phorphiex | a86bc10b92d0cdefbbcb2e58ea78b165ff8983599356ceb81311f92c759bf36f

General

Target

5d91a29ea526e4630883fd17a5e43f9b.exe
Size

31KB
MD5

5d91a29ea526e4630883fd17a5e43f9b
SHA1

6615060efc5b5d439a6ac0246d9668c797e98692
SHA256

a86bc10b92d0cdefbbcb2e58ea78b165ff8983599356ceb81311f92c759bf36f
SHA512

329bd44f37812a54b468fdb06665aa93bf434aa4f5f1c6dbb68c1f86a5e3bd900929387407edbd6ed6ba6c148fff0136113be4fa11fb08431dedd6be817ac7c1

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex Payload 4 IoCs

Processes:

resource	yara_rule
C:\1387055783027\svchost.exe	family_phorphiex
C:\1387055783027\svchost.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\1240915218.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\1240915218.exe	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 3 IoCs

Processes:

svchost.exe1240915218.exe3645528959.exe

pid process

2716 svchost.exe
3744 1240915218.exe
2188 3645528959.exe

pid	process
2716	svchost.exe
3744	1240915218.exe
2188	3645528959.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5d91a29ea526e4630883fd17a5e43f9b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\1387055783027\\svchost.exe"	5d91a29ea526e4630883fd17a5e43f9b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\1387055783027\\svchost.exe"	5d91a29ea526e4630883fd17a5e43f9b.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 icanhazip.com

flow	ioc
33	icanhazip.com

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5d91a29ea526e4630883fd17a5e43f9b.exesvchost.exe

description	pid	process	target process
PID 4048 wrote to memory of 2716	4048	5d91a29ea526e4630883fd17a5e43f9b.exe	svchost.exe
PID 4048 wrote to memory of 2716	4048	5d91a29ea526e4630883fd17a5e43f9b.exe	svchost.exe
PID 4048 wrote to memory of 2716	4048	5d91a29ea526e4630883fd17a5e43f9b.exe	svchost.exe
PID 2716 wrote to memory of 3744	2716	svchost.exe	1240915218.exe
PID 2716 wrote to memory of 3744	2716	svchost.exe	1240915218.exe
PID 2716 wrote to memory of 3744	2716	svchost.exe	1240915218.exe
PID 2716 wrote to memory of 2188	2716	svchost.exe	3645528959.exe
PID 2716 wrote to memory of 2188	2716	svchost.exe	3645528959.exe
PID 2716 wrote to memory of 2188	2716	svchost.exe	3645528959.exe

C:\Users\Admin\AppData\Local\Temp\5d91a29ea526e4630883fd17a5e43f9b.exe
"C:\Users\Admin\AppData\Local\Temp\5d91a29ea526e4630883fd17a5e43f9b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4048

C:\1387055783027\svchost.exe
C:\1387055783027\svchost.exe
2⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\1240915218.exe
C:\Users\Admin\AppData\Local\Temp\1240915218.exe
3⤵
- Executes dropped EXE
PID:3744

C:\Users\Admin\AppData\Local\Temp\3645528959.exe
C:\Users\Admin\AppData\Local\Temp\3645528959.exe
3⤵
- Executes dropped EXE
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1387055783027\svchost.exe
MD5
5d91a29ea526e4630883fd17a5e43f9b

SHA1
6615060efc5b5d439a6ac0246d9668c797e98692

SHA256
a86bc10b92d0cdefbbcb2e58ea78b165ff8983599356ceb81311f92c759bf36f

SHA512
329bd44f37812a54b468fdb06665aa93bf434aa4f5f1c6dbb68c1f86a5e3bd900929387407edbd6ed6ba6c148fff0136113be4fa11fb08431dedd6be817ac7c1

Download Submit
C:\1387055783027\svchost.exe
MD5
5d91a29ea526e4630883fd17a5e43f9b

SHA1
6615060efc5b5d439a6ac0246d9668c797e98692

SHA256
a86bc10b92d0cdefbbcb2e58ea78b165ff8983599356ceb81311f92c759bf36f

SHA512
329bd44f37812a54b468fdb06665aa93bf434aa4f5f1c6dbb68c1f86a5e3bd900929387407edbd6ed6ba6c148fff0136113be4fa11fb08431dedd6be817ac7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1240915218.exe
MD5
5d91a29ea526e4630883fd17a5e43f9b

SHA1
6615060efc5b5d439a6ac0246d9668c797e98692

SHA256
a86bc10b92d0cdefbbcb2e58ea78b165ff8983599356ceb81311f92c759bf36f

SHA512
329bd44f37812a54b468fdb06665aa93bf434aa4f5f1c6dbb68c1f86a5e3bd900929387407edbd6ed6ba6c148fff0136113be4fa11fb08431dedd6be817ac7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1240915218.exe
MD5
5d91a29ea526e4630883fd17a5e43f9b

SHA1
6615060efc5b5d439a6ac0246d9668c797e98692

SHA256
a86bc10b92d0cdefbbcb2e58ea78b165ff8983599356ceb81311f92c759bf36f

SHA512
329bd44f37812a54b468fdb06665aa93bf434aa4f5f1c6dbb68c1f86a5e3bd900929387407edbd6ed6ba6c148fff0136113be4fa11fb08431dedd6be817ac7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3645528959.exe
MD5
7f371679986c29befdf61c85c1262008

SHA1
f1b6a970675cd61dccee2f460685ea0922b55a3c

SHA256
2a3e09782d93ed6198e184ced21083b9c233f61a8c79aaa8cc9c383daefec581

SHA512
f9f998f4b7af9b425d5d00805c0bc7495b52b198d355ff2eb4654ca4920a9b048fdaa74c11cc13db4b87ed1bee933d0dc4a272edc0f254777867934979af92f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\3645528959.exe
MD5
7f371679986c29befdf61c85c1262008

SHA1
f1b6a970675cd61dccee2f460685ea0922b55a3c

SHA256
2a3e09782d93ed6198e184ced21083b9c233f61a8c79aaa8cc9c383daefec581

SHA512
f9f998f4b7af9b425d5d00805c0bc7495b52b198d355ff2eb4654ca4920a9b048fdaa74c11cc13db4b87ed1bee933d0dc4a272edc0f254777867934979af92f2

Download Submit
memory/2188-6-0x0000000000000000-mapping.dmp

Download
memory/2716-0-0x0000000000000000-mapping.dmp

Download
memory/3744-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads