Overview

overview

10

Static

static

10

t.exe

windows7-x64

10

t.exe

windows10-1703-x64

10

t.exe

windows10-2004-x64

10

t.exe

windows11-21h2-x64

10

Resubmissions

09-04-2024 12:54

240409-p5dzaafd97 10

09-04-2024 12:54

240409-p5dcraag3w 10

09-04-2024 12:54

240409-p5cq8aag3v 10

09-04-2024 12:54

240409-p5cffsfd95 10

06-05-2021 04:42

210506-89h2kyk32a 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-04-2024 09:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    t.exe

  • Size

    100KB

  • MD5

    ee0a1ec859b753abc30847157d81f37c

  • SHA1

    2fd868d94c6dc063ca49c767c873505fbc87dcd9

  • SHA256

    abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922

  • SHA512

    6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

  • SSDEEP

    3072:UlmICQuNwVOv/8I6WruEPJZDUXA2M1CUci6sUJW51TrFS83Fo:WmICRmgMtWruEhZDCA2M1CUci6sUJW5D

Score
10/10
phorphiexevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Phorphiex payload 1 IoCs
  • Windows security bypass 2 TTPs 24 IoCs
    evasiontrojan
  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 28 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\t.exe
    "C:\Users\Admin\AppData\Local\Temp\t.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\1703958122112\lsass.exe
      C:\1703958122112\lsass.exe
      2⤵
      • Windows security bypass
      • Executes dropped EXE
      • Windows security modification
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Users\Admin\AppData\Local\Temp\1187422040.exe
        C:\Users\Admin\AppData\Local\Temp\1187422040.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Windows\sylsplvc.exe
          C:\Windows\sylsplvc.exe
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Users\Admin\AppData\Local\Temp\3358230675.exe
            C:\Users\Admin\AppData\Local\Temp\3358230675.exe
            5⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of WriteProcessMemory
            PID:900
            • C:\Users\Admin\AppData\Local\Temp\69064734.exe
              C:\Users\Admin\AppData\Local\Temp\69064734.exe
              6⤵
              • Executes dropped EXE
              PID:3092
          • C:\Users\Admin\AppData\Local\Temp\1823722552.exe
            C:\Users\Admin\AppData\Local\Temp\1823722552.exe
            5⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Drops file in Windows directory
            PID:988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\1703958122112\lsass.exe
    Filesize

    100KB

    MD5

    ee0a1ec859b753abc30847157d81f37c

    SHA1

    2fd868d94c6dc063ca49c767c873505fbc87dcd9

    SHA256

    abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922

    SHA512

    6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KXAXPKLE\2[1]
    Filesize

    14KB

    MD5

    fce292c79288067dc17919ed588c161c

    SHA1

    bb44fa2c95af5bbd11e49264a40c16d6f343fa21

    SHA256

    4ef8146d85d60c2867bdbe44304b5ba00cceb208f4c10c9f91183308e1da3828

    SHA512

    73dac29753044a720fc43b4ee19d320e06855167cdf0ebf329207aa16faa13fd6d2937bd87b54e544dd8d4c3da634773abd73769d3915154099ff01e6e03033e

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LYP7DSKF\1[1]
    Filesize

    92KB

    MD5

    5dde1286cd55e25fe0fc60d2b064d137

    SHA1

    dd311cfbddc4dae8e15ad7b629adfab617b2a727

    SHA256

    a6ddd8b13c1192dd4740991eb836641fff23b2beff06bb348e6cfc613e8abd50

    SHA512

    e5d0efdd47b92b89a2e3e0cf0ab4f8258ba667ce7ac75123248d9c59058322caea8f8980b013d144f7d039bc376760d17c8c16b4c985fd1940f90cc1c450a450

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\1187422040.exe
    Filesize

    79KB

    MD5

    1e8a2ed2e3f35620fb6b8c2a782a57f3

    SHA1

    e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

    SHA256

    3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

    SHA512

    ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\1823722552.exe
    Filesize

    14KB

    MD5

    2f4ab1a4a57649200550c0906d57bc28

    SHA1

    94bc52ed3921791630b2a001d9565b8f1bd3bd17

    SHA256

    baa6149b5b917ea3af1f7c77a65e26a34a191a31a9c79726bd60baf4656701fa

    SHA512

    ab1a59aa4c48f6c7fcf7950f4a68c3b89a56f266681a5aabd0df947af8340676e209d82ddd1997bfebd972b35ca235233b61231335aec4567f7b031e786ea7e8

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\3358230675.exe
    Filesize

    92KB

    MD5

    9d5d9c05478676448e711c067bfac5fc

    SHA1

    9de1e4e02e8b9c2e998f92b5e2b7ec0a6bc832ef

    SHA256

    b4f3a86dc3d34a311aec138b02208b181fb9f767203df3bd26d779a28e3d71ed

    SHA512

    1d47c1d17f968304aa2cfe2e8100d309f95f7303c94455c1098a8ae238fc1e1fbfcb86368836750b48b7a47c67bbcd35f901c4fb9457ab43b7f3ef1cb376e7a3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\496527900.exe
    Filesize

    8KB

    MD5

    93c0bd2539d4d4eb74fe6d41c928f66c

    SHA1

    c7a2010ebd934828e20450c5318c8e20168f4ba8

    SHA256

    5d9f88fcde1bd7fbe7ecba0dae737da96a55005b0d61c45c4251be0677195299

    SHA512

    b8c7cdad4cf1ffd9a3bb6ffb36dabec957169bd43e27f0ec48c19693dd014c09916c0df0a46e808dba0450707c89e7dba7d3ff439d763fbe1e4d8b09fad2aad6

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\496527900.exe
    Filesize

    8KB

    MD5

    80f97c916a3eb0e5663761ac5ee1ddd1

    SHA1

    4ee54f2bf257f9490eaa2c988a5705ef7b11d2bc

    SHA256

    9e06f61d715b1b88507e3e70390721ab7ab35d70fe2df6edaaf0e565783e7d2f

    SHA512

    85e30cfc5c02543820f884602701986aa1e40d587da13c35b76b80dc95c0d6b3e18f5b0ad083fcfa3e9b92935306e4f8faec36ac28ac25e53fb03dcba4a092a6

    Download Submit