Malware Analysis Report

2024-11-13 15:39

Sample ID 220813-p83f2saabp
Target 516319480.exe
SHA256 ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
Tags
phorphiex evasion loader persistence trojan worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3

Threat Level: Known bad

The file 516319480.exe was found to be: Known bad.

Malicious Activity Summary

phorphiex evasion loader persistence trojan worm

Phorphiex family

Phorphiex

Windows security bypass

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

Drops file in Windows directory

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-08-13 13:00

Signatures

Phorphiex family

phorphiex

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-13 13:00

Reported

2022-08-13 13:03

Platform

win7-20220812-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\516319480.exe"

Signatures

Phorphiex

worm trojan loader phorphiex

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\wcdsemgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\469420666.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2356332166.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\wcdsemgr.exe N/A
N/A N/A C:\Windows\wcdsemgr.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\wcdsemgr.exe" C:\Users\Admin\AppData\Local\Temp\516319480.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\wcdsemgr.exe C:\Users\Admin\AppData\Local\Temp\516319480.exe N/A
File opened for modification C:\Windows\wcdsemgr.exe C:\Users\Admin\AppData\Local\Temp\516319480.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\516319480.exe

"C:\Users\Admin\AppData\Local\Temp\516319480.exe"

C:\Windows\wcdsemgr.exe

C:\Windows\wcdsemgr.exe

C:\Users\Admin\AppData\Local\Temp\469420666.exe

C:\Users\Admin\AppData\Local\Temp\469420666.exe

C:\Users\Admin\AppData\Local\Temp\2356332166.exe

C:\Users\Admin\AppData\Local\Temp\2356332166.exe

Network

Country Destination Domain Proto
RU 185.215.113.84:80 185.215.113.84 tcp
RU 185.215.113.84:80 185.215.113.84 tcp
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.109.209.108:80 www.update.microsoft.com tcp
IR 2.189.179.240:40500 tcp
MX 189.181.198.112:40500 udp
RU 185.215.113.84:80 185.215.113.84 tcp
TJ 109.74.67.96:40500 udp
FR 37.59.176.0:40500 udp
MX 189.154.175.11:40500 udp
UZ 80.80.220.62:40500 udp
RU 78.106.184.54:40500 tcp
US 69.67.151.86:40500 udp
UZ 213.230.71.54:40500 udp
KG 85.113.19.18:40500 udp
IR 2.184.186.185:40500 udp
IR 151.238.34.112:40500 tcp
IR 151.235.66.22:40500 udp
UZ 89.236.231.136:40500 udp
IR 2.178.168.136:40500 udp
UZ 217.30.171.221:40500 udp
VE 190.36.68.224:40500 udp
MZ 197.218.177.139:40500 tcp
BG 146.70.53.135:40500 udp
RU 2.94.45.35:40500 udp
US 69.67.151.59:40500 udp
SY 82.100.171.178:40500 udp
IR 66.79.104.149:40500 udp
UZ 213.230.121.236:40500 tcp
IR 176.65.178.144:40500 udp

Files

memory/1820-54-0x0000000075061000-0x0000000075063000-memory.dmp

memory/1984-55-0x0000000000000000-mapping.dmp

C:\Windows\wcdsemgr.exe

MD5 5741eadfc89a1352c61f1ff0a5c01c06
SHA1 cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256 ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA512 08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

C:\Windows\wcdsemgr.exe

MD5 5741eadfc89a1352c61f1ff0a5c01c06
SHA1 cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256 ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA512 08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

\Users\Admin\AppData\Local\Temp\469420666.exe

MD5 c8a69840ffff790ea975bb0cf55f7f4d
SHA1 dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA256 e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
SHA512 df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

memory/1840-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\469420666.exe

MD5 c8a69840ffff790ea975bb0cf55f7f4d
SHA1 dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA256 e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
SHA512 df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

\Users\Admin\AppData\Local\Temp\2356332166.exe

MD5 a475e43527d7dc7d6f2d23bad64fcc99
SHA1 793a7625c0106d6cd79d060b4eec94e58530833e
SHA256 f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
SHA512 4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

memory/1084-63-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\2356332166.exe

MD5 a475e43527d7dc7d6f2d23bad64fcc99
SHA1 793a7625c0106d6cd79d060b4eec94e58530833e
SHA256 f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
SHA512 4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

Analysis: behavioral2

Detonation Overview

Submitted

2022-08-13 13:00

Reported

2022-08-13 13:03

Platform

win10v2004-20220812-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\516319480.exe"

Signatures

Phorphiex

worm trojan loader phorphiex

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\wcdsemgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\681626553.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\734214244.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\Windows\wcdsemgr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\wcdsemgr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\wcdsemgr.exe" C:\Users\Admin\AppData\Local\Temp\516319480.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\wcdsemgr.exe C:\Users\Admin\AppData\Local\Temp\516319480.exe N/A
File opened for modification C:\Windows\wcdsemgr.exe C:\Users\Admin\AppData\Local\Temp\516319480.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\516319480.exe

"C:\Users\Admin\AppData\Local\Temp\516319480.exe"

C:\Windows\wcdsemgr.exe

C:\Windows\wcdsemgr.exe

C:\Users\Admin\AppData\Local\Temp\681626553.exe

C:\Users\Admin\AppData\Local\Temp\681626553.exe

C:\Users\Admin\AppData\Local\Temp\734214244.exe

C:\Users\Admin\AppData\Local\Temp\734214244.exe

Network

Country Destination Domain Proto
RU 185.215.113.84:80 185.215.113.84 tcp
RU 185.215.113.84:80 185.215.113.84 tcp
RU 185.215.113.84:80 185.215.113.84 tcp
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.72.235.82:80 www.update.microsoft.com tcp
UZ 89.249.62.233:40500 tcp
IR 151.242.146.96:40500 udp
TR 109.228.205.235:40500 udp
KZ 95.56.190.220:40500 tcp
IR 89.41.11.75:40500 udp
US 20.189.173.2:443 tcp
US 69.67.151.77:40500 udp
IR 2.178.34.71:40500 udp
IR 80.210.26.209:40500 udp
US 93.184.220.29:80 tcp
IR 5.235.167.139:40500 udp
IR 2.185.154.69:40500 tcp
RU 212.75.139.98:40500 udp
BE 8.238.110.126:80 tcp
YE 188.209.238.30:40500 udp
IR 188.158.158.164:40500 udp
US 93.184.221.240:80 tcp
SD 41.209.102.191:40500 udp
AM 141.136.94.243:40500 udp
VE 186.90.114.33:40500 tcp
MX 187.155.205.39:40500 udp
IR 188.158.76.83:40500 udp
UZ 213.230.91.15:40500 udp
IR 2.186.231.230:40500 udp
FR 37.59.176.0:40500 udp
PK 39.52.130.16:40500 udp
TJ 109.74.67.96:40500 tcp
IR 151.242.140.145:40500 udp
DZ 41.96.28.194:40500 udp
UZ 213.230.127.141:40500 udp
MX 187.200.48.89:40500 udp
TH 182.53.72.147:40500 udp
MX 187.200.227.79:40500 tcp
PK 39.33.116.49:40500 udp
RU 128.73.85.90:40500 udp

Files

memory/3764-132-0x0000000000000000-mapping.dmp

C:\Windows\wcdsemgr.exe

MD5 5741eadfc89a1352c61f1ff0a5c01c06
SHA1 cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256 ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA512 08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

C:\Windows\wcdsemgr.exe

MD5 5741eadfc89a1352c61f1ff0a5c01c06
SHA1 cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256 ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA512 08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063

memory/3476-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\681626553.exe

MD5 c8a69840ffff790ea975bb0cf55f7f4d
SHA1 dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA256 e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
SHA512 df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

C:\Users\Admin\AppData\Local\Temp\681626553.exe

MD5 c8a69840ffff790ea975bb0cf55f7f4d
SHA1 dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA256 e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
SHA512 df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a

memory/3420-138-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\734214244.exe

MD5 a475e43527d7dc7d6f2d23bad64fcc99
SHA1 793a7625c0106d6cd79d060b4eec94e58530833e
SHA256 f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
SHA512 4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900

C:\Users\Admin\AppData\Local\Temp\734214244.exe

MD5 a475e43527d7dc7d6f2d23bad64fcc99
SHA1 793a7625c0106d6cd79d060b4eec94e58530833e
SHA256 f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
SHA512 4af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900