phorphiex | db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5

General

Target

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
Size

454KB
MD5

87f19914a9966998a89839dbdc978d4f
SHA1

f7a14349ce4d889dac552451c91dddf7bc583245
SHA256

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5
SHA512

6c25271d3a52c9f82c34789ed278a8b42565739eedb016cf622a7b488202d6b32bcab4d31edd2db500993b1a24a8debc2ec9e8f5270185ade362f8a28c89cf6b

Score

10^/10

phorphiex evasion loader persistence suricata trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.176.27.132/

Wallets

19mduWVW9QphW5W2caWF84wcGVSmASRYpf

qp5d3zpgldngtzf0xg2swnqaedfhn3kmsyhk7kp0yt

Xj2EfZ34QwSskhx4aRjWjGpLpMgNQWgYeV

DRkCr8Qum86fMBT3ceyzYBAGzD8pbRZmba

0xab1b250d67d08bf73ac864ea57af8cf762a29649

LVvqtuuqxcPbmqZ7VQju6kFTmQKZ58yXH2

t1dWznNU9rPvPLhmgUQTivyFYmCk4FhDKRc

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

sysfstx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sysfstx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sysfstx.exe

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3068-132-0x0000000002460000-0x000000000246A000-memory.dmp	family_phorphiex
behavioral2/memory/2280-139-0x00000000005E0000-0x00000000005EA000-memory.dmp	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

sysfstx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfstx.exe

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata
Executes dropped EXE 1 IoCs

Processes:

sysfstx.exe

pid process

2280 sysfstx.exe

pid	process
2280	sysfstx.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

sysfstx.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	sysfstx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfstx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\1923925090\\sysfstx.exe"	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\1923925090\\sysfstx.exe"	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe

Drops file in Windows directory 3 IoCs

Processes:

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe

description	ioc	process
File created	C:\Windows\1923925090\sysfstx.exe	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
File opened for modification	C:\Windows\1923925090\sysfstx.exe	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
File opened for modification	C:\Windows\1923925090	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exesysfstx.exe

pid	process
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe
2280	sysfstx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exesysfstx.exe

description	pid	process
Token: SeDebugPrivilege	3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
Token: SeDebugPrivilege	2280	sysfstx.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe

description	pid	process	target process
PID 3068 wrote to memory of 2280	3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe	sysfstx.exe
PID 3068 wrote to memory of 2280	3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe	sysfstx.exe
PID 3068 wrote to memory of 2280	3068	db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe	sysfstx.exe

C:\Users\Admin\AppData\Local\Temp\db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe
"C:\Users\Admin\AppData\Local\Temp\db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\1923925090\sysfstx.exe
C:\Windows\1923925090\sysfstx.exe
2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Disabling Security Tools

3

T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\1923925090\sysfstx.exe
Filesize
454KB

MD5
87f19914a9966998a89839dbdc978d4f

SHA1
f7a14349ce4d889dac552451c91dddf7bc583245

SHA256
db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5

SHA512
6c25271d3a52c9f82c34789ed278a8b42565739eedb016cf622a7b488202d6b32bcab4d31edd2db500993b1a24a8debc2ec9e8f5270185ade362f8a28c89cf6b

Download Submit
C:\Windows\1923925090\sysfstx.exe
Filesize
454KB

MD5
87f19914a9966998a89839dbdc978d4f

SHA1
f7a14349ce4d889dac552451c91dddf7bc583245

SHA256
db627ff946ff64910cf909c81ae51294c4bb6477ee2c620aae1d0f7a7208b6b5

SHA512
6c25271d3a52c9f82c34789ed278a8b42565739eedb016cf622a7b488202d6b32bcab4d31edd2db500993b1a24a8debc2ec9e8f5270185ade362f8a28c89cf6b

Download Submit
memory/2280-133-0x0000000000000000-mapping.dmp

Download
memory/2280-136-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2280-138-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2280-139-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/3068-130-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3068-131-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3068-132-0x0000000002460000-0x000000000246A000-memory.dmp

Filesize
40KB

Download
memory/3068-137-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads