phorphiex | 6ff7acc55f48fa1726291f1ab56c939c66c600c9e98d92255055a38ab2093331

General

Target

d16a1879e3be4eec83b18124ec5094ad.exe
Size

104KB
MD5

d16a1879e3be4eec83b18124ec5094ad
SHA1

a79d93bf2350f2ce5c87741c7da0049f200d96b2
SHA256

6ff7acc55f48fa1726291f1ab56c939c66c600c9e98d92255055a38ab2093331
SHA512

33a34adbafbdc603ac7d9530337b44a46bad68046c68066c9c6970a5021f3e5a2e0e034bfb23232b9ca1d9dcafb4a33cc96c2906e229f8b7d69ce345db1d1c0c
SSDEEP

3072:Xl58BV2ZjooGTb5PjMdhS3KV3/jjKwcNHjo86r8X7FS8EFcv:158BIFveZjMrS3q3/jjKwcNHjo86r8r3

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
C:\177891331423307\smss.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\3067027473.exe	family_phorphiex

Windows security bypass 2 TTPs 24 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sylsplvc.exe2078319043.exesmss.exe3067027473.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2078319043.exe

Executes dropped EXE 6 IoCs

Processes:

smss.exe2949131357.exesylsplvc.exe3067027473.exe2078319043.exe1874025818.exe

pid process

664 smss.exe
4552 2949131357.exe
3076 sylsplvc.exe
456 3067027473.exe
932 2078319043.exe
4656 1874025818.exe

pid	process
664	smss.exe
4552	2949131357.exe
3076	sylsplvc.exe
456	3067027473.exe
932	2078319043.exe
4656	1874025818.exe

Windows security modification 2 TTPs 28 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sylsplvc.exe2078319043.exe3067027473.exesmss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3067027473.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	2078319043.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	3067027473.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2949131357.exe3067027473.exe2078319043.exed16a1879e3be4eec83b18124ec5094ad.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe"	2949131357.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe"	3067027473.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe"	3067027473.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysdinrdvs.exe"	2078319043.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysdinrdvs.exe"	2078319043.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\177891331423307\\smss.exe"	d16a1879e3be4eec83b18124ec5094ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\177891331423307\\smss.exe"	d16a1879e3be4eec83b18124ec5094ad.exe

Drops file in Windows directory 6 IoCs

Processes:

2949131357.exe3067027473.exe2078319043.exe

description	ioc	process
File created	C:\Windows\sylsplvc.exe	2949131357.exe
File opened for modification	C:\Windows\sylsplvc.exe	2949131357.exe
File created	C:\Windows\winknavrso.exe	3067027473.exe
File opened for modification	C:\Windows\winknavrso.exe	3067027473.exe
File created	C:\Windows\sysdinrdvs.exe	2078319043.exe
File opened for modification	C:\Windows\sysdinrdvs.exe	2078319043.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

3067027473.exe2078319043.exe

pid process

456 3067027473.exe
932 2078319043.exe

pid	process
456	3067027473.exe
932	2078319043.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

d16a1879e3be4eec83b18124ec5094ad.exesmss.exe2949131357.exesylsplvc.exe2078319043.exe

description	pid	process	target process
PID 3272 wrote to memory of 664	3272	d16a1879e3be4eec83b18124ec5094ad.exe	smss.exe
PID 3272 wrote to memory of 664	3272	d16a1879e3be4eec83b18124ec5094ad.exe	smss.exe
PID 3272 wrote to memory of 664	3272	d16a1879e3be4eec83b18124ec5094ad.exe	smss.exe
PID 664 wrote to memory of 4552	664	smss.exe	2949131357.exe
PID 664 wrote to memory of 4552	664	smss.exe	2949131357.exe
PID 664 wrote to memory of 4552	664	smss.exe	2949131357.exe
PID 4552 wrote to memory of 3076	4552	2949131357.exe	sylsplvc.exe
PID 4552 wrote to memory of 3076	4552	2949131357.exe	sylsplvc.exe
PID 4552 wrote to memory of 3076	4552	2949131357.exe	sylsplvc.exe
PID 3076 wrote to memory of 456	3076	sylsplvc.exe	3067027473.exe
PID 3076 wrote to memory of 456	3076	sylsplvc.exe	3067027473.exe
PID 3076 wrote to memory of 456	3076	sylsplvc.exe	3067027473.exe
PID 3076 wrote to memory of 932	3076	sylsplvc.exe	2078319043.exe
PID 3076 wrote to memory of 932	3076	sylsplvc.exe	2078319043.exe
PID 3076 wrote to memory of 932	3076	sylsplvc.exe	2078319043.exe
PID 932 wrote to memory of 4656	932	2078319043.exe	1874025818.exe
PID 932 wrote to memory of 4656	932	2078319043.exe	1874025818.exe
PID 932 wrote to memory of 4656	932	2078319043.exe	1874025818.exe

C:\Users\Admin\AppData\Local\Temp\d16a1879e3be4eec83b18124ec5094ad.exe
"C:\Users\Admin\AppData\Local\Temp\d16a1879e3be4eec83b18124ec5094ad.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3272

C:\177891331423307\smss.exe
C:\177891331423307\smss.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:664

C:\Users\Admin\AppData\Local\Temp\2949131357.exe
C:\Users\Admin\AppData\Local\Temp\2949131357.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\sylsplvc.exe
C:\Windows\sylsplvc.exe
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3076

C:\Users\Admin\AppData\Local\Temp\3067027473.exe
C:\Users\Admin\AppData\Local\Temp\3067027473.exe
5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:456

C:\Users\Admin\AppData\Local\Temp\2078319043.exe
C:\Users\Admin\AppData\Local\Temp\2078319043.exe
5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Local\Temp\1874025818.exe
C:\Users\Admin\AppData\Local\Temp\1874025818.exe
6⤵
- Executes dropped EXE
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\177891331423307\smss.exe
Filesize
104KB

MD5
d16a1879e3be4eec83b18124ec5094ad

SHA1
a79d93bf2350f2ce5c87741c7da0049f200d96b2

SHA256
6ff7acc55f48fa1726291f1ab56c939c66c600c9e98d92255055a38ab2093331

SHA512
33a34adbafbdc603ac7d9530337b44a46bad68046c68066c9c6970a5021f3e5a2e0e034bfb23232b9ca1d9dcafb4a33cc96c2906e229f8b7d69ce345db1d1c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2ZG7H8ZF\1[1]
Filesize
23KB

MD5
07d8d1886e9515653645a06317888a14

SHA1
50efdfb1b292bb28b9177e19e898d8b4ec59ec09

SHA256
4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b

SHA512
09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894

Download Submit
C:\Users\Admin\AppData\Local\Temp\2078319043.exe
Filesize
84KB

MD5
41d55c23d79fc0c0c322db16c6ce6af8

SHA1
e4bbdf2a983a11975a7ab6dcba41cb60676ec780

SHA256
93f3f99a6d6dc69b907a3da8596bd850c1e3ce53be9bf1c6edfdb00e90579e6f

SHA512
06680eb47802659dc2e28cd9a839052a8536112056db49f7179f1b53cf2dba0e9cfd9d8bbdeb446ecb8a2f4a58f7b0f100d0526660d4afd8540a4db091cf621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2949131357.exe
Filesize
79KB

MD5
1e8a2ed2e3f35620fb6b8c2a782a57f3

SHA1
e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

SHA256
3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

SHA512
ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\3067027473.exe
Filesize
23KB

MD5
9d2b22562b9a3958dfd7e6e6fa7bd66f

SHA1
1941c24958ac09cf518f4124225b2d0b5d874cf0

SHA256
84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450

SHA512
8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads