Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
05/03/2024, 21:53
Behavioral task
behavioral1
Sample
b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
General
- Target b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe
- Size 80KB
- Sample240305-1rrtrsbe43
- SHA256 b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462
- MD5 8d9e7695b942e570f84564345d736762
- SHA1 e16022d7b4a5051c4bff6f8f23cf29ab0811c845
- SHA512 4031d726322cbb14ae84e60591d9c493495cf54e0028c86b3e1789b9885fce1fa577a47a5a1b5ca311b78e8b405f0d0149e44317d5e414d3e3e91d21dcf5f25f
- SSDEEP 1536:P3Mz85SRJP1sW7jeWkfp52S2QyS9QafFFUheeeeeeeeWeeeee:kw5gPiOjeDxb2QyS9QafFF
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
Wallets
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
- Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023229-10.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 698220951.exe - Executes dropped EXE 8 IoCs
pid Process 3536 syspolrvcs.exe 1656 698220951.exe 224 2263910452.exe 3320 3020131756.exe 3488 2412131033.exe 4756 203589593.exe 4056 3197016522.exe 4424 300296920.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syspolrvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 698220951.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2263910452.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2263910452.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syspolrvcs.exe" b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe" 698220951.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe" 698220951.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysdinrdvs.exe" 2263910452.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysdinrdvs.exe" 2263910452.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\syspolrvcs.exe b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe File opened for modification C:\Windows\syspolrvcs.exe b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe File created C:\Windows\winknavrso.exe 698220951.exe File opened for modification C:\Windows\winknavrso.exe 698220951.exe File created C:\Windows\sysdinrdvs.exe 2263910452.exe File opened for modification C:\Windows\sysdinrdvs.exe 2263910452.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1456 3320 WerFault.exe 103 - Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 1656 698220951.exe 224 2263910452.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4640 wrote to memory of 3536 4640 b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe 91 PID 4640 wrote to memory of 3536 4640 b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe 91 PID 4640 wrote to memory of 3536 4640 b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe 91 PID 3536 wrote to memory of 1656 3536 syspolrvcs.exe 99 PID 3536 wrote to memory of 1656 3536 syspolrvcs.exe 99 PID 3536 wrote to memory of 1656 3536 syspolrvcs.exe 99 PID 1656 wrote to memory of 224 1656 698220951.exe 101 PID 1656 wrote to memory of 224 1656 698220951.exe 101 PID 1656 wrote to memory of 224 1656 698220951.exe 101 PID 3536 wrote to memory of 3320 3536 syspolrvcs.exe 103 PID 3536 wrote to memory of 3320 3536 syspolrvcs.exe 103 PID 3536 wrote to memory of 3320 3536 syspolrvcs.exe 103 PID 3536 wrote to memory of 3488 3536 syspolrvcs.exe 108 PID 3536 wrote to memory of 3488 3536 syspolrvcs.exe 108 PID 3536 wrote to memory of 3488 3536 syspolrvcs.exe 108 PID 224 wrote to memory of 4756 224 2263910452.exe 109 PID 224 wrote to memory of 4756 224 2263910452.exe 109 PID 224 wrote to memory of 4756 224 2263910452.exe 109 PID 224 wrote to memory of 4056 224 2263910452.exe 110 PID 224 wrote to memory of 4056 224 2263910452.exe 110 PID 224 wrote to memory of 4056 224 2263910452.exe 110 PID 224 wrote to memory of 4424 224 2263910452.exe 111 PID 224 wrote to memory of 4424 224 2263910452.exe 111 PID 224 wrote to memory of 4424 224 2263910452.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe"C:\Users\Admin\AppData\Local\Temp\b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\syspolrvcs.exeC:\Windows\syspolrvcs.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\698220951.exeC:\Users\Admin\AppData\Local\Temp\698220951.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2263910452.exeC:\Users\Admin\AppData\Local\Temp\2263910452.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\203589593.exeC:\Users\Admin\AppData\Local\Temp\203589593.exe5⤵
- Executes dropped EXE
PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\3197016522.exeC:\Users\Admin\AppData\Local\Temp\3197016522.exe5⤵
- Executes dropped EXE
PID:4056
-
-
C:\Users\Admin\AppData\Local\Temp\300296920.exeC:\Users\Admin\AppData\Local\Temp\300296920.exe5⤵
- Executes dropped EXE
PID:4424
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3020131756.exeC:\Users\Admin\AppData\Local\Temp\3020131756.exe3⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 3244⤵
- Program crash
PID:1456
-
-
-
C:\Users\Admin\AppData\Local\Temp\2412131033.exeC:\Users\Admin\AppData\Local\Temp\2412131033.exe3⤵
- Executes dropped EXE
PID:3488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 33201⤵PID:1564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GAXHX86M\4[1]
- Size 17KB
- SHA256 1a50293341baa2c41d3001c09d23c2c54d24c8b4ad8697b25ec66dbf1d7803a4
- MD5 975a47206a677c055af488960f268d9f
- SHA1 4ce2d8bdaa8c55d4f6e592dffb6093d8a3f7ee33
- SHA512 1aa07bab14b78df9721e892df2d8c4f895666621c5dcaa3b33bf955e37c6bc2eeb0b802898dd8b2c7eb9ca93a6fd02c845aabafae0d5bc9882bea510a3719c4b
- SSDEEP 384:3rxdlr0s2EyH0hGbcl6UTkiQwCIUg1YcTm2DNP5izzEj:3tdh035CSclZlCE71Q4j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RGI21ZAG\1[1]
- Size 23KB
- SHA256 4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b
- MD5 07d8d1886e9515653645a06317888a14
- SHA1 50efdfb1b292bb28b9177e19e898d8b4ec59ec09
- SHA512 09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894
- SSDEEP 384:bwHpS3LDv1xjNaM69O/i01RnL+WoLrLdSIR7KDNxfQpkrlpzdZ5zj4y0AgH3CxwU:8Hp0Lb1xj1iQi01RL+WoLrLIIRUrjlpZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RGI21ZAG\5[1]
- Size 84KB
- SHA256 c1b2b4d052f98028e6b32955ed052881591bbaa57f11279b7745cc26566f8268
- MD5 b464b1ac75172e05db725d17b9bb9044
- SHA1 cc8689ef9f70be7210520bd68b9767e3c6f1e363
- SHA512 9adab953f44c68cd0eb37873a51d18827a06bf4d99d4d354053e16bd4c3bb272b9c9290cc4190919f9d89bfe6d304546ddffc460f8ee2ed8e75a9bd3e13294e2
- SSDEEP 1536:xubuTOzoKTY/Vpn9ReZqW+QipRlqlQw/K8T3bUkAm3x+SzG/Dcsbq/wBsKCyl2B:xubuTOpTs/9ReZqnpRlIK8T3bUextq/u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2263910452.exe
- Size 84KB
- SHA256 41eac81105327a9bdb98bf783698eb53d385c07c2a7a7dc6c207f81302f807c3
- MD5 327f84628e45d23cf22fe1241e0e6919
- SHA1 5cadf08fe7f12320819a505ed0fea0995dc83c95
- SHA512 d4c7eeab2672e5bbf2479d14f61c8119df5979ceaaca06e035644c9a83de38b63973d4a7a7c5e9210d0f214354ec33194c94565624b43631210952a5c0a429d9
- SSDEEP 1536:hhLCZdBFmav82unyYNrbmpcKHZdX7Xl0CF:beZUOuPHKrXl0CF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2412131033.exe
- Size 84KB
- SHA256 93f3f99a6d6dc69b907a3da8596bd850c1e3ce53be9bf1c6edfdb00e90579e6f
- MD5 41d55c23d79fc0c0c322db16c6ce6af8
- SHA1 e4bbdf2a983a11975a7ab6dcba41cb60676ec780
- SHA512 06680eb47802659dc2e28cd9a839052a8536112056db49f7179f1b53cf2dba0e9cfd9d8bbdeb446ecb8a2f4a58f7b0f100d0526660d4afd8540a4db091cf621f
- SSDEEP 1536:fhLCZdBFmav82unyYNrbmpcKHZdX7Xl0CF:5eZUOuPHKrXl0CF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3020131756.exe
- Size 17KB
- SHA256 12795baa56912fee4647a20f0bdbac53637aa205704274a77a9f688f7aec70cf
- MD5 b97dfe854a69f7a20c3cc0910904d438
- SHA1 1d89880053920f138b3000008fdd1d7ef698d271
- SHA512 34481c2b1e3ea3cb15d8263019b3c9530f1f3a36de1aaa59c1a5889a290e51e6e845d5a1cf7d40f57b847b1005beaa9d6c2395e16f31e6ca9ffaefc75333caba
- SSDEEP 384:ZNSgAujjzuweeeeeeeeWeeeee9MMpPweeeeeeeeWeeeee9MMpPweeeeeeeeWeeeU:OgxbeeeeeeeeWeeeeeCeeeeeeeeWeeeX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\698220951.exe
- Size 23KB
- SHA256 84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450
- MD5 9d2b22562b9a3958dfd7e6e6fa7bd66f
- SHA1 1941c24958ac09cf518f4124225b2d0b5d874cf0
- SHA512 8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1
- SSDEEP 384:psxGwxN5Af+2v877Oo0MOQ+XceXUoRgWScdQhue4/5zF:pSGxCeo4MeXUoiR4e4/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\syspolrvcs.exe
- Size 80KB
- SHA256 b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462
- MD5 8d9e7695b942e570f84564345d736762
- SHA1 e16022d7b4a5051c4bff6f8f23cf29ab0811c845
- SHA512 4031d726322cbb14ae84e60591d9c493495cf54e0028c86b3e1789b9885fce1fa577a47a5a1b5ca311b78e8b405f0d0149e44317d5e414d3e3e91d21dcf5f25f
- SSDEEP 1536:P3Mz85SRJP1sW7jeWkfp52S2QyS9QafFFUheeeeeeeeWeeeee:kw5gPiOjeDxb2QyS9QafFF
- MD5 SHA1 SHA512 SSDEEP