phorphiex | 4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8ecc1fd1deb6c69a39bbae5c2c4e528.exe
Size 10KB
Sample221124-fa4rsada2w
SHA256 4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee
MD5 d8ecc1fd1deb6c69a39bbae5c2c4e528
SHA1 9abce16698a70cf118a251a00ba550122ad31102
SHA512 7c00e5d84b5e6b5b8ac4e9bd1b1490db6cb1888c48f74946cc218954a1be30030360dc1fad35d7cd8e6909c58a0d201111ef8dc5416462378646c8bebc218ab7
SSDEEP 192:V8WNyBKkeqbOABDNDZP1oynVeMLkWS+E/Q+VIKiIidEiv:lNyxeqFBl1XeMQWS+E/Q+VXiWiv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysredvcs.exe

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
736	winsvc.exe
1592	3157112956.exe
2028	sysredvcs.exe
1932	1673529597.exe
1196	318404306.exe

Loads dropped DLL 4 IoCs

pid	Process
736	winsvc.exe
736	winsvc.exe
2028	sysredvcs.exe
2028	sysredvcs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysredvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysredvcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winsvc.exe"	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysredvcs.exe"	3157112956.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\winsvc.exe	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe
File opened for modification	C:\Windows\winsvc.exe	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe
File created	C:\Windows\sysredvcs.exe	3157112956.exe
File opened for modification	C:\Windows\sysredvcs.exe	3157112956.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 736	864	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe	29
PID 864 wrote to memory of 736	864	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe	29
PID 864 wrote to memory of 736	864	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe	29
PID 864 wrote to memory of 736	864	d8ecc1fd1deb6c69a39bbae5c2c4e528.exe	29
PID 736 wrote to memory of 1592	736	winsvc.exe	30
PID 736 wrote to memory of 1592	736	winsvc.exe	30
PID 736 wrote to memory of 1592	736	winsvc.exe	30
PID 736 wrote to memory of 1592	736	winsvc.exe	30
PID 1592 wrote to memory of 2028	1592	3157112956.exe	32
PID 1592 wrote to memory of 2028	1592	3157112956.exe	32
PID 1592 wrote to memory of 2028	1592	3157112956.exe	32
PID 1592 wrote to memory of 2028	1592	3157112956.exe	32
PID 2028 wrote to memory of 1932	2028	sysredvcs.exe	34
PID 2028 wrote to memory of 1932	2028	sysredvcs.exe	34
PID 2028 wrote to memory of 1932	2028	sysredvcs.exe	34
PID 2028 wrote to memory of 1932	2028	sysredvcs.exe	34
PID 2028 wrote to memory of 1196	2028	sysredvcs.exe	35
PID 2028 wrote to memory of 1196	2028	sysredvcs.exe	35
PID 2028 wrote to memory of 1196	2028	sysredvcs.exe	35
PID 2028 wrote to memory of 1196	2028	sysredvcs.exe	35
PID 1196 wrote to memory of 1808	1196	318404306.exe	36
PID 1196 wrote to memory of 1808	1196	318404306.exe	36
PID 1196 wrote to memory of 1808	1196	318404306.exe	36
PID 1196 wrote to memory of 1728	1196	318404306.exe	38
PID 1196 wrote to memory of 1728	1196	318404306.exe	38
PID 1196 wrote to memory of 1728	1196	318404306.exe	38
PID 1728 wrote to memory of 1208	1728	cmd.exe	41
PID 1728 wrote to memory of 1208	1728	cmd.exe	41
PID 1728 wrote to memory of 1208	1728	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\d8ecc1fd1deb6c69a39bbae5c2c4e528.exe
"C:\Users\Admin\AppData\Local\Temp\d8ecc1fd1deb6c69a39bbae5c2c4e528.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\winsvc.exe
  C:\Windows\winsvc.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Users\Admin\AppData\Local\Temp\3157112956.exe
    C:\Users\Admin\AppData\Local\Temp\3157112956.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\sysredvcs.exe
      C:\Windows\sysredvcs.exe
      4⤵
      Windows security bypass
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious use of WriteProcessMemory
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\1673529597.exe
        
        C:\Users\Admin\AppData\Local\Temp\1673529597.exe
        5⤵
        Executes dropped EXE
        
        PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\318404306.exe
        
        C:\Users\Admin\AppData\Local\Temp\318404306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /f
        6⤵
        
        PID:1808
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /f
        7⤵
        
        PID:1936
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "GoogleUpdateTaskMachineQC"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "GoogleUpdateTaskMachineQC"
        7⤵
        
        PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1673529597.exe

Path C:\Users\Admin\AppData\Local\Temp\1673529597.exe
Size 6KB
SHA256 439426d267966d8ca1a2dee65cc63dc5899b8ed9f07a84662c8c836bb3c77acd
MD5 083b15eab7618da9dc5c8ad941873d1a
SHA1 0f96a825435929e7510e1e8c234b2bc6ae4c049e
SHA512 44b796689a204ac1d9dfa252b00d5c307710a47133f844f27e05e34bd74ff7f8d76b119ff03564039c09465de2b32e2374647a139fe69ff91e795ebef7cb3b81
SSDEEP 96:k6xoFpotz6AE2H5CXl7xnGDqPtboynundCtZe:k6xaotzFEyi7aqP1oynWcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

3157112956.exe

Path C:\Users\Admin\AppData\Local\Temp\3157112956.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

3157112956.exe

Path C:\Users\Admin\AppData\Local\Temp\3157112956.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

318404306.exe

Path C:\Users\Admin\AppData\Local\Temp\318404306.exe
Size 6KB
SHA256 9cd42d2fda1280b56a3b3a02e8fbe4a85f3bcff978f7d25167696c80d62bbcc9
MD5 6709b681a9066706ccdb2e51ec46abf3
SHA1 1f8f945add7071b731123d6cf5218a97ffa1a27f
SHA512 a36bedd4fecbe318e35a45d6f133029488fc2932b3a4a6c106a78ad560543f0f7a922eade637e181b1fe17b24018d20ecaa9c7d762097404b85e27c17197bc0e
SSDEEP 96:mjmq3/j28iYohAZh61f799BF0QaHguME5qJllfKRqzl:mjNq8i1huh61j99BF0rAKECsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

318404306.exe

Path C:\Users\Admin\AppData\Local\Temp\318404306.exe
Size 6KB
SHA256 9cd42d2fda1280b56a3b3a02e8fbe4a85f3bcff978f7d25167696c80d62bbcc9
MD5 6709b681a9066706ccdb2e51ec46abf3
SHA1 1f8f945add7071b731123d6cf5218a97ffa1a27f
SHA512 a36bedd4fecbe318e35a45d6f133029488fc2932b3a4a6c106a78ad560543f0f7a922eade637e181b1fe17b24018d20ecaa9c7d762097404b85e27c17197bc0e
SSDEEP 96:mjmq3/j28iYohAZh61f799BF0QaHguME5qJllfKRqzl:mjNq8i1huh61j99BF0rAKECsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysredvcs.exe

Path C:\Windows\sysredvcs.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysredvcs.exe

Path C:\Windows\sysredvcs.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

winsvc.exe

Path C:\Windows\winsvc.exe
Size 10KB
SHA256 4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee
MD5 d8ecc1fd1deb6c69a39bbae5c2c4e528
SHA1 9abce16698a70cf118a251a00ba550122ad31102
SHA512 7c00e5d84b5e6b5b8ac4e9bd1b1490db6cb1888c48f74946cc218954a1be30030360dc1fad35d7cd8e6909c58a0d201111ef8dc5416462378646c8bebc218ab7
SSDEEP 192:V8WNyBKkeqbOABDNDZP1oynVeMLkWS+E/Q+VIKiIidEiv:lNyxeqFBl1XeMQWS+E/Q+VXiWiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

1673529597.exe

Path \Users\Admin\AppData\Local\Temp\1673529597.exe
Size 6KB
SHA256 439426d267966d8ca1a2dee65cc63dc5899b8ed9f07a84662c8c836bb3c77acd
MD5 083b15eab7618da9dc5c8ad941873d1a
SHA1 0f96a825435929e7510e1e8c234b2bc6ae4c049e
SHA512 44b796689a204ac1d9dfa252b00d5c307710a47133f844f27e05e34bd74ff7f8d76b119ff03564039c09465de2b32e2374647a139fe69ff91e795ebef7cb3b81
SSDEEP 96:k6xoFpotz6AE2H5CXl7xnGDqPtboynundCtZe:k6xaotzFEyi7aqP1oynWcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

3157112956.exe

Path \Users\Admin\AppData\Local\Temp\3157112956.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

3157112956.exe

Path \Users\Admin\AppData\Local\Temp\3157112956.exe
Size 73KB
SHA256 68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
MD5 45fcc38f53e4ba514815477f91618a47
SHA1 e971641482d77987e082289c38388052465b2117
SHA512 99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
SSDEEP 1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

318404306.exe

Path \Users\Admin\AppData\Local\Temp\318404306.exe
Size 6KB
SHA256 9cd42d2fda1280b56a3b3a02e8fbe4a85f3bcff978f7d25167696c80d62bbcc9
MD5 6709b681a9066706ccdb2e51ec46abf3
SHA1 1f8f945add7071b731123d6cf5218a97ffa1a27f
SHA512 a36bedd4fecbe318e35a45d6f133029488fc2932b3a4a6c106a78ad560543f0f7a922eade637e181b1fe17b24018d20ecaa9c7d762097404b85e27c17197bc0e
SSDEEP 96:mjmq3/j28iYohAZh61f799BF0QaHguME5qJllfKRqzl:mjNq8i1huh61j99BF0rAKECsZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmp

Download

memory/1196-76-0x000000013F890000-0x000000013F896000-memory.dmp

Download

memory/1196-77-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads