Analysis
- max time kernel
152s - max time network
160s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
- submitted
25/07/2022, 02:46
General
- Target d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe
- Size 392KB
- Sample220725-c9b92abea5
- SHA256 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf
Malware Config
Extracted
-
phorphiex
-
http://185.176.27.132/
-
13cQ2H6oszrEnvw1ZGdsPix9gUayB8tzNa
-
qr5pm4d27z250wpz4sfy08ytghxn56kryvsw5tdw99
-
XfrM8P9YWSg8mQTxSCCxyHUeQjMEGx8vnE
-
DSG5PddW9wu1eKdLcx4f3KBF4wUvaBFaGc
-
0x373b9854c9e4511b920372f5495640cdc25d6832
-
LSermtCTLWeS683x17AtYuhNT8MpMmVmi8
-
t1XgRHyGj6YDNqkS5EWwdcXG1rjQPFFdUsR
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Phorphiex payload 2 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Windows security modification 2 TTPs 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe"C:\Users\Admin\AppData\Local\Temp\d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\251915576\sysuwys.exeC:\Windows\251915576\sysuwys.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
sysuwys.exe
sysuwys.exe
sysuwys.exe
sysuwys.exe
memory/1412-54-0x0000000076291000-0x0000000076293000-memory.dmp
memory/1412-55-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1412-56-0x0000000000300000-0x000000000030E000-memory.dmp
memory/1412-61-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2044-67-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2044-68-0x0000000000230000-0x000000000023E000-memory.dmp
memory/2044-74-0x0000000000400000-0x0000000000466000-memory.dmp