phorphiex | b564f60fe6aa3c42836ce4bcad1c111532fa9381552af1cf07432a35325536e5

General

Target

xzxz/DriveMgr.exe
Size

181KB
MD5

21b478895429ea7a534794822dce5950
SHA1

9b6699769eab7a1e67b72a01585cad64445b69a6
SHA256

957511b6e51c6d8da71014bb9ac88ef7e24fb63e1345aa113c573a4a69f70018
SHA512

c6c360ee4c2cfa3dcb54935c252b369ee44f20c1da941fd98462b869814803457b721901954305064b750b82bb8ece9217a98e8163dcbdcbf6b2517fa9c9b879
SSDEEP

3072:REbJSwzmlbt/d6WruEPJZDTS7MJCAc2BEUzWndAatTIgFpg2lQBV+UdE+rECWp7f:WbJSwIcWruEhZDTS7MJCAc2BEUzWnd7j

Score

10^/10

phorphiex evasion loader persistence trojan upx worm

Malware Config

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000600000001af10-137.dat	family_phorphiex
behavioral1/memory/4404-138-0x0000000000EA0000-0x0000000000EBE000-memory.dmp	family_phorphiex
behavioral1/files/0x000600000001af11-142.dat	family_phorphiex
behavioral1/files/0x000600000001af11-143.dat	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000001a560-122.dat	acprotect
behavioral1/files/0x000500000001a560-127.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1824	lsass.exe

Loads dropped DLL 1 IoCs

pid	Process
4404	DriveMgr.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a560-122.dat	upx
behavioral1/memory/4404-125-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x000500000001a560-127.dat	upx
behavioral1/memory/4404-139-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4404-145-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	lsass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\107661983819572\\lsass.exe"	DriveMgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\107661983819572\\lsass.exe"	DriveMgr.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	DriveMgr.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	DriveMgr.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	DriveMgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4404	DriveMgr.exe
4404	DriveMgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	DriveMgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1824	4404	DriveMgr.exe	66
PID 4404 wrote to memory of 1824	4404	DriveMgr.exe	66
PID 4404 wrote to memory of 1824	4404	DriveMgr.exe	66

C:\Users\Admin\AppData\Local\Temp\xzxz\DriveMgr.exe
"C:\Users\Admin\AppData\Local\Temp\xzxz\DriveMgr.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\107661983819572\lsass.exe
  C:\107661983819572\lsass.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\107661983819572\lsass.exe

Filesize
105KB

MD5
a5b52c5e0c977b7e03caa61a19bdf22c

SHA1
c51156c6540cdc73daf59cf618b3cfc92c3c4c63

SHA256
057f8f82fb2bae7638438cdd9ae6099f06039d0af97564b7bad9486066b78505

SHA512
2bb1ced0a9f59fac90404435c2b7994bce4903bec2092b0078f8f89392ac824bf8f04ca5d456617bc874df3772243301965a7e53b7b7059505815c31e82fd69d

Download Submit
C:\107661983819572\lsass.exe

Filesize
105KB

MD5
a5b52c5e0c977b7e03caa61a19bdf22c

SHA1
c51156c6540cdc73daf59cf618b3cfc92c3c4c63

SHA256
057f8f82fb2bae7638438cdd9ae6099f06039d0af97564b7bad9486066b78505

SHA512
2bb1ced0a9f59fac90404435c2b7994bce4903bec2092b0078f8f89392ac824bf8f04ca5d456617bc874df3772243301965a7e53b7b7059505815c31e82fd69d

Download Submit
C:\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\A1D26E2\B59945C1134.tmp

Filesize
105KB

MD5
a5b52c5e0c977b7e03caa61a19bdf22c

SHA1
c51156c6540cdc73daf59cf618b3cfc92c3c4c63

SHA256
057f8f82fb2bae7638438cdd9ae6099f06039d0af97564b7bad9486066b78505

SHA512
2bb1ced0a9f59fac90404435c2b7994bce4903bec2092b0078f8f89392ac824bf8f04ca5d456617bc874df3772243301965a7e53b7b7059505815c31e82fd69d

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
memory/4404-125-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4404-138-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

Filesize
120KB

Download
memory/4404-139-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4404-145-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads