phorphiex | b97040f0f3a2a5158354af553886e7d7737a5640cb32506b50e7bbb3a767e61d

Analysis

max time kernel
10s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-02-06_78055f917e856e46432b396766060a16_mafia.exe
Size 3.3MB
Sample240206-ly5xmsdfg8
SHA256 b97040f0f3a2a5158354af553886e7d7737a5640cb32506b50e7bbb3a767e61d
MD5 78055f917e856e46432b396766060a16
SHA1 00965834e04d2c9181d88ea58bb2b9728bb81615
SHA512 615cc4df34559c494e835bacfca51ecfeeb59aae6d6cbafd61ed5e4bb73413fb3c9ef52c79d8755594d6cbe6685061a6c70dab772d75fd901cdb6f94b2b40dd9
SSDEEP 98304:XL/KCxy7YosGAQEWGayy+tBH4U9072usSA1CRQHcgD5O:b/f+YPaQtb5usSA1CMO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000002324f-36.dat	family_phorphiex
behavioral2/files/0x000700000002324f-35.dat	family_phorphiex
behavioral2/files/0x0006000000023256-40.dat	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	232062021.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3604	4EDB.exe
4824	232062021.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	232062021.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	232062021.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winxsdrvcsa.exe"	232062021.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winxsdrvcsa.exe"	232062021.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winxsdrvcsa.exe	232062021.exe
File opened for modification	C:\Windows\winxsdrvcsa.exe	232062021.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1208	4968	WerFault.exe	93

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	2024-02-06_78055f917e856e46432b396766060a16_mafia.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3604	2992	2024-02-06_78055f917e856e46432b396766060a16_mafia.exe	26
PID 2992 wrote to memory of 3604	2992	2024-02-06_78055f917e856e46432b396766060a16_mafia.exe	26
PID 2992 wrote to memory of 3604	2992	2024-02-06_78055f917e856e46432b396766060a16_mafia.exe	26
PID 3604 wrote to memory of 4824	3604	4EDB.exe	87
PID 3604 wrote to memory of 4824	3604	4EDB.exe	87
PID 3604 wrote to memory of 4824	3604	4EDB.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-02-06_78055f917e856e46432b396766060a16_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-06_78055f917e856e46432b396766060a16_mafia.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\4EDB.exe
  "C:\Users\Admin\AppData\Local\Temp\4EDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Users\Admin\AppData\Local\Temp\232062021.exe
    C:\Users\Admin\AppData\Local\Temp\232062021.exe
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\2135210020.exe
      C:\Users\Admin\AppData\Local\Temp\2135210020.exe
      4⤵
      PID:4968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 324
        5⤵
        Program crash
        
        PID:1208
  - - C:\Users\Admin\AppData\Local\Temp\195361234.exe
      C:\Users\Admin\AppData\Local\Temp\195361234.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\1797226850.exe
      C:\Users\Admin\AppData\Local\Temp\1797226850.exe
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\1366818929.exe
      C:\Users\Admin\AppData\Local\Temp\1366818929.exe
      4⤵
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
        5⤵
        
        PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\1185310144.exe
      C:\Users\Admin\AppData\Local\Temp\1185310144.exe
      4⤵
      PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4968 -ip 4968
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1185310144.exe

Path C:\Users\Admin\AppData\Local\Temp\1185310144.exe
Size 23KB
SHA256 74c61ef5513821652bee8464f65519c0f58af109b73966affbbf402e5f517ea6
MD5 35af53bd834971bb685db39d85b6b44d
SHA1 2c385d522d198a22f37ea7de05f903682567e9dd
SHA512 3d4bcdea022825873938b67503b039046f20585c7413e357a9b98a2b0b17fbd8a724740cd235acec21e588255d126cd83a6f5a3c4e5cb4e1d5481f57251485f1
SSDEEP 384:OvS+A7v2NC7MCUnGfEs1xgOtbaN+Wk55bNkU4A4GE9+0DGuwwNGp6JJcdRYp1ycD:uSrvy7jGMsrFbaNC5eUZKGnwNGYcdWBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1366818929.exe

Path C:\Users\Admin\AppData\Local\Temp\1366818929.exe
Size 10KB
SHA256 0d1006e878c6721404b48883edde17e9bebcec9a563fa35fe54cbc278503a3cd
MD5 c1e6ead2a9c0accaa34fb677fc69404f
SHA1 6b42f2af2f9f7ff2ceece364c646c5f0ac453f9c
SHA512 7caa6ae78c8a58168ed5e3affcc2b293fa8c2e036f86bd064dec35f53efd190d32184f32753908b172f0cddcabb5228a8704273e0538f971da461c5e350e836a
SSDEEP 96:vdHg3sEHyz3lNY9m1ddRYDb9FWPXiw4xCUvZYkJxGE9nP2qhtC7tCE9buxuv2d:vdHcsEHEVakWFWaw5GVJxT9Pthe88O
MD5 SHA1 SHA512 SSDEEP

Submit Download

1797226850.exe

Path C:\Users\Admin\AppData\Local\Temp\1797226850.exe
Size 7KB
SHA256 2f051b2d30a6b29d9c1291a0ba7c2c6884e76935f2e232a1e4ff5f32f936f6d8
MD5 366c1443c75497dda239cb3f9e100806
SHA1 2b13c1a71c404033801562a8f1a153666c9a78b6
SHA512 dd8b6f33b1814e7b71d940f5dc6a12c1a49ae649a4b55761dc1b7c6f132ad61573fc87ed9712617fe572d654d6268dbc9ddf2629942633784053e09d35c4abb5
SSDEEP 96:UPMQboxV8naU1chfSWxBbt3ToV17Ua7pEULg5rMMyHCwMpmAmqL0PJ4ZYlOw8KJ:UEQsxV8F6VBx3cVCugRtfmqAPQYlv8KJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1797226850.exe

Path C:\Users\Admin\AppData\Local\Temp\1797226850.exe
Size 23KB
SHA256 deb0e9fe1aa66fc42d58bf8561a417d6018f4a1b28b9d2a891a353b6f3d670d0
MD5 0240f93b9137fcad9a0570a5bd06fc05
SHA1 a5402c0f2784e2df894804d167809ea7735ccae8
SHA512 300e3f2e3b5d08f0b627fa5cde39e72cc72862976eec1c8a49e6bbe4412642d4ba04d9458965a151cd2c804da1548b07672d2aa0ffb15507d395a273d33014e9
SSDEEP 384:URsx6w335avY2v8FxkVSo0QOQ+XcTfXUoRgWScdQhue4v:URS6rE3booMrXUoiR4e4
MD5 SHA1 SHA512 SSDEEP

Submit Download

195361234.exe

Path C:\Users\Admin\AppData\Local\Temp\195361234.exe
Size 28KB
SHA256 389157dbd749ca02fef366e2cf7b41b0496aca524c5133f61ef03f4aa290ac00
MD5 98b14b217891281c7aa4d1c922951696
SHA1 3c9703635f4516d208a92305db550ec1e4819f1f
SHA512 8981e501a7de8856b0fcfcda75aa703348d0a500d0d900904a00a22537bc9d5f379159c666a34de45f2ed0ad03dbf70f017c9c8b17349f3c454a52fe10db7a2c
SSDEEP 768:2Vw+1aPX8EhHFmZdJOPvs2fVn9OG2yhOBYHpCVf40Z7kZarchwfe9A:rQaPX8E9Fmavs2ThOBYHpCVfF7kIchZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

195361234.exe

Path C:\Users\Admin\AppData\Local\Temp\195361234.exe
Size 29KB
SHA256 20955fca9777d13d715aeb4473d0a1bf429064c9b035ae37794a6ddc493f2f30
MD5 cb7e08c35a253b6ef6fbffb007d3341b
SHA1 c31b7cbdd4f25e8a4d8f982f3a5e03cb722dfed2
SHA512 e44d00a531356145905c462509965ce22b70a3f15bab1dad6443c3d45a4bb5dcf759fc1e6167ffd168742c9a488e80f488ac870506548b0298ee23303f9acc99
SSDEEP 768:2Vw+1aPX8EhHFmZdJOPvs2fVn9OG2yhOBYHpCVf40Z7kZarchwfe9W7d:rQaPX8E9Fmavs2ThOBYHpCVfF7kIchZg
MD5 SHA1 SHA512 SSDEEP

Submit Download

2135210020.exe

Path C:\Users\Admin\AppData\Local\Temp\2135210020.exe
Size 10KB
SHA256 fe6048533f29dbaa106b30419c28533d6de00842fae8d5463124e886dd1c099a
MD5 f64598d062770041892271264f286260
SHA1 74b69f1c13e7a7234a4b0f205447efcad4955fda
SHA512 2aebd5b14ac49f57839abeba7543906265b31e22bde53f18a9f8ad7ca9955fd7d98ed503baece70c98b35e8db127b8b93a2d853dc9c5f5343e06c8ec03fd0a10
SSDEEP 192:vYcrbaXc6qPGtijnJx3DtpmweeeeeeeeWeeeee9MMbVx:wcXaX46ijnzmweeeeeeeeWeeeee9MMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

232062021.exe

Path C:\Users\Admin\AppData\Local\Temp\232062021.exe
Size 79KB
SHA256 94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161
MD5 bb3d7bd66c92454429a8c78bf64f977b
SHA1 85563e7850d20f984a6264f68602fcc8a2b1a73f
SHA512 cacd552b6cb5a1b1ee3569428681d154c25f6fa4b7141e33a64153b30711c345b6335161aa4a87688c047610cca141091b57cf8fe883769495a3b6caf3f03ea0
SSDEEP 1536:AQaPX8E9Fmavs2ThOBYHpCVfF7kIchZU8mcwpjNV6IqTlEpF:AQ48BOLhO/DMZJxwpjmTlEpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

4EDB.exe

Path C:\Users\Admin\AppData\Local\Temp\4EDB.exe
Size 9KB
SHA256 e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
MD5 62b97cf4c0abafeda36e3fc101a5a022
SHA1 328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
SHA512 32bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24
SSDEEP 96:zM2BLwN8GXhc1I+a8gnYFdj9DSYp+BYA8v7cVO15uJxGE9YUBz2qh3C7tCE4ecp:AIwNfC1TUYv9p+OF8JxTmUBzthcqp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Security Upgrade Service.exe

Path C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
Size 20KB
SHA256 1a97deb1661bd0c9e50415a15bee1e40f8a2e9346b5d03ff59cb5b21c357d2c3
MD5 c4fd721a5842c796d0a0527a6b256f75
SHA1 eccf3b47f30e472c4fc8f60fe5a8cc1d12a3e2a6
SHA512 0d499bf15a30ff0e701930ef54a80bb928f43f7d21109072607f7351968bee9a09bbdeba008187ac47b705c1582ebdd324934815fc1c53b21a90a78f5682653f
SSDEEP 384:90piP0DWvqASUAzYAtlYxJ4JVB00EgMSKRj:lP0ivCUIDYOvEg
MD5 SHA1 SHA512 SSDEEP

Submit Download

winkqdvsdo.exe

Path C:\Users\Admin\winkqdvsdo.exe
Size 13KB
SHA256 e36e8f14ae794d916a4d155ca47f91a0afef873a895ab9a110e8c715bc07c7a4
MD5 8f0cda12814033e78305bfd1369b25fb
SHA1 dbbdfed1158e47608265125d92f6b5bfc0923bca
SHA512 70810e86888a0c1969a9ee0e5530bdfb67fc8a4765b973e56dadf2703b9284a6cd1b82e29ade980620a924d74e4063caccc394a65cd6dc846c0d4f525fae758d
SSDEEP 192:UEQsxV8F6VBx3cVCugRtfmqAPQYlv8KqaYrd7aiiSpe0W3b9UQ+R:URsx6w335avY2v8FxkVSo0QOQ+R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads