phorphiex | d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef

General

Target
d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe
Size 79KB
Sample230826-styq4abe67
SHA256 d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef
MD5 90cbeadcda0ad6d4302c36aa9fd2a53c
SHA1 72326251a563e16eeec31d7e1f7bed9d99563246
SHA512 4b24d4970896a19178b290ff35ecfd6e5db08b74426992cdb02a0f19d792f92c6230507a376262f77375330e5d8adea139c072a29774e915bedb82840e1bee76
SSDEEP 1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	´sysesvcmw.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	´sysesvcmw.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	´sysesvcmw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	´sysesvcmw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\´sysesvcmw.exe"	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\´sysesvcmw.exe	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe
File opened for modification	C:\Windows\´sysesvcmw.exe	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3728	4580	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe	85
PID 4580 wrote to memory of 3728	4580	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe	85
PID 4580 wrote to memory of 3728	4580	d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\´sysesvcmw.exe
  C:\Windows\´sysesvcmw.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:3728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

´sysesvcmw.exe

Path C:\Windows\´sysesvcmw.exe
Size 79KB
SHA256 d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef
MD5 90cbeadcda0ad6d4302c36aa9fd2a53c
SHA1 72326251a563e16eeec31d7e1f7bed9d99563246
SHA512 4b24d4970896a19178b290ff35ecfd6e5db08b74426992cdb02a0f19d792f92c6230507a376262f77375330e5d8adea139c072a29774e915bedb82840e1bee76
SSDEEP 1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

´sysesvcmw.exe

Path C:\Windows\´sysesvcmw.exe
Size 79KB
SHA256 d2b6791fb169c2c87d9fbc2846525dbbbecef3bf112259214b1b4da907d580ef
MD5 90cbeadcda0ad6d4302c36aa9fd2a53c
SHA1 72326251a563e16eeec31d7e1f7bed9d99563246
SHA512 4b24d4970896a19178b290ff35ecfd6e5db08b74426992cdb02a0f19d792f92c6230507a376262f77375330e5d8adea139c072a29774e915bedb82840e1bee76
SSDEEP 1536:T3Mz8M4xQ21dFtb4Jn6wfpSzSLGcmRfFN8R+eeeeeeeeWeeeee:4wMH2zbb4x6wxTLGcmRfFN8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads