phorphiex | ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

General

Target

5741eadfc89a1352c61f1ff0a5c01c06.exe
Size

75KB
MD5

5741eadfc89a1352c61f1ff0a5c01c06
SHA1

cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256

ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA512

08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wcdsemgr.exewcdsemgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wcdsemgr.exe

Executes dropped EXE 3 IoCs

Processes:

wcdsemgr.exe3280928655.exewcdsemgr.exe

pid process

4672 wcdsemgr.exe
368 3280928655.exe
380 wcdsemgr.exe

pid	process
4672	wcdsemgr.exe
368	3280928655.exe
380	wcdsemgr.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wcdsemgr.exewcdsemgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wcdsemgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wcdsemgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5741eadfc89a1352c61f1ff0a5c01c06.exe3280928655.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\wcdsemgr.exe"	5741eadfc89a1352c61f1ff0a5c01c06.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\wcdsemgr.exe"	3280928655.exe

Drops file in Windows directory 3 IoCs

Processes:

5741eadfc89a1352c61f1ff0a5c01c06.exe3280928655.exe

description	ioc	process
File created	C:\Windows\wcdsemgr.exe	5741eadfc89a1352c61f1ff0a5c01c06.exe
File opened for modification	C:\Windows\wcdsemgr.exe	5741eadfc89a1352c61f1ff0a5c01c06.exe
File created	C:\Windows\wcdsemgr.exe	3280928655.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5741eadfc89a1352c61f1ff0a5c01c06.exewcdsemgr.exe3280928655.exe

description	pid	process	target process
PID 932 wrote to memory of 4672	932	5741eadfc89a1352c61f1ff0a5c01c06.exe	wcdsemgr.exe
PID 932 wrote to memory of 4672	932	5741eadfc89a1352c61f1ff0a5c01c06.exe	wcdsemgr.exe
PID 932 wrote to memory of 4672	932	5741eadfc89a1352c61f1ff0a5c01c06.exe	wcdsemgr.exe
PID 4672 wrote to memory of 368	4672	wcdsemgr.exe	3280928655.exe
PID 4672 wrote to memory of 368	4672	wcdsemgr.exe	3280928655.exe
PID 4672 wrote to memory of 368	4672	wcdsemgr.exe	3280928655.exe
PID 368 wrote to memory of 380	368	3280928655.exe	wcdsemgr.exe
PID 368 wrote to memory of 380	368	3280928655.exe	wcdsemgr.exe
PID 368 wrote to memory of 380	368	3280928655.exe	wcdsemgr.exe

C:\Users\Admin\AppData\Local\Temp\5741eadfc89a1352c61f1ff0a5c01c06.exe
"C:\Users\Admin\AppData\Local\Temp\5741eadfc89a1352c61f1ff0a5c01c06.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\wcdsemgr.exe
  C:\Windows\wcdsemgr.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\3280928655.exe
    C:\Users\Admin\AppData\Local\Temp\3280928655.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Users\Admin\wcdsemgr.exe
      C:\Users\Admin\wcdsemgr.exe
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      PID:380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3280928655.exe

Filesize
75KB

MD5
5741eadfc89a1352c61f1ff0a5c01c06

SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6

SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Download Submit
C:\Users\Admin\AppData\Local\Temp\3280928655.exe

Filesize
75KB

MD5
5741eadfc89a1352c61f1ff0a5c01c06

SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6

SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Download Submit
C:\Users\Admin\tncmds.dat

Filesize
292B

MD5
07872b17cfd93a2792bd0b17f5c07002

SHA1
7de2ee0b5255ecc6720fb91cae5e51af20a0e4c5

SHA256
44a3fbe34f99b539d55342fc99c33a9d5c6da95bfc765d94c47eb64ecbdbede0

SHA512
f6c519a48afd92a1eee0f6e4efdf9f0c0cd6104e7edae202aee33d1d8036be3be681032383c0b36fd1ca71ae53600d55b05bb736410f905de06b0f5364d64d37

Download Submit
C:\Users\Admin\tnnodes.dat

Filesize
4KB

MD5
be170ffc4777a1a6ed94290ac8e9f734

SHA1
18c63a6d7780224187ef1fd2c36700dea1136d2a

SHA256
cb2002e068f5a8cc44e7dc7768226f99994ae5ecf21f1b063049cf8eeeda2244

SHA512
62ffb45a0d3b29d9493bfa79d1241b2ccfb607e767ef584b8fe9e28eb7c73e7571445ca3b4e62afa4f9d7c11c18ddff40e49de061752a3b49450b38518f02636

Download Submit
C:\Users\Admin\wcdsemgr.exe

Filesize
75KB

MD5
5741eadfc89a1352c61f1ff0a5c01c06

SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6

SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Download Submit
C:\Users\Admin\wcdsemgr.exe

Filesize
75KB

MD5
5741eadfc89a1352c61f1ff0a5c01c06

SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6

SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Download Submit
C:\Windows\wcdsemgr.exe

Filesize
75KB

MD5
5741eadfc89a1352c61f1ff0a5c01c06

SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6

SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Download Submit
C:\Windows\wcdsemgr.exe

Filesize
75KB

MD5
5741eadfc89a1352c61f1ff0a5c01c06

SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6

SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

Download Submit
memory/368-133-0x0000000000000000-mapping.dmp

Download
memory/380-136-0x0000000000000000-mapping.dmp

Download
memory/4672-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads