Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system - submitted
27/03/2024, 12:38
Behavioral task
behavioral1
Sample
e1af1ba1edb943b838456f57bd564d01.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
- Target e1af1ba1edb943b838456f57bd564d01.exe
- Size 105KB
- Sample240327-pt4essfd4s
- SHA256 042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29
- MD5 e1af1ba1edb943b838456f57bd564d01
- SHA1 489760f1f57a35591020f1f82e54740d76fa97e7
- SHA512 982417c1f742e2624c1da543058ccb2b3e9b5f46cedcbba242d13717a2f6c56cd186ba186767542bf68e0e38d0894b3ac027874f33f5bd5a94c3dac542916155
- SSDEEP 3072:gEbJSw745FIlbt/d6WruEPJZDTS7MJCAc2BEUzWndAstTIgFpW:rbJSgkkcWruEhZDTS7MJCAc2BEUzWndw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
phorphiex
C2
-
http://185.215.113.66/
Wallets
-
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
-
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
-
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
-
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
-
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
-
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
-
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
-
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
-
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
-
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
-
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
-
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
-
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
-
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
-
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
-
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
- Phorphiex payload 2 IoCs
resource yara_rule behavioral2/files/0x0008000000023314-3.dat family_phorphiex behavioral2/files/0x000700000002343d-21.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2030322604.exe - Executes dropped EXE 7 IoCs
pid Process 1200 lsass.exe 2832 3982436535.exe 3324 sylsplvc.exe 1880 2030322604.exe 3092 1198524379.exe 1564 325483898.exe 1172 3060727064.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2030322604.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 1198524379.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1198524379.exe - Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe" 3982436535.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe" 2030322604.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe" 2030322604.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysdinrdvs.exe" 1198524379.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysdinrdvs.exe" 1198524379.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\30574125328530\\lsass.exe" e1af1ba1edb943b838456f57bd564d01.exe Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\30574125328530\\lsass.exe" e1af1ba1edb943b838456f57bd564d01.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\sylsplvc.exe 3982436535.exe File opened for modification C:\Windows\sylsplvc.exe 3982436535.exe File created C:\Windows\winknavrso.exe 2030322604.exe File opened for modification C:\Windows\winknavrso.exe 2030322604.exe File created C:\Windows\sysdinrdvs.exe 1198524379.exe File opened for modification C:\Windows\sysdinrdvs.exe 1198524379.exe - Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 1880 2030322604.exe 3092 1198524379.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2592 wrote to memory of 1200 2592 e1af1ba1edb943b838456f57bd564d01.exe 104 PID 2592 wrote to memory of 1200 2592 e1af1ba1edb943b838456f57bd564d01.exe 104 PID 2592 wrote to memory of 1200 2592 e1af1ba1edb943b838456f57bd564d01.exe 104 PID 1200 wrote to memory of 2832 1200 lsass.exe 112 PID 1200 wrote to memory of 2832 1200 lsass.exe 112 PID 1200 wrote to memory of 2832 1200 lsass.exe 112 PID 2832 wrote to memory of 3324 2832 3982436535.exe 113 PID 2832 wrote to memory of 3324 2832 3982436535.exe 113 PID 2832 wrote to memory of 3324 2832 3982436535.exe 113 PID 3324 wrote to memory of 1880 3324 sylsplvc.exe 115 PID 3324 wrote to memory of 1880 3324 sylsplvc.exe 115 PID 3324 wrote to memory of 1880 3324 sylsplvc.exe 115 PID 3324 wrote to memory of 3092 3324 sylsplvc.exe 116 PID 3324 wrote to memory of 3092 3324 sylsplvc.exe 116 PID 3324 wrote to memory of 3092 3324 sylsplvc.exe 116 PID 3092 wrote to memory of 1564 3092 1198524379.exe 117 PID 3092 wrote to memory of 1564 3092 1198524379.exe 117 PID 3092 wrote to memory of 1564 3092 1198524379.exe 117 PID 3092 wrote to memory of 1172 3092 1198524379.exe 118 PID 3092 wrote to memory of 1172 3092 1198524379.exe 118 PID 3092 wrote to memory of 1172 3092 1198524379.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1af1ba1edb943b838456f57bd564d01.exe"C:\Users\Admin\AppData\Local\Temp\e1af1ba1edb943b838456f57bd564d01.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\30574125328530\lsass.exeC:\30574125328530\lsass.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3982436535.exeC:\Users\Admin\AppData\Local\Temp\3982436535.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\sylsplvc.exeC:\Windows\sylsplvc.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\2030322604.exeC:\Users\Admin\AppData\Local\Temp\2030322604.exe5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:1880
-
-
C:\Users\Admin\AppData\Local\Temp\1198524379.exeC:\Users\Admin\AppData\Local\Temp\1198524379.exe5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\325483898.exeC:\Users\Admin\AppData\Local\Temp\325483898.exe6⤵
- Executes dropped EXE
PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\3060727064.exeC:\Users\Admin\AppData\Local\Temp\3060727064.exe6⤵
- Executes dropped EXE
PID:1172
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3764 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:81⤵PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\30574125328530\lsass.exe
- Size 105KB
- SHA256 042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29
- MD5 e1af1ba1edb943b838456f57bd564d01
- SHA1 489760f1f57a35591020f1f82e54740d76fa97e7
- SHA512 982417c1f742e2624c1da543058ccb2b3e9b5f46cedcbba242d13717a2f6c56cd186ba186767542bf68e0e38d0894b3ac027874f33f5bd5a94c3dac542916155
- SSDEEP 3072:gEbJSw745FIlbt/d6WruEPJZDTS7MJCAc2BEUzWndAstTIgFpW:rbJSgkkcWruEhZDTS7MJCAc2BEUzWndw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\40QGA6IK\1[1]
- Size 23KB
- SHA256 4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b
- MD5 07d8d1886e9515653645a06317888a14
- SHA1 50efdfb1b292bb28b9177e19e898d8b4ec59ec09
- SHA512 09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894
- SSDEEP 384:bwHpS3LDv1xjNaM69O/i01RnL+WoLrLdSIR7KDNxfQpkrlpzdZ5zj4y0AgH3CxwU:8Hp0Lb1xj1iQi01RL+WoLrLIIRUrjlpZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\63P52RXT\2[1]
- Size 84KB
- SHA256 c1b2b4d052f98028e6b32955ed052881591bbaa57f11279b7745cc26566f8268
- MD5 b464b1ac75172e05db725d17b9bb9044
- SHA1 cc8689ef9f70be7210520bd68b9767e3c6f1e363
- SHA512 9adab953f44c68cd0eb37873a51d18827a06bf4d99d4d354053e16bd4c3bb272b9c9290cc4190919f9d89bfe6d304546ddffc460f8ee2ed8e75a9bd3e13294e2
- SSDEEP 1536:xubuTOzoKTY/Vpn9ReZqW+QipRlqlQw/K8T3bUkAm3x+SzG/Dcsbq/wBsKCyl2B:xubuTOpTs/9ReZqnpRlIK8T3bUextq/u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1198524379.exe
- Size 84KB
- SHA256 93f3f99a6d6dc69b907a3da8596bd850c1e3ce53be9bf1c6edfdb00e90579e6f
- MD5 41d55c23d79fc0c0c322db16c6ce6af8
- SHA1 e4bbdf2a983a11975a7ab6dcba41cb60676ec780
- SHA512 06680eb47802659dc2e28cd9a839052a8536112056db49f7179f1b53cf2dba0e9cfd9d8bbdeb446ecb8a2f4a58f7b0f100d0526660d4afd8540a4db091cf621f
- SSDEEP 1536:fhLCZdBFmav82unyYNrbmpcKHZdX7Xl0CF:5eZUOuPHKrXl0CF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2030322604.exe
- Size 23KB
- SHA256 84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450
- MD5 9d2b22562b9a3958dfd7e6e6fa7bd66f
- SHA1 1941c24958ac09cf518f4124225b2d0b5d874cf0
- SHA512 8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1
- SSDEEP 384:psxGwxN5Af+2v877Oo0MOQ+XceXUoRgWScdQhue4/5zF:pSGxCeo4MeXUoiR4e4/5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3982436535.exe
- Size 79KB
- SHA256 3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879
- MD5 1e8a2ed2e3f35620fb6b8c2a782a57f3
- SHA1 e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a
- SHA512 ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade
- SSDEEP 1536:y3Mz8f2Z9F1nc2ZWEa5pFeStStfFPeeeeeeeeWeeeee:ZwfYFRVZWz3XtStfF
- MD5 SHA1 SHA512 SSDEEP