phorphiex | e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab

General

Target

tmp.exe
Size

9KB
MD5

62b97cf4c0abafeda36e3fc101a5a022
SHA1

328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
SHA256

e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
SHA512

32bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24
SSDEEP

96:zM2BLwN8GXhc1I+a8gnYFdj9DSYp+BYA8v7cVO15uJxGE9YUBz2qh3C7tCE4ecp:AIwNfC1TUYv9p+OF8JxTmUBzthcqp

Score

10^/10

phorphiex evasion loader persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3247215299.exe	family_phorphiex

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3247215299.exe1810010879.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3247215299.exe

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

Processes:

1810010879.exe3247215299.exe191556729.exe3314931234.exeWindows Security Upgrade Service.exeWindows Security Upgrade Service.exeWindows Security Upgrade Service.exe

pid	process
1836	1810010879.exe
1888	3247215299.exe
320	191556729.exe
2800	3314931234.exe
864	Windows Security Upgrade Service.exe
2356	Windows Security Upgrade Service.exe
1488	Windows Security Upgrade Service.exe

Loads dropped DLL 9 IoCs

Processes:

tmp.exe1810010879.exe3314931234.exe

pid	process
944	tmp.exe
944	tmp.exe
1836	1810010879.exe
1836	1810010879.exe
1836	1810010879.exe
1836	1810010879.exe
2800	3314931234.exe
2800	3314931234.exe
2800	3314931234.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3247215299.exe1810010879.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1810010879.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3247215299.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3247215299.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1810010879.exe3247215299.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysdinrdvs.exe"	1810010879.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysdinrdvs.exe"	1810010879.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe"	3247215299.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe"	3247215299.exe

Drops file in Windows directory 4 IoCs

Processes:

1810010879.exe3247215299.exe

description	ioc	process
File created	C:\Windows\sysdinrdvs.exe	1810010879.exe
File opened for modification	C:\Windows\sysdinrdvs.exe	1810010879.exe
File created	C:\Windows\winknavrso.exe	3247215299.exe
File opened for modification	C:\Windows\winknavrso.exe	3247215299.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

3247215299.exe

pid process

1888 3247215299.exe

pid	process
1888	3247215299.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

tmp.exe1810010879.exe3314931234.exe

description	pid	process	target process
PID 944 wrote to memory of 1836	944	tmp.exe	1810010879.exe
PID 944 wrote to memory of 1836	944	tmp.exe	1810010879.exe
PID 944 wrote to memory of 1836	944	tmp.exe	1810010879.exe
PID 944 wrote to memory of 1836	944	tmp.exe	1810010879.exe
PID 1836 wrote to memory of 1888	1836	1810010879.exe	3247215299.exe
PID 1836 wrote to memory of 1888	1836	1810010879.exe	3247215299.exe
PID 1836 wrote to memory of 1888	1836	1810010879.exe	3247215299.exe
PID 1836 wrote to memory of 1888	1836	1810010879.exe	3247215299.exe
PID 1836 wrote to memory of 320	1836	1810010879.exe	191556729.exe
PID 1836 wrote to memory of 320	1836	1810010879.exe	191556729.exe
PID 1836 wrote to memory of 320	1836	1810010879.exe	191556729.exe
PID 1836 wrote to memory of 320	1836	1810010879.exe	191556729.exe
PID 1836 wrote to memory of 2800	1836	1810010879.exe	3314931234.exe
PID 1836 wrote to memory of 2800	1836	1810010879.exe	3314931234.exe
PID 1836 wrote to memory of 2800	1836	1810010879.exe	3314931234.exe
PID 1836 wrote to memory of 2800	1836	1810010879.exe	3314931234.exe
PID 2800 wrote to memory of 864	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 864	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 864	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 864	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 2356	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 2356	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 2356	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 2356	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 1488	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 1488	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 1488	2800	3314931234.exe	Windows Security Upgrade Service.exe
PID 2800 wrote to memory of 1488	2800	3314931234.exe	Windows Security Upgrade Service.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\1810010879.exe
C:\Users\Admin\AppData\Local\Temp\1810010879.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Local\Temp\3247215299.exe
C:\Users\Admin\AppData\Local\Temp\3247215299.exe
3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:1888

C:\Users\Admin\AppData\Local\Temp\191556729.exe
C:\Users\Admin\AppData\Local\Temp\191556729.exe
3⤵
- Executes dropped EXE
PID:320

C:\Users\Admin\AppData\Local\Temp\3314931234.exe
C:\Users\Admin\AppData\Local\Temp\3314931234.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
4⤵
- Executes dropped EXE
PID:864

C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
4⤵
- Executes dropped EXE
PID:2356

C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
4⤵
- Executes dropped EXE
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1810010879.exe
Filesize
84KB

MD5
161a475bfe57d8b5317ca1f2f24b88fa

SHA1
38fa8a789d3d7570c411ddf4c038d89524142c2c

SHA256
98fb81423a107a5359e5fc86f1c4d81ff2d4bc73b79f55a5bf827fdb8e620c54

SHA512
d9f61f80c96fbac030c1105274f690d38d5dc8af360645102080a7caed7bad303ae89ed0e169124b834a68d1a669781eb70269bf4e8d5f34aeef394dd3d16547

Download Submit
\Users\Admin\AppData\Local\Temp\191556729.exe
Filesize
84KB

MD5
41d55c23d79fc0c0c322db16c6ce6af8

SHA1
e4bbdf2a983a11975a7ab6dcba41cb60676ec780

SHA256
93f3f99a6d6dc69b907a3da8596bd850c1e3ce53be9bf1c6edfdb00e90579e6f

SHA512
06680eb47802659dc2e28cd9a839052a8536112056db49f7179f1b53cf2dba0e9cfd9d8bbdeb446ecb8a2f4a58f7b0f100d0526660d4afd8540a4db091cf621f

Download Submit
\Users\Admin\AppData\Local\Temp\3247215299.exe
Filesize
23KB

MD5
9d2b22562b9a3958dfd7e6e6fa7bd66f

SHA1
1941c24958ac09cf518f4124225b2d0b5d874cf0

SHA256
84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450

SHA512
8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1

Download Submit
\Users\Admin\AppData\Local\Temp\3314931234.exe
Filesize
10KB

MD5
34aa7652414d0362f2b9343acea62511

SHA1
b58bbaef71dc70adc0d033b733cabdf83e432d78

SHA256
b47b3821c5909323987e8979c5d9e66c6920118542a598bfd12d9d5b34b604cb

SHA512
d9ae5e4cd20ed0722c24b15efe9aff10adcd87fcedb5d03be74450da098a73abe8e4550b6de5d321252128d0ed2e93c160b462cf91fbba7c295a0ea6afedf3d9

Download Submit
\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
Filesize
20KB

MD5
5edee966656eceb04d86ef885ec57562

SHA1
353b6ebe6e681c62783848907087526ed029838f

SHA256
811778701d422ba4e3f222b023c81f174b96359c273d46ab5c7343cd1270030e

SHA512
f4d03585f3049b0144ec92a60188dff2a4a0a7a36b8c3e348a017e10bf81e00361da271103ae4ec94d2c6bd517958845607af7ea49839b64af3ce51af7332a68

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads