phorphiex | 552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17

Target

4c80e5212c71b86274b03c7e90df62a6.exe
Size

100KB
MD5

4c80e5212c71b86274b03c7e90df62a6
SHA1

27fb49e915fba0537c26f2e3643c8ed079cd5e45
SHA256

552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17
SHA512

4135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex Payload 3 IoCs

Processes:

resource	yara_rule
\13180265906024\wininet.exe	family_phorphiex
C:\13180265906024\wininet.exe	family_phorphiex
C:\13180265906024\wininet.exe	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

wininet.exe

pid process

1016 wininet.exe
Loads dropped DLL 1 IoCs

Processes:

4c80e5212c71b86274b03c7e90df62a6.exe

pid process

1052 4c80e5212c71b86274b03c7e90df62a6.exe

pid	process
1016	wininet.exe

pid	process
1052	4c80e5212c71b86274b03c7e90df62a6.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wininet.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wininet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wininet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wininet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wininet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wininet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wininet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	wininet.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4c80e5212c71b86274b03c7e90df62a6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\13180265906024\\wininet.exe"	4c80e5212c71b86274b03c7e90df62a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\13180265906024\\wininet.exe"	4c80e5212c71b86274b03c7e90df62a6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4c80e5212c71b86274b03c7e90df62a6.exe

description	pid	process	target process
PID 1052 wrote to memory of 1016	1052	4c80e5212c71b86274b03c7e90df62a6.exe	wininet.exe
PID 1052 wrote to memory of 1016	1052	4c80e5212c71b86274b03c7e90df62a6.exe	wininet.exe
PID 1052 wrote to memory of 1016	1052	4c80e5212c71b86274b03c7e90df62a6.exe	wininet.exe
PID 1052 wrote to memory of 1016	1052	4c80e5212c71b86274b03c7e90df62a6.exe	wininet.exe

C:\Users\Admin\AppData\Local\Temp\4c80e5212c71b86274b03c7e90df62a6.exe
"C:\Users\Admin\AppData\Local\Temp\4c80e5212c71b86274b03c7e90df62a6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052
- C:\13180265906024\wininet.exe
  C:\13180265906024\wininet.exe
  2⤵
  - Executes dropped EXE
  - Windows security modification
  PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\13180265906024\wininet.exe

MD5
4c80e5212c71b86274b03c7e90df62a6

SHA1
27fb49e915fba0537c26f2e3643c8ed079cd5e45

SHA256
552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17

SHA512
4135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453

Download Submit
C:\13180265906024\wininet.exe

MD5
4c80e5212c71b86274b03c7e90df62a6

SHA1
27fb49e915fba0537c26f2e3643c8ed079cd5e45

SHA256
552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17

SHA512
4135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453

Download Submit
\13180265906024\wininet.exe

MD5
4c80e5212c71b86274b03c7e90df62a6

SHA1
27fb49e915fba0537c26f2e3643c8ed079cd5e45

SHA256
552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17

SHA512
4135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453

Download Submit
memory/1016-61-0x0000000000000000-mapping.dmp

Download
memory/1052-59-0x0000000075721000-0x0000000075723000-memory.dmp

Filesize
8KB

Download