phorphiex | 4196b94a61fbb975f313ca486b1ef91b39c0bdcd9ff94c36edbdbeb9f07b78a7

General

Target
128e7b46b91789697fc09d8ba0463003.exe
Size 100KB
Sample231219-ne16fscff9
SHA256 4196b94a61fbb975f313ca486b1ef91b39c0bdcd9ff94c36edbdbeb9f07b78a7
MD5 128e7b46b91789697fc09d8ba0463003
SHA1 34ec405532b51e18cfc95ec0cb15a1dd775d90e4
SHA512 1c0200d12662d52502d4084e520bc083bb869cd89e87d9c6d97c3d0877ea47c9bc0dadb261740048cd9fadda19eb55ced9227d04f8df5b9218e35b6ade11e581
SSDEEP 3072:jXmkh1ZZDI5msTBTsDCnseWR3KEBqwciyY496dh3YwFS8ShFx:rmkhvluBBTsDCnHSKEBqwciyY496dhon
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.93/

Wallets

15i4zgkk6g4x3eb161Ay9hMj8aZ8dswqEJpNaCY4s4C5ka17
17SBPhXtH8AxszbyEPPvFaazef6Cpup7Rg
3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ
qrzu3lahc7thkstxdsjamym2sak78j6mpy23fk3mxj
XdxqSoWqiAHKgbXP5zQabiy2kUhbtaiqmn
DAHCJcwE5y3K4nA9YGjiLWSEPmadeh7uZX
0x57af5e3E5D6CB0cA6F44D303328b4f68Edaa9E39
LKHcffQ1KFH9byXS8VdfHUYLzY9a8W4ZHg
r9Ftrva5RQP24TsK3yA5JVgDHaSSFxvt1s
TDfp7Nkqk26x6Yx7Cg4otm96HLpaUXRXfY
t1aCQnZyyAmDbuDxHvWHYJw8yHKXvGKfx2H
AJE3WzUsBvX1BWF1fcnwby28114DKpoSVm
bitcoincash:qrzu3lahc7thkstxdsjamym2sak78j6mpy23fk3mxj
4AfbdZbgJ52fg6GbKkR2gRT3DMboW1ZToGisLqu3psxsGEtXoGg8QGhdfhcYkX5He19L2qEJpG2fajSz7mxEbYQF2zCAMKs
GCY7OC7EPYI6LSMPCC54UBGNFGFMX2LJF6SCVRKS5CJD5YMHVQSGBJVW
bnb1qq5re95dlsf0l0edx8kjpurluc5uslgdgqzxnv
bc1qfqne66vggljvmreg8gz6ng8xrjtf63vrm4c40a

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023210-3.dat	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dwm.exe

Executes dropped EXE 1 IoCs

pid	Process
2892	dwm.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	dwm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Desktop Window Manager = "C:\\2245153113664\\dwm.exe"	128e7b46b91789697fc09d8ba0463003.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Desktop Window Manager = "C:\\2245153113664\\dwm.exe"	128e7b46b91789697fc09d8ba0463003.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2892	1200	128e7b46b91789697fc09d8ba0463003.exe	92
PID 1200 wrote to memory of 2892	1200	128e7b46b91789697fc09d8ba0463003.exe	92
PID 1200 wrote to memory of 2892	1200	128e7b46b91789697fc09d8ba0463003.exe	92

C:\Users\Admin\AppData\Local\Temp\128e7b46b91789697fc09d8ba0463003.exe
"C:\Users\Admin\AppData\Local\Temp\128e7b46b91789697fc09d8ba0463003.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1200
- C:\2245153113664\dwm.exe
  C:\2245153113664\dwm.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\2245153113664\dwm.exe
Size 100KB
SHA256 4196b94a61fbb975f313ca486b1ef91b39c0bdcd9ff94c36edbdbeb9f07b78a7
MD5 128e7b46b91789697fc09d8ba0463003
SHA1 34ec405532b51e18cfc95ec0cb15a1dd775d90e4
SHA512 1c0200d12662d52502d4084e520bc083bb869cd89e87d9c6d97c3d0877ea47c9bc0dadb261740048cd9fadda19eb55ced9227d04f8df5b9218e35b6ade11e581
SSDEEP 3072:jXmkh1ZZDI5msTBTsDCnseWR3KEBqwciyY496dh3YwFS8ShFx:rmkhvluBBTsDCnHSKEBqwciyY496dhon
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads