Overview

overview

10

Static

static

f1a4bbcf63...56.exe

windows7-x64

10

f1a4bbcf63...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe

  • Size

    191KB

  • Sample

    221006-p7gsyshde8

  • MD5

    699e7392535db8efd7a2e4e0ba279fec

  • SHA1

    3d4d5a2ff6207f0dbbc842d3b8971bd512b1190f

  • SHA256

    f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56

  • SHA512

    a8eaeff4b5c348ede36f7e34d89774e41aa156e7cbcb835f717677332ae327890b0ab8823da277a94bbd89903df3578661ba8da65d4be99baac70f8826063aa7

  • SSDEEP

    3072:ABittsFZbCwsqQcfizhLnQBrGxEGcG3TBf8EQjZqMNHDnvV85:ABikffsqQ7zdnQBrGuBG3TB4vj

Score
10/10
phorphiexevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Targets

    • Target

      f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56.exe

    • Size

      191KB

    • MD5

      699e7392535db8efd7a2e4e0ba279fec

    • SHA1

      3d4d5a2ff6207f0dbbc842d3b8971bd512b1190f

    • SHA256

      f1a4bbcf6335464a249378fc07e95c8f2f5315b9f8b6e2b845f2317894e80f56

    • SHA512

      a8eaeff4b5c348ede36f7e34d89774e41aa156e7cbcb835f717677332ae327890b0ab8823da277a94bbd89903df3578661ba8da65d4be99baac70f8826063aa7

    • SSDEEP

      3072:ABittsFZbCwsqQcfizhLnQBrGxEGcG3TBf8EQjZqMNHDnvV85:ABikffsqQ7zdnQBrGuBG3TB4vj

    Score
    10/10
    phorphiexevasionloaderpersistencetrojanworm

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Windows security bypass

      evasiontrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks