Analysis
-
max time kernel
137s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04-03-2023 08:04
Static task
static1
Behavioral task
behavioral1
Sample
605d8e8adf3e43e606d45869bc279803.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
605d8e8adf3e43e606d45869bc279803.exe
Resource
win10v2004-20230220-en
General
-
Target
605d8e8adf3e43e606d45869bc279803.exe
-
Size
7KB
-
MD5
605d8e8adf3e43e606d45869bc279803
-
SHA1
39a7dbe4554585fa73f6e581f0b7ccdd5ce26b27
-
SHA256
66ecd78d60b6b570cc14e088899af8afaad696bc11775c845777aebf7d97234c
-
SHA512
9ddb30dab956ca3310f8a791073ef6a4e492fc895015a2e389d6b8c1094f980d2caf49b68178f52d4d222e674dac03d3e5223aa470ef3e8605ca7016dbbf0ead
-
SSDEEP
96:S5UrVm8uw0G3U6RYHKcBPtboynuYUL8PCtbOoX:4MVm8ybkMP1oynfUL8ebJ
Malware Config
Extracted
phorphiex
http://185.215.113.66/
0x77BC9dDbaf423139eC0C7F699B676c72Ab34fcc7
TCX5ybBsuZE2BZk6GJMqZaCjBEjiuX1zPP
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
3278530633.exesysmsrvcx.exepid process 852 3278530633.exe 824 sysmsrvcx.exe -
Loads dropped DLL 2 IoCs
Processes:
605d8e8adf3e43e606d45869bc279803.exepid process 1520 605d8e8adf3e43e606d45869bc279803.exe 1520 605d8e8adf3e43e606d45869bc279803.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3278530633.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmsrvcx.exe" 3278530633.exe -
Drops file in Windows directory 2 IoCs
Processes:
3278530633.exedescription ioc process File created C:\Windows\sysmsrvcx.exe 3278530633.exe File opened for modification C:\Windows\sysmsrvcx.exe 3278530633.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
605d8e8adf3e43e606d45869bc279803.exe3278530633.exedescription pid process target process PID 1520 wrote to memory of 852 1520 605d8e8adf3e43e606d45869bc279803.exe 3278530633.exe PID 1520 wrote to memory of 852 1520 605d8e8adf3e43e606d45869bc279803.exe 3278530633.exe PID 1520 wrote to memory of 852 1520 605d8e8adf3e43e606d45869bc279803.exe 3278530633.exe PID 1520 wrote to memory of 852 1520 605d8e8adf3e43e606d45869bc279803.exe 3278530633.exe PID 852 wrote to memory of 824 852 3278530633.exe sysmsrvcx.exe PID 852 wrote to memory of 824 852 3278530633.exe sysmsrvcx.exe PID 852 wrote to memory of 824 852 3278530633.exe sysmsrvcx.exe PID 852 wrote to memory of 824 852 3278530633.exe sysmsrvcx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\605d8e8adf3e43e606d45869bc279803.exe"C:\Users\Admin\AppData\Local\Temp\605d8e8adf3e43e606d45869bc279803.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3278530633.exeC:\Users\Admin\AppData\Local\Temp\3278530633.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmsrvcx.exeC:\Windows\sysmsrvcx.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3278530633.exeFilesize
75KB
MD519076f70cf529cbcb260befcc4595f1a
SHA1e24619c6cc207f9ff26ca0ff553901de2e688ca0
SHA25601a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA512327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f
-
C:\Users\Admin\AppData\Local\Temp\3278530633.exeFilesize
75KB
MD519076f70cf529cbcb260befcc4595f1a
SHA1e24619c6cc207f9ff26ca0ff553901de2e688ca0
SHA25601a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA512327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f
-
C:\Users\Admin\AppData\Local\Temp\3278530633.exeFilesize
75KB
MD519076f70cf529cbcb260befcc4595f1a
SHA1e24619c6cc207f9ff26ca0ff553901de2e688ca0
SHA25601a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA512327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f
-
C:\Windows\sysmsrvcx.exeFilesize
75KB
MD519076f70cf529cbcb260befcc4595f1a
SHA1e24619c6cc207f9ff26ca0ff553901de2e688ca0
SHA25601a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA512327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f
-
\Users\Admin\AppData\Local\Temp\3278530633.exeFilesize
75KB
MD519076f70cf529cbcb260befcc4595f1a
SHA1e24619c6cc207f9ff26ca0ff553901de2e688ca0
SHA25601a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA512327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f
-
\Users\Admin\AppData\Local\Temp\3278530633.exeFilesize
75KB
MD519076f70cf529cbcb260befcc4595f1a
SHA1e24619c6cc207f9ff26ca0ff553901de2e688ca0
SHA25601a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
SHA512327d56cb76c2d7e57915189754073f89bec4ae204cd238ed713e885e5e5d1d6b13b4031ea56dcf86a418181ba30b1ae081fc39d0f14902827adcee3d29b54c2f