phorphiex | 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc

General

Target
tmp.exe
Size 73KB
Sample221111-hpsdeacabj
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysredvcs.exe

Executes dropped EXE 1 IoCs

pid	Process
4956	sysredvcs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysredvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysredvcs.exe"	tmp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysredvcs.exe	tmp.exe
File created	C:\Windows\sysredvcs.exe	tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4956	5016	tmp.exe	78
PID 5016 wrote to memory of 4956	5016	tmp.exe	78
PID 5016 wrote to memory of 4956	5016	tmp.exe	78

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\sysredvcs.exe
  C:\Windows\sysredvcs.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysredvcs.exe

Path C:\Windows\sysredvcs.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysredvcs.exe

Path C:\Windows\sysredvcs.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads