecf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\65FCRE8S\2[1]MD5
e2824fff8e3879279626866e5197e680
SHA19df30cd6e894352b1a001d3178cca78057198f5a
SHA256adef83ca9a41294170281ebf67b3bbe96f8e68246c01bbf3edc80a754ec48341
SHA512f4849aa38e60919a0f5b8aeebd750f812e89bcff2bbadcd0d7e6f158c4572bbc0f7f8ce5ecb804adb0516ad73d7aec2d1d50217bb21b17a502ba7b641664bfe3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\65FCRE8S\4[1]MD5
c60c14a709009a2b11f0b08b47d0c360
SHA1b955e646964a76229dc170a11c99e0f1a20e6fa5
SHA2569604cbb3047d8eb09e29b7cbf1cb25f93c6c07a2899b7297cd9f9f1a46a47d5c
SHA51222c94b793804149e704f9a5d607ccdaa706f6363bcf8d743ad78afcd6e37e912e429f62b1807ba23c272f101b1e24b10578cc9c8647237da86cf8ee136152f4c
-
C:\Users\Admin\AppData\Local\Temp\1230638365.exeMD5
9ad727a371a0afc80274b2ae22f83abf
SHA10b4423282135f4df6647f194446474053b0b31da
SHA25653f9ec1ef40ed5b55673e49fc4c8c72a372d53c93a10a94b72b5d7c8470d8306
SHA51240bb2584538dabc0cea5e2c93275ad9244fd3e9b5ec0b2952a36d9b6ef46fec943a2a639112e6f8a8725066593807c9d0df9ecd86afd698ed7c5e6150756e731
-
C:\Users\Admin\AppData\Local\Temp\1230638365.exeMD5
9ad727a371a0afc80274b2ae22f83abf
SHA10b4423282135f4df6647f194446474053b0b31da
SHA25653f9ec1ef40ed5b55673e49fc4c8c72a372d53c93a10a94b72b5d7c8470d8306
SHA51240bb2584538dabc0cea5e2c93275ad9244fd3e9b5ec0b2952a36d9b6ef46fec943a2a639112e6f8a8725066593807c9d0df9ecd86afd698ed7c5e6150756e731
-
C:\Users\Admin\AppData\Local\Temp\1652022234.exeMD5
8c97633fd038b6a9656548a6eb1a7613
SHA1deefb0d8616717aa40f1983c4eab951facfe5687
SHA25683e29bfd2de9e9ec05f19963ca6084b109c1c8427d3fcc720ce0bcd076fa074e
SHA5121fe516050d7449ef6688465c079be080014520f66412974007a51ab904e42ecef24b50aff9791cb4e9ceee88edf12d1ce976457d5c09c5a30024be276cfa42a4
-
C:\Users\Admin\AppData\Local\Temp\1652022234.exeMD5
8c97633fd038b6a9656548a6eb1a7613
SHA1deefb0d8616717aa40f1983c4eab951facfe5687
SHA25683e29bfd2de9e9ec05f19963ca6084b109c1c8427d3fcc720ce0bcd076fa074e
SHA5121fe516050d7449ef6688465c079be080014520f66412974007a51ab904e42ecef24b50aff9791cb4e9ceee88edf12d1ce976457d5c09c5a30024be276cfa42a4
-
C:\Users\Admin\AppData\Local\Temp\2600214963.exeMD5
9ad727a371a0afc80274b2ae22f83abf
SHA10b4423282135f4df6647f194446474053b0b31da
SHA25653f9ec1ef40ed5b55673e49fc4c8c72a372d53c93a10a94b72b5d7c8470d8306
SHA51240bb2584538dabc0cea5e2c93275ad9244fd3e9b5ec0b2952a36d9b6ef46fec943a2a639112e6f8a8725066593807c9d0df9ecd86afd698ed7c5e6150756e731
-
C:\Users\Admin\AppData\Local\Temp\2600214963.exeMD5
9ad727a371a0afc80274b2ae22f83abf
SHA10b4423282135f4df6647f194446474053b0b31da
SHA25653f9ec1ef40ed5b55673e49fc4c8c72a372d53c93a10a94b72b5d7c8470d8306
SHA51240bb2584538dabc0cea5e2c93275ad9244fd3e9b5ec0b2952a36d9b6ef46fec943a2a639112e6f8a8725066593807c9d0df9ecd86afd698ed7c5e6150756e731
-
C:\Users\Admin\AppData\Local\Temp\2729311810.exeMD5
8c65b44e5d2d09d5c14e881a52386fd1
SHA1848d6ec4d4b0ad4322bb9c4b33d4c03b6c39114d
SHA25640f7fc587d70e0c3c1e8f955cec25fd86ada17928920b04714a2444289921992
SHA51288ce9eb6d8d042cdff7e3413ba2e28ae0781f4e79f548e79da6a7775b35b860d5a7f71352294e07b559bab606b26d1ba77e747cc6b0cef75234e29d3afde424f
-
C:\Users\Admin\AppData\Local\Temp\2729311810.exeMD5
8c65b44e5d2d09d5c14e881a52386fd1
SHA1848d6ec4d4b0ad4322bb9c4b33d4c03b6c39114d
SHA25640f7fc587d70e0c3c1e8f955cec25fd86ada17928920b04714a2444289921992
SHA51288ce9eb6d8d042cdff7e3413ba2e28ae0781f4e79f548e79da6a7775b35b860d5a7f71352294e07b559bab606b26d1ba77e747cc6b0cef75234e29d3afde424f
-
C:\Users\Admin\AppData\Local\Temp\3164236024.exeMD5
8c65b44e5d2d09d5c14e881a52386fd1
SHA1848d6ec4d4b0ad4322bb9c4b33d4c03b6c39114d
SHA25640f7fc587d70e0c3c1e8f955cec25fd86ada17928920b04714a2444289921992
SHA51288ce9eb6d8d042cdff7e3413ba2e28ae0781f4e79f548e79da6a7775b35b860d5a7f71352294e07b559bab606b26d1ba77e747cc6b0cef75234e29d3afde424f
-
C:\Users\Admin\AppData\Local\Temp\3164236024.exeMD5
8c65b44e5d2d09d5c14e881a52386fd1
SHA1848d6ec4d4b0ad4322bb9c4b33d4c03b6c39114d
SHA25640f7fc587d70e0c3c1e8f955cec25fd86ada17928920b04714a2444289921992
SHA51288ce9eb6d8d042cdff7e3413ba2e28ae0781f4e79f548e79da6a7775b35b860d5a7f71352294e07b559bab606b26d1ba77e747cc6b0cef75234e29d3afde424f
-
C:\Users\Admin\AppData\Local\Temp\3406732252.exeMD5
b89ef7d964ca4a8ea690205ea88c962f
SHA11b3028eda26f6cca669c0e0772ca0142ff1527bb
SHA256bc742502ac480d470e896d9b8391406aadfb8ddb343cba8e4eef9c107a94179d
SHA512693c7386c5895fd34eba3e56fe7febce8643836625303d3fd3bd9097ec31678183a7f2eb1266456f6bdddea83064a98abafd157c5272702cecbe651795fe9560
-
C:\Users\Admin\AppData\Local\Temp\3406732252.exeMD5
b89ef7d964ca4a8ea690205ea88c962f
SHA11b3028eda26f6cca669c0e0772ca0142ff1527bb
SHA256bc742502ac480d470e896d9b8391406aadfb8ddb343cba8e4eef9c107a94179d
SHA512693c7386c5895fd34eba3e56fe7febce8643836625303d3fd3bd9097ec31678183a7f2eb1266456f6bdddea83064a98abafd157c5272702cecbe651795fe9560
-
C:\Users\Admin\AppData\Local\Temp\3427929040.exeMD5
b89ef7d964ca4a8ea690205ea88c962f
SHA11b3028eda26f6cca669c0e0772ca0142ff1527bb
SHA256bc742502ac480d470e896d9b8391406aadfb8ddb343cba8e4eef9c107a94179d
SHA512693c7386c5895fd34eba3e56fe7febce8643836625303d3fd3bd9097ec31678183a7f2eb1266456f6bdddea83064a98abafd157c5272702cecbe651795fe9560
-
C:\Users\Admin\AppData\Local\Temp\3427929040.exeMD5
b89ef7d964ca4a8ea690205ea88c962f
SHA11b3028eda26f6cca669c0e0772ca0142ff1527bb
SHA256bc742502ac480d470e896d9b8391406aadfb8ddb343cba8e4eef9c107a94179d
SHA512693c7386c5895fd34eba3e56fe7febce8643836625303d3fd3bd9097ec31678183a7f2eb1266456f6bdddea83064a98abafd157c5272702cecbe651795fe9560
-
C:\Users\Admin\AppData\Local\Temp\3902419604.exeMD5
8c97633fd038b6a9656548a6eb1a7613
SHA1deefb0d8616717aa40f1983c4eab951facfe5687
SHA25683e29bfd2de9e9ec05f19963ca6084b109c1c8427d3fcc720ce0bcd076fa074e
SHA5121fe516050d7449ef6688465c079be080014520f66412974007a51ab904e42ecef24b50aff9791cb4e9ceee88edf12d1ce976457d5c09c5a30024be276cfa42a4
-
C:\Users\Admin\AppData\Local\Temp\3902419604.exeMD5
8c97633fd038b6a9656548a6eb1a7613
SHA1deefb0d8616717aa40f1983c4eab951facfe5687
SHA25683e29bfd2de9e9ec05f19963ca6084b109c1c8427d3fcc720ce0bcd076fa074e
SHA5121fe516050d7449ef6688465c079be080014520f66412974007a51ab904e42ecef24b50aff9791cb4e9ceee88edf12d1ce976457d5c09c5a30024be276cfa42a4
-
memory/188-23-0x0000000000000000-mapping.dmp
-
memory/728-6-0x0000000000000000-mapping.dmp
-
memory/1544-15-0x0000000000000000-mapping.dmp
-
memory/2140-9-0x0000000000000000-mapping.dmp
-
memory/3216-12-0x0000000000000000-mapping.dmp
-
memory/3508-3-0x0000000000000000-mapping.dmp
-
memory/3784-0-0x0000000000000000-mapping.dmp
-
memory/3992-19-0x0000000000000000-mapping.dmp
-
memory/4440-27-0x0000000000000000-mapping.dmp
-
memory/4956-31-0x0000000000000000-mapping.dmp