Malware Analysis Report

2024-11-30 15:37

Sample ID 210527-kg5q5274tx
Target 1694521508.bin.zip
SHA256 794d7a6997fe076aebd016658a0f2fffc19546c899a9b220af921eecf4bc0a3e
Tags
phorphiex evasion loader persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

794d7a6997fe076aebd016658a0f2fffc19546c899a9b220af921eecf4bc0a3e

Threat Level: Known bad

The file 1694521508.bin.zip was found to be: Known bad.

Malicious Activity Summary

phorphiex evasion loader persistence trojan worm

Phorphiex Payload

Phorphiex family

Phorphiex Worm

Windows security bypass

Executes dropped EXE

Windows security modification

Loads dropped DLL

Adds Run key to start application

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-05-27 06:15

Signatures

Phorphiex Payload

Description Indicator Process Target
N/A N/A N/A N/A

Phorphiex family

phorphiex

Analysis: behavioral1

Detonation Overview

Submitted

2021-05-27 06:15

Reported

2021-05-27 06:18

Platform

win7v20210410

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe"

Signatures

Phorphiex Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phorphiex Worm

worm trojan loader phorphiex

Windows security bypass

evasion trojan

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\2652120957336\lsass.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\2652120957336\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\2652120957336\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\2652120957336\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\2652120957336\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\2652120957336\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\2652120957336\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\2652120957336\lsass.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\2652120957336\\lsass.exe" C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\2652120957336\\lsass.exe" C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe

"C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe"

C:\2652120957336\lsass.exe

C:\2652120957336\lsass.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 api.wipmania.com udp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 95.217.42.50:1067 95.217.42.50 tcp
N/A 127.0.0.1:56102 tcp
N/A 185.215.113.93:80 tcp
N/A 154.35.175.225:80 154.35.175.225 tcp
N/A 45.33.46.101:9001 tcp
N/A 91.219.237.21:443 tcp
N/A 131.188.40.189:443 131.188.40.189 tcp
N/A 212.149.211.5:443 tcp
N/A 45.66.156.176:8443 tcp
N/A 185.215.113.93:80 tcp
N/A 45.66.156.176:8443 tcp
N/A 185.215.113.93:80 tcp
N/A 141.255.162.34:8080 tcp
N/A 185.215.113.93:80 tcp
N/A 141.255.162.34:8080 tcp
N/A 185.215.113.93:80 tcp
N/A 131.188.40.189:443 131.188.40.189 tcp
N/A 130.185.250.214:80 tcp
N/A 185.215.113.93:80 tcp
N/A 89.37.120.230:26 tcp
N/A 185.181.160.216:9001 tcp
N/A 77.50.84.6:443 tcp
N/A 127.0.0.1:56102 tcp
N/A 130.185.250.214:80 tcp

Files

memory/1088-60-0x0000000075281000-0x0000000075283000-memory.dmp

\2652120957336\lsass.exe

MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

memory/292-62-0x0000000000000000-mapping.dmp

C:\2652120957336\lsass.exe

MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

C:\2652120957336\lsass.exe

MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

Analysis: behavioral2

Detonation Overview

Submitted

2021-05-27 06:15

Reported

2021-05-27 06:18

Platform

win10v20210410

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe"

Signatures

Phorphiex Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phorphiex Worm

worm trojan loader phorphiex

Windows security bypass

evasion trojan

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\18310262110790\lsass.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1770125895.exe N/A
N/A N/A C:\12361143712238\dwm.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\12361143712238\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\12361143712238\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\12361143712238\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\12361143712238\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\12361143712238\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\12361143712238\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\18310262110790\lsass.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\12361143712238\dwm.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\18310262110790\\lsass.exe" C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Desktop Window Manager = "C:\\12361143712238\\dwm.exe" C:\Users\Admin\AppData\Local\Temp\1770125895.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Desktop Window Manager = "C:\\12361143712238\\dwm.exe" C:\Users\Admin\AppData\Local\Temp\1770125895.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\18310262110790\\lsass.exe" C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe

"C:\Users\Admin\AppData\Local\Temp\1694521508.bin.exe"

C:\18310262110790\lsass.exe

C:\18310262110790\lsass.exe

C:\Users\Admin\AppData\Local\Temp\1770125895.exe

C:\Users\Admin\AppData\Local\Temp\\1770125895.exe

C:\12361143712238\dwm.exe

C:\12361143712238\dwm.exe

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 api.wipmania.com udp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 131.188.40.189:443 131.188.40.189 tcp
N/A 86.59.21.38:80 86.59.21.38 tcp
N/A 127.0.0.1:61482 tcp
N/A 185.215.113.93:80 tcp
N/A 154.35.175.225:80 154.35.175.225 tcp
N/A 104.244.74.211:9000 tcp
N/A 193.182.61.9:443 tcp
N/A 193.47.147.252:9001 tcp
N/A 213.32.71.116:9030 tcp
N/A 185.215.113.93:80 tcp
N/A 23.129.64.201:80 tcp
N/A 185.215.113.93:80 tcp
N/A 199.58.81.140:80 199.58.81.140 tcp
N/A 185.113.143.86:443 tcp
N/A 198.100.148.205:443 tcp
N/A 193.189.100.202:443 tcp
N/A 127.0.0.1:61482 tcp
N/A 5.154.174.241:443 tcp
N/A 78.46.174.72:9001 tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 185.215.113.93:80 tcp
N/A 127.0.0.1:61482 tcp
N/A 45.150.64.55:443 tcp
N/A 80.66.135.123:9001 tcp
N/A 77.68.88.20:443 tcp
N/A 95.216.27.105:9001 tcp
N/A 212.83.168.196:80 api.wipmania.com tcp
N/A 193.182.61.9:443 tcp
N/A 213.239.218.195:9001 tcp
N/A 127.0.0.1:61482 tcp
N/A 185.215.113.93:80 tcp
N/A 185.215.113.93:80 tcp
N/A 104.244.74.211:9000 tcp
N/A 193.47.147.252:9001 tcp
N/A 185.113.143.86:443 tcp
N/A 198.100.148.205:443 tcp
N/A 193.189.100.202:443 tcp
N/A 5.154.174.241:443 tcp
N/A 78.46.174.72:9001 tcp
N/A 127.0.0.1:61482 tcp
N/A 185.215.113.93:80 tcp
N/A 127.0.0.1:61482 tcp
N/A 45.150.64.55:443 tcp
N/A 80.66.135.123:9001 tcp
N/A 77.68.88.20:443 tcp
N/A 95.216.27.105:9001 tcp
N/A 185.215.113.93:80 tcp
N/A 185.215.113.93:80 tcp

Files

memory/3776-114-0x0000000000000000-mapping.dmp

C:\18310262110790\lsass.exe

MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

C:\18310262110790\lsass.exe

MD5 ee0a1ec859b753abc30847157d81f37c
SHA1 2fd868d94c6dc063ca49c767c873505fbc87dcd9
SHA256 abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922
SHA512 6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

C:\Users\Admin\AppData\Local\Temp\1770125895.exe

MD5 d46fb7feb34da15fae1c05116d0c3885
SHA1 e2aa39b7c26fbbf31cfa05386495ad3bafd3ef90
SHA256 f7cf59d65e7673a1e170750cf9fea732a013b84c547c3a139adadec614ea6f96
SHA512 5fcb894b66a0ce3b93db4ed8a31c4718a66b822279d16fc0a553ec115696a333b2613113055d890083a79398f953f2286b51f103c1f221297145f6e9296f9807

memory/1992-117-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1770125895.exe

MD5 d46fb7feb34da15fae1c05116d0c3885
SHA1 e2aa39b7c26fbbf31cfa05386495ad3bafd3ef90
SHA256 f7cf59d65e7673a1e170750cf9fea732a013b84c547c3a139adadec614ea6f96
SHA512 5fcb894b66a0ce3b93db4ed8a31c4718a66b822279d16fc0a553ec115696a333b2613113055d890083a79398f953f2286b51f103c1f221297145f6e9296f9807

memory/2588-120-0x0000000000000000-mapping.dmp

C:\12361143712238\dwm.exe

MD5 d46fb7feb34da15fae1c05116d0c3885
SHA1 e2aa39b7c26fbbf31cfa05386495ad3bafd3ef90
SHA256 f7cf59d65e7673a1e170750cf9fea732a013b84c547c3a139adadec614ea6f96
SHA512 5fcb894b66a0ce3b93db4ed8a31c4718a66b822279d16fc0a553ec115696a333b2613113055d890083a79398f953f2286b51f103c1f221297145f6e9296f9807

C:\12361143712238\dwm.exe

MD5 d46fb7feb34da15fae1c05116d0c3885
SHA1 e2aa39b7c26fbbf31cfa05386495ad3bafd3ef90
SHA256 f7cf59d65e7673a1e170750cf9fea732a013b84c547c3a139adadec614ea6f96
SHA512 5fcb894b66a0ce3b93db4ed8a31c4718a66b822279d16fc0a553ec115696a333b2613113055d890083a79398f953f2286b51f103c1f221297145f6e9296f9807