Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
21/02/2024, 04:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
General
- Target e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe
- Size 9KB
- Sample240221-er2s3sbc6s
- SHA256 e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
- MD5 62b97cf4c0abafeda36e3fc101a5a022
- SHA1 328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
- SHA512 32bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24
- SSDEEP 96:zM2BLwN8GXhc1I+a8gnYFdj9DSYp+BYA8v7cVO15uJxGE9YUBz2qh3C7tCE4ecp:AIwNfC1TUYv9p+OF8JxTmUBzthcqp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
Wallets
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
- Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x0006000000023161-24.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 324343804.exe - Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
pid Process 3180 1790926441.exe 4776 949011826.exe 1016 324343804.exe 2592 460318859.exe 1936 328169306.exe 3068 3297733419.exe 4124 93313461.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1790926441.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 949011826.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 324343804.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 324343804.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winpsdrvnas.exe" 949011826.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe" 324343804.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe" 324343804.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\winxsdrvcsa.exe" 1790926441.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winxsdrvcsa.exe" 1790926441.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winpsdrvnas.exe" 949011826.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\winxsdrvcsa.exe 1790926441.exe File created C:\Windows\winpsdrvnas.exe 949011826.exe File opened for modification C:\Windows\winpsdrvnas.exe 949011826.exe File created C:\Windows\winknavrso.exe 324343804.exe File opened for modification C:\Windows\winknavrso.exe 324343804.exe File created C:\Windows\winxsdrvcsa.exe 1790926441.exe - Program crash 1 IoCs
pid pid_target Process procid_target 380 3068 WerFault.exe 97 - Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 4776 949011826.exe 1016 324343804.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4280 wrote to memory of 3180 4280 e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe 84 PID 4280 wrote to memory of 3180 4280 e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe 84 PID 4280 wrote to memory of 3180 4280 e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe 84 PID 3180 wrote to memory of 4776 3180 1790926441.exe 92 PID 3180 wrote to memory of 4776 3180 1790926441.exe 92 PID 3180 wrote to memory of 4776 3180 1790926441.exe 92 PID 3180 wrote to memory of 1016 3180 1790926441.exe 94 PID 3180 wrote to memory of 1016 3180 1790926441.exe 94 PID 3180 wrote to memory of 1016 3180 1790926441.exe 94 PID 4776 wrote to memory of 2592 4776 949011826.exe 95 PID 4776 wrote to memory of 2592 4776 949011826.exe 95 PID 4776 wrote to memory of 2592 4776 949011826.exe 95 PID 4776 wrote to memory of 1936 4776 949011826.exe 96 PID 4776 wrote to memory of 1936 4776 949011826.exe 96 PID 4776 wrote to memory of 1936 4776 949011826.exe 96 PID 3180 wrote to memory of 3068 3180 1790926441.exe 97 PID 3180 wrote to memory of 3068 3180 1790926441.exe 97 PID 3180 wrote to memory of 3068 3180 1790926441.exe 97 PID 4776 wrote to memory of 4124 4776 949011826.exe 101 PID 4776 wrote to memory of 4124 4776 949011826.exe 101 PID 4776 wrote to memory of 4124 4776 949011826.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe"C:\Users\Admin\AppData\Local\Temp\e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\1790926441.exeC:\Users\Admin\AppData\Local\Temp\1790926441.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\949011826.exeC:\Users\Admin\AppData\Local\Temp\949011826.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\460318859.exeC:\Users\Admin\AppData\Local\Temp\460318859.exe4⤵
- Executes dropped EXE
PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\328169306.exeC:\Users\Admin\AppData\Local\Temp\328169306.exe4⤵
- Executes dropped EXE
PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\93313461.exeC:\Users\Admin\AppData\Local\Temp\93313461.exe4⤵
- Executes dropped EXE
PID:4124
-
-
-
C:\Users\Admin\AppData\Local\Temp\324343804.exeC:\Users\Admin\AppData\Local\Temp\324343804.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\3297733419.exeC:\Users\Admin\AppData\Local\Temp\3297733419.exe3⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 3244⤵
- Program crash
PID:380
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3068 -ip 30681⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\1[1]
- Size 86KB
- SHA256 86b717189b01aa5db7f367a6bb926f55379db91c757d50f3eab278750f405c1f
- MD5 fb7320dd95b6d47b722520ac0ffe1fda
- SHA1 4e4411fb5188b32b9310cd021fb262fbabe271a3
- SHA512 0487772a84d60c4aa739d7addc43687f189bf144a0ec4ffcbf4822b60711d253df89802fb546b04fd5acf84e55acde6e0b08deb83281a835ab0d5e2905710376
- SSDEEP 1536:gf8NjGLI9Q+PM5pQZKIvhcYFKNij+cA7rRJO9wQ/MVlB78C9NrNOScviewBY1:FVmpa7cNiicAfvK40KNpOScD1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\3[1]
- Size 86KB
- SHA256 2906e7f0b36cced4343b5aaa17fc04e85ca0d4258b90bf3c2b31f4914a1b068e
- MD5 504be39e4bf87420a31b86c2d9b97952
- SHA1 7ae264d82db82ef6c190e03966f92bc6c7e19b80
- SHA512 87aea980bcd5c9453e630cf6822bb9e0781226304a2ad7fa6827ea2a64f46c22ff99252cb5af772cf6fefc37e09c0f29ea3b99c074eca80081bd6e04f633046d
- SSDEEP 1536:7X8NjGLI9Q+PM5pQZKIvhcYFKNij+cA7rRJO9wQ/MVlB78C9NrNOScviewBY1:7sVmpa7cNiicAfvK40KNpOScD1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\2[1]
- Size 23KB
- SHA256 4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b
- MD5 07d8d1886e9515653645a06317888a14
- SHA1 50efdfb1b292bb28b9177e19e898d8b4ec59ec09
- SHA512 09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894
- SSDEEP 384:bwHpS3LDv1xjNaM69O/i01RnL+WoLrLdSIR7KDNxfQpkrlpzdZ5zj4y0AgH3CxwU:8Hp0Lb1xj1iQi01RL+WoLrLIIRUrjlpZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\5[1]
- Size 18KB
- SHA256 0367572142c5d7aa36047009d9f45e0d30436ecbcfe8910167cf8f39c678d3d9
- MD5 b30bdd3e25437d7ab8ab8435d3e7805c
- SHA1 b0b890566c00d1975e266dfceb2c93671631f77e
- SHA512 976a28d50b442589a9aeb9c9eac37081520c62c95e4c097442a2c9b6f33c03c596b713c9f3b85a09c7eb7033448d90bd03357d43f64d6465e474ee111f685806
- SSDEEP 384:KAtWjHHaL8zTe4n+xXp4C4OL3ecj+aS2X4YAX1pxN9kVRqFHH:rtWjHxxAXp4CDL3e6VX4YAPxEeHH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1790926441.exe
- Size 79KB
- SHA256 94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161
- MD5 bb3d7bd66c92454429a8c78bf64f977b
- SHA1 85563e7850d20f984a6264f68602fcc8a2b1a73f
- SHA512 cacd552b6cb5a1b1ee3569428681d154c25f6fa4b7141e33a64153b30711c345b6335161aa4a87688c047610cca141091b57cf8fe883769495a3b6caf3f03ea0
- SSDEEP 1536:AQaPX8E9Fmavs2ThOBYHpCVfF7kIchZU8mcwpjNV6IqTlEpF:AQ48BOLhO/DMZJxwpjmTlEpF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\324343804.exe
- Size 23KB
- SHA256 84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450
- MD5 9d2b22562b9a3958dfd7e6e6fa7bd66f
- SHA1 1941c24958ac09cf518f4124225b2d0b5d874cf0
- SHA512 8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1
- SSDEEP 384:psxGwxN5Af+2v877Oo0MOQ+XceXUoRgWScdQhue4/5zF:pSGxCeo4MeXUoiR4e4/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3297733419.exe
- Size 18KB
- SHA256 fd4c89d7b2d30000e6893e880c948d7f11fa2f8c5053997f746722ec9fff0eec
- MD5 01510572ccaca200b474d553ece2daf6
- SHA1 09a1c497080b50216810dadd7de1dac26b4c209f
- SHA512 8a52959e93b71388ef7bd3d97df461a22bb54de721b2960b52c48c6001bf93cd5bbb7c95ff7d5c0c6fd31e80acdcf35a99cf336bcc3e1ca455a150f8d5c3c35c
- SSDEEP 384:Q6fwvrcjWITuweeeeeeeeWeeeee9MMpPweeeeeeeeWeeeee9MMpPweeeeeeeeWe0:QSwvYDeeeeeeeeWeeeeeCeeeeeeeeWex
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\949011826.exe
- Size 86KB
- SHA256 a8454ee4d51de8582746091a406dd659324d2f7330552431c130f72baedc1266
- MD5 d6dd136183e107163263416aac6786c6
- SHA1 a6b2ec93462b8ecb0bad5688122de2b33a7c0e1c
- SHA512 c42952b6bd8614d07cf755139699eae1df81d5ded4a7b86728c0962d73c225b6b8c12674f649bfc2cb118665c028f4f4888f43d39027380ea2146275ec724a9a
- SSDEEP 1536:yQaPX8E9Fmavs2ThOWw9kYXVUeGbowliN06I68lUpF3bG:yQ48BOLhOlNFzQowlij8lUpFrG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\tbnds.dat
- Size 4KB
- SHA256 9b74b6d6fabd91b20418b990c0de20f91eda306e17fac4e78a18989eea453d81
- MD5 69c1bee7d9ecb7e8acda0ba93a555582
- SHA1 1e73c35c6007f8385fe5e150f2bfb2f662925cc6
- SHA512 28b73a22d79719cce565b746f2db8bda75463e8aacf57c7a8474d157a9b7f851a25dc767d0b15b4de3b5580ff6571552dfb606a4ed3f35600f3fb4e7a07bb9fd
- MD5 SHA1 SHA512