phorphiex | c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d

General

Target
209baf40779b80d5e443c3dbbd656bfb.exe
Size 75KB
Sample220811-g67c8aead3
SHA256 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
MD5 209baf40779b80d5e443c3dbbd656bfb
SHA1 b64fa8dded031d5dacac519a2035cefcd05e6503
SHA512 9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e
MD5 SHA1 SHA512

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wklopsvcs.exe

Executes dropped EXE 3 IoCs

pid	Process
1688	wklopsvcs.exe
1792	253278763.exe
1568	1694820364.exe

Loads dropped DLL 2 IoCs

pid	Process
1688	wklopsvcs.exe
1688	wklopsvcs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wklopsvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wklopsvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\wklopsvcs.exe"	209baf40779b80d5e443c3dbbd656bfb.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wklopsvcs.exe	209baf40779b80d5e443c3dbbd656bfb.exe
File created	C:\Windows\wklopsvcs.exe	209baf40779b80d5e443c3dbbd656bfb.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1688	1092	209baf40779b80d5e443c3dbbd656bfb.exe	27
PID 1092 wrote to memory of 1688	1092	209baf40779b80d5e443c3dbbd656bfb.exe	27
PID 1092 wrote to memory of 1688	1092	209baf40779b80d5e443c3dbbd656bfb.exe	27
PID 1092 wrote to memory of 1688	1092	209baf40779b80d5e443c3dbbd656bfb.exe	27
PID 1688 wrote to memory of 1792	1688	wklopsvcs.exe	30
PID 1688 wrote to memory of 1792	1688	wklopsvcs.exe	30
PID 1688 wrote to memory of 1792	1688	wklopsvcs.exe	30
PID 1688 wrote to memory of 1792	1688	wklopsvcs.exe	30
PID 1688 wrote to memory of 1568	1688	wklopsvcs.exe	31
PID 1688 wrote to memory of 1568	1688	wklopsvcs.exe	31
PID 1688 wrote to memory of 1568	1688	wklopsvcs.exe	31
PID 1688 wrote to memory of 1568	1688	wklopsvcs.exe	31

C:\Users\Admin\AppData\Local\Temp\209baf40779b80d5e443c3dbbd656bfb.exe
"C:\Users\Admin\AppData\Local\Temp\209baf40779b80d5e443c3dbbd656bfb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\wklopsvcs.exe
  C:\Windows\wklopsvcs.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\253278763.exe
    C:\Users\Admin\AppData\Local\Temp\253278763.exe
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Users\Admin\AppData\Local\Temp\1694820364.exe
    C:\Users\Admin\AppData\Local\Temp\1694820364.exe
    3⤵
    - Executes dropped EXE
    PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1694820364.exe

Path C:\Users\Admin\AppData\Local\Temp\1694820364.exe
Size 6KB
SHA256 f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
MD5 a475e43527d7dc7d6f2d23bad64fcc99
SHA1 793a7625c0106d6cd79d060b4eec94e58530833e
SHA512 4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900
SSDEEP 96:nYdJtz6aW+HMl7hswYGZ9w/Ptboynun9Cth:nktz/67hO/P1oynW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

253278763.exe

Path C:\Users\Admin\AppData\Local\Temp\253278763.exe
Size 9KB
SHA256 e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
MD5 c8a69840ffff790ea975bb0cf55f7f4d
SHA1 dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA512 df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a
SSDEEP 96:xZednSm6JihrDRlgujT8NCZPtboynfnMADCtUPgh:jVghBK08IP1oynPMAaUYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

wklopsvcs.exe

Path C:\Windows\wklopsvcs.exe
Size 75KB
SHA256 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
MD5 209baf40779b80d5e443c3dbbd656bfb
SHA1 b64fa8dded031d5dacac519a2035cefcd05e6503
SHA512 9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e
SSDEEP 1536:E3Mz8Guoo90MXrtvWhzNmgrZBVnWw7V15FK9:fwGuPXpOh5mgrVnj7V15FK
MD5 SHA1 SHA512 SSDEEP

Submit Download

wklopsvcs.exe

Path C:\Windows\wklopsvcs.exe
Size 75KB
SHA256 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
MD5 209baf40779b80d5e443c3dbbd656bfb
SHA1 b64fa8dded031d5dacac519a2035cefcd05e6503
SHA512 9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e
SSDEEP 1536:E3Mz8Guoo90MXrtvWhzNmgrZBVnWw7V15FK9:fwGuPXpOh5mgrVnj7V15FK
MD5 SHA1 SHA512 SSDEEP

Submit Download

1694820364.exe

Path \Users\Admin\AppData\Local\Temp\1694820364.exe
Size 6KB
SHA256 f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
MD5 a475e43527d7dc7d6f2d23bad64fcc99
SHA1 793a7625c0106d6cd79d060b4eec94e58530833e
SHA512 4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900
SSDEEP 96:nYdJtz6aW+HMl7hswYGZ9w/Ptboynun9Cth:nktz/67hO/P1oynW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

253278763.exe

Path \Users\Admin\AppData\Local\Temp\253278763.exe
Size 9KB
SHA256 e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
MD5 c8a69840ffff790ea975bb0cf55f7f4d
SHA1 dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA512 df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a
SSDEEP 96:xZednSm6JihrDRlgujT8NCZPtboynfnMADCtUPgh:jVghBK08IP1oynPMAaUYh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-54-0x0000000075871000-0x0000000075873000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads