phoenix | 580006399ce81551ccf09b2ff057eb3a1a8b74cd2234419292f9cdc79945fb16

Analysis

max time kernel
151s
max time network
137s
platform
windows10_x64
resource
win10v20201028
submitted
29-10-2020 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Temppot_Protected.bin.exe
Size

288KB
MD5

c42599e95105b0f96915f009cf9b0956
SHA1

591049db2ec06a767ccc107a580470e85a094c58
SHA256

580006399ce81551ccf09b2ff057eb3a1a8b74cd2234419292f9cdc79945fb16
SHA512

d869ff010821bdc8046ed9632eccefb887c0be9c65b71bf66adebced69cfd815300388a5bc86030c660f40f2add2ec21c1d15b9d8ac05a26bd0cc8c836f7b6a1

Score

10^/10

phoenix keylogger stealer

Malware Config

Signatures

Phoenix Keylogger
Phoenix is a keylogger and info stealer first seen in July 2019.
stealer keylogger phoenix

Phoenix Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1804-10-0x0000000005820000-0x0000000005851000-memory.dmp	family_phoenix

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ifconfig.me

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 500 set thread context of 1804	500	Temppot_Protected.bin.exe	75

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
1804	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe
500	Temppot_Protected.bin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	Temppot_Protected.bin.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
500	Temppot_Protected.bin.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	500	Temppot_Protected.bin.exe
Token: SeDebugPrivilege	1804	Temppot_Protected.bin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	Temppot_Protected.bin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 1804	500	Temppot_Protected.bin.exe	75
PID 500 wrote to memory of 1804	500	Temppot_Protected.bin.exe	75
PID 500 wrote to memory of 1804	500	Temppot_Protected.bin.exe	75
PID 500 wrote to memory of 1804	500	Temppot_Protected.bin.exe	75

C:\Users\Admin\AppData\Local\Temp\Temppot_Protected.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Temppot_Protected.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\Temppot_Protected.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Temppot_Protected.bin.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-0-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/500-1-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/500-3-0x0000000000C90000-0x0000000000CB9000-memory.dmp

Filesize
164KB

Download
memory/500-4-0x0000000004A40000-0x0000000004A60000-memory.dmp

Filesize
128KB

Download
memory/1804-5-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1804-7-0x0000000073560000-0x0000000073C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1804-10-0x0000000005820000-0x0000000005851000-memory.dmp

Filesize
196KB

Download
memory/1804-11-0x0000000006140000-0x0000000006141000-memory.dmp

Filesize
4KB

Download
memory/1804-12-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/1804-13-0x00000000068F0000-0x00000000068F1000-memory.dmp

Filesize
4KB

Download
memory/1804-14-0x0000000007100000-0x0000000007101000-memory.dmp

Filesize
4KB

Download
memory/1804-15-0x00000000070A0000-0x00000000070A1000-memory.dmp

Filesize
4KB

Download