phorphiex | 94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161

General

Target
file.exe
Size 79KB
Sample240205-r61wjsadf7
SHA256 94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161
MD5 bb3d7bd66c92454429a8c78bf64f977b
SHA1 85563e7850d20f984a6264f68602fcc8a2b1a73f
SHA512 cacd552b6cb5a1b1ee3569428681d154c25f6fa4b7141e33a64153b30711c345b6335161aa4a87688c047610cca141091b57cf8fe883769495a3b6caf3f03ea0
SSDEEP 1536:AQaPX8E9Fmavs2ThOBYHpCVfF7kIchZU8mcwpjNV6IqTlEpF:AQ48BOLhO/DMZJxwpjmTlEpF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	file.exe

Executes dropped EXE 2 IoCs

pid	Process
2376	1865125236.exe
1740	2787716652.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	file.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	file.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winxsdrvcsa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winxsdrvcsa.exe"	file.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winxsdrvcsa.exe	file.exe
File opened for modification	C:\Windows\winxsdrvcsa.exe	file.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
116	2376	WerFault.exe	92

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 2376	3748	file.exe	92
PID 3748 wrote to memory of 2376	3748	file.exe	92
PID 3748 wrote to memory of 2376	3748	file.exe	92
PID 3748 wrote to memory of 1740	3748	file.exe	96
PID 3748 wrote to memory of 1740	3748	file.exe	96
PID 3748 wrote to memory of 1740	3748	file.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\1865125236.exe
  C:\Users\Admin\AppData\Local\Temp\1865125236.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 324
    3⤵
    - Program crash
    PID:116
- C:\Users\Admin\AppData\Local\Temp\2787716652.exe
  C:\Users\Admin\AppData\Local\Temp\2787716652.exe
  2⤵
  - Executes dropped EXE
  PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2376 -ip 2376
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1865125236.exe

Path C:\Users\Admin\AppData\Local\Temp\1865125236.exe
Size 10KB
SHA256 fe6048533f29dbaa106b30419c28533d6de00842fae8d5463124e886dd1c099a
MD5 f64598d062770041892271264f286260
SHA1 74b69f1c13e7a7234a4b0f205447efcad4955fda
SHA512 2aebd5b14ac49f57839abeba7543906265b31e22bde53f18a9f8ad7ca9955fd7d98ed503baece70c98b35e8db127b8b93a2d853dc9c5f5343e06c8ec03fd0a10
SSDEEP 192:vYcrbaXc6qPGtijnJx3DtpmweeeeeeeeWeeeee9MMbVx:wcXaX46ijnzmweeeeeeeeWeeeee9MMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

2787716652.exe

Path C:\Users\Admin\AppData\Local\Temp\2787716652.exe
Size 79KB
SHA256 c07243389989e597d65e2f2fd11d43c07719c520da9723e2f66f0814dfc1f0ea
MD5 a2663ac921094bdbb253100b5635db7f
SHA1 cd065025d6889e5afb16ebc70dd649dba44879eb
SHA512 129708571e7e7aaef25c9646058ed556d851480f18849bf24ab18c8de055fe91d4fc252853c2a7aab09a35d6bfd7e013087e0999c0fa8e59908498d0d6b5e03c
SSDEEP 1536:rQaPX8E9Fmavs2ThOBYHpCVfF7kIchZU8mcwpjNV6IqTlEpF:rQ48BOLhO/DMZJxwpjmTlEpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads