phorphiex | c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc

General

Target
c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe
Size 85KB
Sample220503-sawsdscbdm
SHA256 c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc
MD5 5a5ea34b7265aec2fbcc1183376a9f47
SHA1 6008107f7e197b564ec186caa8e04995cba50ede
SHA512 7f65306676f81a5456f24cb1f0ac4cbcb227a523af5e087ba4725bf1207dc8248085e59458de07b4ae32c8ff3f008235c16c5f627ab78c435dbca0334c8f1dc7
MD5 SHA1 SHA512

Score

10^/10

phorphiex evasion loader persistence suricata trojan worm

Malware Config

Signatures

Phorphiex Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022eb0-131.dat	family_phorphiex
behavioral2/files/0x0008000000022eb0-132.dat	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Executes dropped EXE 1 IoCs

pid	Process
1748	svchost.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\268633075922011\\svchost.exe"	c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\268633075922011\\svchost.exe"	c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1748	4304	c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe	87
PID 4304 wrote to memory of 1748	4304	c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe	87
PID 4304 wrote to memory of 1748	4304	c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe	87

C:\Users\Admin\AppData\Local\Temp\c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe
"C:\Users\Admin\AppData\Local\Temp\c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4304
- C:\268633075922011\svchost.exe
  C:\268633075922011\svchost.exe
  2⤵
  - Executes dropped EXE
  - Windows security modification
  PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\268633075922011\svchost.exe
Size 85KB
SHA256 c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc
MD5 5a5ea34b7265aec2fbcc1183376a9f47
SHA1 6008107f7e197b564ec186caa8e04995cba50ede
SHA512 7f65306676f81a5456f24cb1f0ac4cbcb227a523af5e087ba4725bf1207dc8248085e59458de07b4ae32c8ff3f008235c16c5f627ab78c435dbca0334c8f1dc7
SSDEEP 768:FllNU0vCiBb8nzDLu3rv0Ud/iCeFD9aki8fbo+bvzO9YtvCUbba74rY28FQhlXev:DzU4CW2zDy3rZeFDTi8Tr7KAHOM7IiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\268633075922011\svchost.exe
Size 85KB
SHA256 c2dccbab233df2db2afa8be9c811ca05f44befb91cdd82057e3877367f7902dc
MD5 5a5ea34b7265aec2fbcc1183376a9f47
SHA1 6008107f7e197b564ec186caa8e04995cba50ede
SHA512 7f65306676f81a5456f24cb1f0ac4cbcb227a523af5e087ba4725bf1207dc8248085e59458de07b4ae32c8ff3f008235c16c5f627ab78c435dbca0334c8f1dc7
SSDEEP 768:FllNU0vCiBb8nzDLu3rv0Ud/iCeFD9aki8fbo+bvzO9YtvCUbba74rY28FQhlXev:DzU4CW2zDy3rZeFDTi8Tr7KAHOM7IiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads