phorphiex | d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

General

Target
96de9c78028eaec7cd06d8e3e755ffc4.exe
Size 75KB
Sample220906-gla5aafhe3
SHA256 d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
MD5 96de9c78028eaec7cd06d8e3e755ffc4
SHA1 612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA512 5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
SSDEEP 1536:K3Mz8j5ZOooa0kCOrtEH1jBfSuh7wi5FLDtC:xwNZO3OpQ1VfPEi5Fft
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winuedrvs.exe

Executes dropped EXE 3 IoCs

pid	Process
1380	winuedrvs.exe
4080	89464612.exe
4124	662825328.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winuedrvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winuedrvs.exe"	96de9c78028eaec7cd06d8e3e755ffc4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winuedrvs.exe	96de9c78028eaec7cd06d8e3e755ffc4.exe
File opened for modification	C:\Windows\winuedrvs.exe	96de9c78028eaec7cd06d8e3e755ffc4.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1380	4528	96de9c78028eaec7cd06d8e3e755ffc4.exe	83
PID 4528 wrote to memory of 1380	4528	96de9c78028eaec7cd06d8e3e755ffc4.exe	83
PID 4528 wrote to memory of 1380	4528	96de9c78028eaec7cd06d8e3e755ffc4.exe	83
PID 1380 wrote to memory of 4080	1380	winuedrvs.exe	84
PID 1380 wrote to memory of 4080	1380	winuedrvs.exe	84
PID 1380 wrote to memory of 4080	1380	winuedrvs.exe	84
PID 1380 wrote to memory of 4124	1380	winuedrvs.exe	89
PID 1380 wrote to memory of 4124	1380	winuedrvs.exe	89
PID 1380 wrote to memory of 4124	1380	winuedrvs.exe	89

C:\Users\Admin\AppData\Local\Temp\96de9c78028eaec7cd06d8e3e755ffc4.exe
"C:\Users\Admin\AppData\Local\Temp\96de9c78028eaec7cd06d8e3e755ffc4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\winuedrvs.exe
  C:\Windows\winuedrvs.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\89464612.exe
    C:\Users\Admin\AppData\Local\Temp\89464612.exe
    3⤵
    - Executes dropped EXE
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\662825328.exe
    C:\Users\Admin\AppData\Local\Temp\662825328.exe
    3⤵
    - Executes dropped EXE
    PID:4124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

662825328.exe

Path C:\Users\Admin\AppData\Local\Temp\662825328.exe
Size 8KB
SHA256 62a26c3f4e3e1f469e06d2d9d14da3bbe49d80363753bddf2f23862c8e91784c
MD5 ca7b8f20e45e2e40f30cea521e1c6490
SHA1 49e227b0a5d8bb8b37efbd2bbfd3cbeb4fbbd984
SHA512 2db1a78ac144bf09825ade6be684cc381b09e3cf6a8a5eeab1b09eb57a42bd4481ec8d7974e7592638b75be1c85216485844cc080bb5b81893c6aee3addafff9
SSDEEP 96:rDF7ATAHD68mQBj5mSDB/FPSPGZnHqKbPtboynVyCtAP:VEkHPFgSDrK0KMP1oynbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

662825328.exe

Path C:\Users\Admin\AppData\Local\Temp\662825328.exe
Size 8KB
SHA256 62a26c3f4e3e1f469e06d2d9d14da3bbe49d80363753bddf2f23862c8e91784c
MD5 ca7b8f20e45e2e40f30cea521e1c6490
SHA1 49e227b0a5d8bb8b37efbd2bbfd3cbeb4fbbd984
SHA512 2db1a78ac144bf09825ade6be684cc381b09e3cf6a8a5eeab1b09eb57a42bd4481ec8d7974e7592638b75be1c85216485844cc080bb5b81893c6aee3addafff9
SSDEEP 96:rDF7ATAHD68mQBj5mSDB/FPSPGZnHqKbPtboynVyCtAP:VEkHPFgSDrK0KMP1oynbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

89464612.exe

Path C:\Users\Admin\AppData\Local\Temp\89464612.exe
Size 6KB
SHA256 368c0f5e42a73e655f18a564b7e6cd53ca4ef702108c08b59f3fa819faec4655
MD5 69171b8026f4437ea72ce1f37a22ca27
SHA1 6f8cffe2a8bdcb4f3955816e2b524cd7847be9eb
SHA512 66e93474c01a3cb01e17ea142f0ff07664738c5cf944b7352ef2955c2a084529884292cb8921a32207e8b78fb7ca6ae7d5ae6a8d84447d6c8a1cc38d1d9782ae
SSDEEP 96:A9Jtz6aW+HV3Ml7hYGz32Ptboynun9Ct5:8tz/E7uP1oynW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

89464612.exe

Path C:\Users\Admin\AppData\Local\Temp\89464612.exe
Size 6KB
SHA256 368c0f5e42a73e655f18a564b7e6cd53ca4ef702108c08b59f3fa819faec4655
MD5 69171b8026f4437ea72ce1f37a22ca27
SHA1 6f8cffe2a8bdcb4f3955816e2b524cd7847be9eb
SHA512 66e93474c01a3cb01e17ea142f0ff07664738c5cf944b7352ef2955c2a084529884292cb8921a32207e8b78fb7ca6ae7d5ae6a8d84447d6c8a1cc38d1d9782ae
SSDEEP 96:A9Jtz6aW+HV3Ml7hYGz32Ptboynun9Ct5:8tz/E7uP1oynW8
MD5 SHA1 SHA512 SSDEEP

Submit Download

winuedrvs.exe

Path C:\Windows\winuedrvs.exe
Size 75KB
SHA256 d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
MD5 96de9c78028eaec7cd06d8e3e755ffc4
SHA1 612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA512 5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
SSDEEP 1536:K3Mz8j5ZOooa0kCOrtEH1jBfSuh7wi5FLDtC:xwNZO3OpQ1VfPEi5Fft
MD5 SHA1 SHA512 SSDEEP

Submit Download

winuedrvs.exe

Path C:\Windows\winuedrvs.exe
Size 75KB
SHA256 d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f
MD5 96de9c78028eaec7cd06d8e3e755ffc4
SHA1 612d1261bce41723b0a981c92bf9f186c9d46fe2
SHA512 5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f
SSDEEP 1536:K3Mz8j5ZOooa0kCOrtEH1jBfSuh7wi5FLDtC:xwNZO3OpQ1VfPEi5Fft
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads