Malware Analysis Report

2025-01-19 05:03

Sample ID 220731-h7cqnsecf6
Target 6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98
SHA256 6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98
Tags
phoenix collection keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98

Threat Level: Known bad

The file 6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98 was found to be: Known bad.

Malicious Activity Summary

phoenix collection keylogger spyware stealer

Phoenix Keylogger payload

Phoenix Keylogger

Phoenix family

Reads user/profile data of web browsers

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Program crash

outlook_office_path

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-31 07:22

Signatures

Phoenix Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

Phoenix family

phoenix

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-31 07:22

Reported

2022-07-31 10:27

Platform

win7-20220718-en

Max time kernel

82s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe"

Signatures

Phoenix Keylogger

stealer keylogger phoenix

Phoenix Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ifconfig.me N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe

"C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1264

Network

Country Destination Domain Proto
US 8.8.8.8:53 ifconfig.me udp
US 34.160.111.145:80 ifconfig.me tcp

Files

memory/1328-54-0x00000000000C0000-0x00000000000DC000-memory.dmp

memory/1328-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

memory/1592-56-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-31 07:22

Reported

2022-07-31 10:25

Platform

win10v2004-20220721-en

Max time kernel

78s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe"

Signatures

Phoenix Keylogger

stealer keylogger phoenix

Phoenix Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ifconfig.me N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe

"C:\Users\Admin\AppData\Local\Temp\6c163bee10e7a3b0c3ca2174f9875841fe26815c52d63cdfc4553ef422493d98.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4336 -ip 4336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1768

Network

Country Destination Domain Proto
US 8.8.8.8:53 ifconfig.me udp
US 34.160.111.145:80 ifconfig.me tcp
FR 2.18.109.224:443 tcp
FR 40.79.141.152:443 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp

Files

memory/4336-130-0x0000000000BB0000-0x0000000000BCC000-memory.dmp

memory/4336-131-0x00000000059A0000-0x0000000005F44000-memory.dmp

memory/4336-132-0x0000000005490000-0x000000000552C000-memory.dmp

memory/4336-133-0x0000000006640000-0x00000000066A6000-memory.dmp

memory/4336-134-0x0000000006CC0000-0x0000000006E82000-memory.dmp