Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
16/02/2024, 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a003466a5853264b01f92a6f1b0e906d.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
- Target a003466a5853264b01f92a6f1b0e906d.exe
- Size 334KB
- Sample240216-la335sfc7z
- SHA256 0cb5c42907f6ef9990a4ae9b1cb9d2e0d3517316bd371ee860988f3a753c1b4f
- MD5 a003466a5853264b01f92a6f1b0e906d
- SHA1 e78c54540b51964a6d9db0442991684b84441a4b
- SHA512 effc0229d7e7619e596be04e27476d543b16beeb6feabc5b6c5e01174815aebd87b8d3e97ec8323a658a29e40870d2510799fbf0a6d96cb804842dd60f54c43c
- SSDEEP 6144:iHSrOEkZVVqUHFmPQfyjHyPXvEHuixkDPxKlF:iHSqEsVMCyiXMuEk7xg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
Wallets
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
- Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x0006000000023222-32.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1585527112.exe - Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
pid Process 3056 490F.exe 944 sylsplvc.exe 4504 91802470.exe 1892 1585527112.exe 4728 317719193.exe 5064 2983032359.exe 4704 3125915572.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 91802470.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1585527112.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe" 490F.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winpsdrvnas.exe" 91802470.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winpsdrvnas.exe" 91802470.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe" 1585527112.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe" 1585527112.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\sylsplvc.exe 490F.exe File opened for modification C:\Windows\sylsplvc.exe 490F.exe File created C:\Windows\winpsdrvnas.exe 91802470.exe File opened for modification C:\Windows\winpsdrvnas.exe 91802470.exe File created C:\Windows\winknavrso.exe 1585527112.exe File opened for modification C:\Windows\winknavrso.exe 1585527112.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3456 4704 WerFault.exe 100 - Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 4504 91802470.exe 1892 1585527112.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3992 wrote to memory of 3056 3992 a003466a5853264b01f92a6f1b0e906d.exe 86 PID 3992 wrote to memory of 3056 3992 a003466a5853264b01f92a6f1b0e906d.exe 86 PID 3992 wrote to memory of 3056 3992 a003466a5853264b01f92a6f1b0e906d.exe 86 PID 3056 wrote to memory of 944 3056 490F.exe 87 PID 3056 wrote to memory of 944 3056 490F.exe 87 PID 3056 wrote to memory of 944 3056 490F.exe 87 PID 944 wrote to memory of 4504 944 sylsplvc.exe 95 PID 944 wrote to memory of 4504 944 sylsplvc.exe 95 PID 944 wrote to memory of 4504 944 sylsplvc.exe 95 PID 944 wrote to memory of 1892 944 sylsplvc.exe 96 PID 944 wrote to memory of 1892 944 sylsplvc.exe 96 PID 944 wrote to memory of 1892 944 sylsplvc.exe 96 PID 4504 wrote to memory of 4728 4504 91802470.exe 97 PID 4504 wrote to memory of 4728 4504 91802470.exe 97 PID 4504 wrote to memory of 4728 4504 91802470.exe 97 PID 4504 wrote to memory of 5064 4504 91802470.exe 99 PID 4504 wrote to memory of 5064 4504 91802470.exe 99 PID 4504 wrote to memory of 5064 4504 91802470.exe 99 PID 4504 wrote to memory of 4704 4504 91802470.exe 100 PID 4504 wrote to memory of 4704 4504 91802470.exe 100 PID 4504 wrote to memory of 4704 4504 91802470.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\a003466a5853264b01f92a6f1b0e906d.exe"C:\Users\Admin\AppData\Local\Temp\a003466a5853264b01f92a6f1b0e906d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\490F.exe"C:\Users\Admin\AppData\Local\Temp\490F.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\sylsplvc.exeC:\Windows\sylsplvc.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\91802470.exeC:\Users\Admin\AppData\Local\Temp\91802470.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\317719193.exeC:\Users\Admin\AppData\Local\Temp\317719193.exe5⤵
- Executes dropped EXE
PID:4728
-
-
C:\Users\Admin\AppData\Local\Temp\2983032359.exeC:\Users\Admin\AppData\Local\Temp\2983032359.exe5⤵
- Executes dropped EXE
PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\3125915572.exeC:\Users\Admin\AppData\Local\Temp\3125915572.exe5⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 3246⤵
- Program crash
PID:3456
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1585527112.exeC:\Users\Admin\AppData\Local\Temp\1585527112.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:1892
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4704 -ip 47041⤵PID:2244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\1[1]
- Size 86KB
- SHA256 86b717189b01aa5db7f367a6bb926f55379db91c757d50f3eab278750f405c1f
- MD5 fb7320dd95b6d47b722520ac0ffe1fda
- SHA1 4e4411fb5188b32b9310cd021fb262fbabe271a3
- SHA512 0487772a84d60c4aa739d7addc43687f189bf144a0ec4ffcbf4822b60711d253df89802fb546b04fd5acf84e55acde6e0b08deb83281a835ab0d5e2905710376
- SSDEEP 1536:gf8NjGLI9Q+PM5pQZKIvhcYFKNij+cA7rRJO9wQ/MVlB78C9NrNOScviewBY1:FVmpa7cNiicAfvK40KNpOScD1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\3[1]
- Size 86KB
- SHA256 2906e7f0b36cced4343b5aaa17fc04e85ca0d4258b90bf3c2b31f4914a1b068e
- MD5 504be39e4bf87420a31b86c2d9b97952
- SHA1 7ae264d82db82ef6c190e03966f92bc6c7e19b80
- SHA512 87aea980bcd5c9453e630cf6822bb9e0781226304a2ad7fa6827ea2a64f46c22ff99252cb5af772cf6fefc37e09c0f29ea3b99c074eca80081bd6e04f633046d
- SSDEEP 1536:7X8NjGLI9Q+PM5pQZKIvhcYFKNij+cA7rRJO9wQ/MVlB78C9NrNOScviewBY1:7sVmpa7cNiicAfvK40KNpOScD1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\2[1]
- Size 23KB
- SHA256 4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b
- MD5 07d8d1886e9515653645a06317888a14
- SHA1 50efdfb1b292bb28b9177e19e898d8b4ec59ec09
- SHA512 09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894
- SSDEEP 384:bwHpS3LDv1xjNaM69O/i01RnL+WoLrLdSIR7KDNxfQpkrlpzdZ5zj4y0AgH3CxwU:8Hp0Lb1xj1iQi01RL+WoLrLIIRUrjlpZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\5[1]
- Size 18KB
- SHA256 0367572142c5d7aa36047009d9f45e0d30436ecbcfe8910167cf8f39c678d3d9
- MD5 b30bdd3e25437d7ab8ab8435d3e7805c
- SHA1 b0b890566c00d1975e266dfceb2c93671631f77e
- SHA512 976a28d50b442589a9aeb9c9eac37081520c62c95e4c097442a2c9b6f33c03c596b713c9f3b85a09c7eb7033448d90bd03357d43f64d6465e474ee111f685806
- SSDEEP 384:KAtWjHHaL8zTe4n+xXp4C4OL3ecj+aS2X4YAX1pxN9kVRqFHH:rtWjHxxAXp4CDL3e6VX4YAPxEeHH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1585527112.exe
- Size 23KB
- SHA256 84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450
- MD5 9d2b22562b9a3958dfd7e6e6fa7bd66f
- SHA1 1941c24958ac09cf518f4124225b2d0b5d874cf0
- SHA512 8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1
- SSDEEP 384:psxGwxN5Af+2v877Oo0MOQ+XceXUoRgWScdQhue4/5zF:pSGxCeo4MeXUoiR4e4/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3125915572.exe
- Size 18KB
- SHA256 fd4c89d7b2d30000e6893e880c948d7f11fa2f8c5053997f746722ec9fff0eec
- MD5 01510572ccaca200b474d553ece2daf6
- SHA1 09a1c497080b50216810dadd7de1dac26b4c209f
- SHA512 8a52959e93b71388ef7bd3d97df461a22bb54de721b2960b52c48c6001bf93cd5bbb7c95ff7d5c0c6fd31e80acdcf35a99cf336bcc3e1ca455a150f8d5c3c35c
- SSDEEP 384:Q6fwvrcjWITuweeeeeeeeWeeeee9MMpPweeeeeeeeWeeeee9MMpPweeeeeeeeWe0:QSwvYDeeeeeeeeWeeeeeCeeeeeeeeWex
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\490F.exe
- Size 79KB
- SHA256 3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879
- MD5 1e8a2ed2e3f35620fb6b8c2a782a57f3
- SHA1 e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a
- SHA512 ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade
- SSDEEP 1536:y3Mz8f2Z9F1nc2ZWEa5pFeStStfFPeeeeeeeeWeeeee:ZwfYFRVZWz3XtStfF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\91802470.exe
- Size 86KB
- SHA256 a8454ee4d51de8582746091a406dd659324d2f7330552431c130f72baedc1266
- MD5 d6dd136183e107163263416aac6786c6
- SHA1 a6b2ec93462b8ecb0bad5688122de2b33a7c0e1c
- SHA512 c42952b6bd8614d07cf755139699eae1df81d5ded4a7b86728c0962d73c225b6b8c12674f649bfc2cb118665c028f4f4888f43d39027380ea2146275ec724a9a
- SSDEEP 1536:yQaPX8E9Fmavs2ThOWw9kYXVUeGbowliN06I68lUpF3bG:yQ48BOLhOlNFzQowlij8lUpFrG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\tbnds.dat
- Size 3KB
- SHA256 96ac186bd3b186abacfb6af72e945de2c8794466ecf6c31020a56a0ed12c2494
- MD5 acf0810365b9a19559fb85b1f84486c1
- SHA1 5d84dcff9397192b8a617acf7188998b4e82c01a
- SHA512 ada959065720d5819cc2b9b33a44f780eee8dcf755e699bc37a37cefbbfe0a7f83e689c38a3d9ef40eefae21cdf6dae368792880869dc29f628efc4cfbc684ed
- MD5 SHA1 SHA512