phorphiex | 29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889

General

Target

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
Size

248KB
MD5

a995787df1dd00b8c0554d0429a0055b
SHA1

3e62863d7144cbdb00ebd0856c05e6c55383f5b9
SHA256

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889
SHA512

0c5eb2f92a1f5e700a9c01c36196c557ce5ab324fb7c1b214a87d8318a077de9c55e32bdb0e976e254039b95adcb058dcf2e99e394d1804a0c87acdc96ce0632

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://193.32.161.73/

Wallets

1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh

qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0xa5228127395263575a4b4f532e4f132b14599d24

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

syspxgi.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	syspxgi.exe

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1908-57-0x0000000000270000-0x000000000027B000-memory.dmp	family_phorphiex
behavioral1/memory/1984-66-0x00000000002D0000-0x00000000002DB000-memory.dmp	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

syspxgi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syspxgi.exe

Executes dropped EXE 1 IoCs

Processes:

syspxgi.exe

pid process

1984 syspxgi.exe

pid	process
1984	syspxgi.exe

Loads dropped DLL 2 IoCs

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

pid	process
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

syspxgi.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syspxgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	syspxgi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\1955122345\\syspxgi.exe"	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\1955122345\\syspxgi.exe"	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

Drops file in Windows directory 3 IoCs

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

description	ioc	process
File opened for modification	C:\Windows\1955122345\syspxgi.exe	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
File opened for modification	C:\Windows\1955122345	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
File created	C:\Windows\1955122345\syspxgi.exe	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exesyspxgi.exe

pid	process
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe
1984	syspxgi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exesyspxgi.exe

description	pid	process
Token: SeDebugPrivilege	1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
Token: SeDebugPrivilege	1984	syspxgi.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exesyspxgi.exe

pid	process
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
1984	syspxgi.exe
1984	syspxgi.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe

description	pid	process	target process
PID 1908 wrote to memory of 1984	1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe	syspxgi.exe
PID 1908 wrote to memory of 1984	1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe	syspxgi.exe
PID 1908 wrote to memory of 1984	1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe	syspxgi.exe
PID 1908 wrote to memory of 1984	1908	29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe	syspxgi.exe

C:\Users\Admin\AppData\Local\Temp\29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe
"C:\Users\Admin\AppData\Local\Temp\29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\1955122345\syspxgi.exe
C:\Windows\1955122345\syspxgi.exe
2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\1955122345\syspxgi.exe
Filesize
248KB

MD5
a995787df1dd00b8c0554d0429a0055b

SHA1
3e62863d7144cbdb00ebd0856c05e6c55383f5b9

SHA256
29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889

SHA512
0c5eb2f92a1f5e700a9c01c36196c557ce5ab324fb7c1b214a87d8318a077de9c55e32bdb0e976e254039b95adcb058dcf2e99e394d1804a0c87acdc96ce0632

Download Submit
\Windows\1955122345\syspxgi.exe
Filesize
248KB

MD5
a995787df1dd00b8c0554d0429a0055b

SHA1
3e62863d7144cbdb00ebd0856c05e6c55383f5b9

SHA256
29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889

SHA512
0c5eb2f92a1f5e700a9c01c36196c557ce5ab324fb7c1b214a87d8318a077de9c55e32bdb0e976e254039b95adcb058dcf2e99e394d1804a0c87acdc96ce0632

Download Submit
\Windows\1955122345\syspxgi.exe
Filesize
248KB

MD5
a995787df1dd00b8c0554d0429a0055b

SHA1
3e62863d7144cbdb00ebd0856c05e6c55383f5b9

SHA256
29c5bee50ae4ae71dee17438c7833ce25eac1a7dad491703eec74cf266b0e889

SHA512
0c5eb2f92a1f5e700a9c01c36196c557ce5ab324fb7c1b214a87d8318a077de9c55e32bdb0e976e254039b95adcb058dcf2e99e394d1804a0c87acdc96ce0632

Download Submit
memory/1908-54-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1908-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1908-56-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/1908-57-0x0000000000270000-0x000000000027B000-memory.dmp

Filesize
44KB

Download
memory/1908-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1984-60-0x0000000000000000-mapping.dmp

Download
memory/1984-62-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1984-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1984-66-0x00000000002D0000-0x00000000002DB000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads