phoenix | bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da

General

Target

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
Size

1.1MB
MD5

df42c439132933e840bb989440b0db6d
SHA1

80e66df85a64d4b88083fcfcd6a280a07ddbaa41
SHA256

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da
SHA512

15a80ca61db62f5c2c24ad1c87d1baae3a8ec247f66df64b03fe8ca3c154d5fd9fdc11db57675bfc56f3d194b16e75c5af1bd5d54b189e87605808d969bc3f6e

Score

10^/10

phoenix collection keylogger stealer

Malware Config

Signatures

Phoenix Keylogger
Phoenix is a keylogger and info stealer first seen in July 2019.
stealer keylogger phoenix

Phoenix Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1240-64-0x0000000000980000-0x00000000009BA000-memory.dmp	family_phoenix

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ifconfig.me

flow	ioc
4	ifconfig.me

Suspicious use of SetThreadContext 1 IoCs

Processes:

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

description	pid	process	target process
PID 988 set thread context of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

268 1240 WerFault.exe MSBuild.exe

pid	pid_target	process	target process
268	1240	WerFault.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

pid	process
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1240 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1240	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

pid	process
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

pid	process
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exeMSBuild.exe

description	pid	process	target process
PID 988 wrote to memory of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe
PID 988 wrote to memory of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe
PID 988 wrote to memory of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe
PID 988 wrote to memory of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe
PID 988 wrote to memory of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe
PID 988 wrote to memory of 1240	988	bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe	MSBuild.exe
PID 1240 wrote to memory of 268	1240	MSBuild.exe	WerFault.exe
PID 1240 wrote to memory of 268	1240	MSBuild.exe	WerFault.exe
PID 1240 wrote to memory of 268	1240	MSBuild.exe	WerFault.exe
PID 1240 wrote to memory of 268	1240	MSBuild.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe
"C:\Users\Admin\AppData\Local\Temp\bcb6b071f96c578d2262fc1559b8ee534fecfb47e9cee3096b3cde7576de99da.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1068
    3⤵
    - Program crash
    PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-67-0x0000000000000000-mapping.dmp

Download
memory/988-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/988-65-0x0000000000560000-0x0000000000580000-memory.dmp

Filesize
128KB

Download
memory/1240-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1240-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1240-62-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1240-61-0x0000000000420DBE-mapping.dmp

Download
memory/1240-63-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1240-64-0x0000000000980000-0x00000000009BA000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads