Resubmissions

09-04-2024 12:54

240409-p5dzaafd97 10

09-04-2024 12:54

240409-p5dcraag3w 10

09-04-2024 12:54

240409-p5cq8aag3v 10

09-04-2024 12:54

240409-p5cffsfd95 10

06-05-2021 04:42

210506-89h2kyk32a 10

Analysis

  • max time kernel
    560s
  • max time network
    564s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-04-2024 09:04

Errors

Reason
Machine shutdown

General

  • Target

    t.exe

  • Size

    100KB

  • MD5

    ee0a1ec859b753abc30847157d81f37c

  • SHA1

    2fd868d94c6dc063ca49c767c873505fbc87dcd9

  • SHA256

    abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922

  • SHA512

    6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

  • SSDEEP

    3072:UlmICQuNwVOv/8I6WruEPJZDUXA2M1CUci6sUJW51TrFS83Fo:WmICRmgMtWruEhZDCA2M1CUci6sUJW5D

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Phorphiex payload 1 IoCs
  • Windows security bypass 2 TTPs 24 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 28 IoCs
  • Adds Run key to start application 2 TTPs 7 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\t.exe
    "C:\Users\Admin\AppData\Local\Temp\t.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\2841782089764\lsass.exe
      C:\2841782089764\lsass.exe
      2⤵
      • Windows security bypass
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Users\Admin\AppData\Local\Temp\1092730454.exe
        C:\Users\Admin\AppData\Local\Temp\1092730454.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\sylsplvc.exe
          C:\Windows\sylsplvc.exe
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Users\Admin\AppData\Local\Temp\254388261.exe
            C:\Users\Admin\AppData\Local\Temp\254388261.exe
            5⤵
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Users\Admin\AppData\Local\Temp\783716146.exe
              C:\Users\Admin\AppData\Local\Temp\783716146.exe
              6⤵
              • Executes dropped EXE
              PID:2312
            • C:\Users\Admin\AppData\Local\Temp\216426659.exe
              C:\Users\Admin\AppData\Local\Temp\216426659.exe
              6⤵
              • Executes dropped EXE
              PID:2840
            • C:\Users\Admin\AppData\Local\Temp\1138111131.exe
              C:\Users\Admin\AppData\Local\Temp\1138111131.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1924
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c shutdown /r
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2544
                • C:\Windows\SysWOW64\shutdown.exe
                  shutdown /r
                  8⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3020
          • C:\Users\Admin\AppData\Local\Temp\178301017.exe
            C:\Users\Admin\AppData\Local\Temp\178301017.exe
            5⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Drops file in Windows directory
            PID:2704
          • C:\Users\Admin\AppData\Local\Temp\241946201.exe
            C:\Users\Admin\AppData\Local\Temp\241946201.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2836
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c shutdown /r
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:324
              • C:\Windows\SysWOW64\shutdown.exe
                shutdown /r
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2512
      • C:\Users\Admin\AppData\Local\Temp\1949337737.exe
        C:\Users\Admin\AppData\Local\Temp\1949337737.exe
        3⤵
        • Executes dropped EXE
        PID:2628
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2760
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\1[1]

        Filesize

        92KB

        MD5

        5dde1286cd55e25fe0fc60d2b064d137

        SHA1

        dd311cfbddc4dae8e15ad7b629adfab617b2a727

        SHA256

        a6ddd8b13c1192dd4740991eb836641fff23b2beff06bb348e6cfc613e8abd50

        SHA512

        e5d0efdd47b92b89a2e3e0cf0ab4f8258ba667ce7ac75123248d9c59058322caea8f8980b013d144f7d039bc376760d17c8c16b4c985fd1940f90cc1c450a450

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\5[1]

        Filesize

        8KB

        MD5

        93c0bd2539d4d4eb74fe6d41c928f66c

        SHA1

        c7a2010ebd934828e20450c5318c8e20168f4ba8

        SHA256

        5d9f88fcde1bd7fbe7ecba0dae737da96a55005b0d61c45c4251be0677195299

        SHA512

        b8c7cdad4cf1ffd9a3bb6ffb36dabec957169bd43e27f0ec48c19693dd014c09916c0df0a46e808dba0450707c89e7dba7d3ff439d763fbe1e4d8b09fad2aad6

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\2[1]

        Filesize

        14KB

        MD5

        fce292c79288067dc17919ed588c161c

        SHA1

        bb44fa2c95af5bbd11e49264a40c16d6f343fa21

        SHA256

        4ef8146d85d60c2867bdbe44304b5ba00cceb208f4c10c9f91183308e1da3828

        SHA512

        73dac29753044a720fc43b4ee19d320e06855167cdf0ebf329207aa16faa13fd6d2937bd87b54e544dd8d4c3da634773abd73769d3915154099ff01e6e03033e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\cc33[1]

        Filesize

        80KB

        MD5

        98e2443907f1ecb82e86e3818b25ba66

        SHA1

        cfdafa41e582e8bd21cb93a96add84d0ab2bdc9f

        SHA256

        ef83ef42ff36634eb2af69ab262e248623751c5491267904ef50ae8d3f1d0481

        SHA512

        d47843174a5d5aa468e166c8f8d1bc74240b47ada6b095df948863b72aee503f9221be813d0a40dd5e6f7def43e1023e394227ab0ff7d8708d65eada708e7356

      • C:\Users\Admin\AppData\Local\Temp\241946201.exe

        Filesize

        8KB

        MD5

        80f97c916a3eb0e5663761ac5ee1ddd1

        SHA1

        4ee54f2bf257f9490eaa2c988a5705ef7b11d2bc

        SHA256

        9e06f61d715b1b88507e3e70390721ab7ab35d70fe2df6edaaf0e565783e7d2f

        SHA512

        85e30cfc5c02543820f884602701986aa1e40d587da13c35b76b80dc95c0d6b3e18f5b0ad083fcfa3e9b92935306e4f8faec36ac28ac25e53fb03dcba4a092a6

      • C:\Users\Admin\tbtnds.dat

        Filesize

        4KB

        MD5

        1d4b7ab77e14b679b333e22ce39d21bf

        SHA1

        3e2e1d840234c8af4aa1d0820ac4c3e44a93f8c4

        SHA256

        4f3304730ccdd911b9c0f23b37a34db91b093a1b0d9fdd422252a46e1ef4325c

        SHA512

        edec716371f5a48d42fadf393d87a5d88d937ea9931a34d747c8a9d7c39c46b62709366dc16ef9030bde0d1422dfbc8b63a1dbe76ea6eb0b25d957ba67dd8aec

      • \2841782089764\lsass.exe

        Filesize

        100KB

        MD5

        ee0a1ec859b753abc30847157d81f37c

        SHA1

        2fd868d94c6dc063ca49c767c873505fbc87dcd9

        SHA256

        abf63fc54948cdd9d1bf46a2f59fcb081bb0ff10b595f0ba2faad392ad368922

        SHA512

        6ba490cad428176d4235241ab96d741121e608f3fcf156c4a8ba0b106c640ac392ef4f74e0b11f5c56c3829e8566a613676dbef812e1e89c248c40338331bfdc

      • \Users\Admin\AppData\Local\Temp\1092730454.exe

        Filesize

        79KB

        MD5

        1e8a2ed2e3f35620fb6b8c2a782a57f3

        SHA1

        e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

        SHA256

        3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

        SHA512

        ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

      • \Users\Admin\AppData\Local\Temp\178301017.exe

        Filesize

        14KB

        MD5

        2f4ab1a4a57649200550c0906d57bc28

        SHA1

        94bc52ed3921791630b2a001d9565b8f1bd3bd17

        SHA256

        baa6149b5b917ea3af1f7c77a65e26a34a191a31a9c79726bd60baf4656701fa

        SHA512

        ab1a59aa4c48f6c7fcf7950f4a68c3b89a56f266681a5aabd0df947af8340676e209d82ddd1997bfebd972b35ca235233b61231335aec4567f7b031e786ea7e8

      • \Users\Admin\AppData\Local\Temp\1949337737.exe

        Filesize

        79KB

        MD5

        ca57b9f2c47ab7d459f6c88d550e3e32

        SHA1

        a179d0c011a06f02aa0b24fa9ceaea10429da078

        SHA256

        937faa2f94fd8bf084196a0b354bb2dc364e557b70d682f183caf8cb0fdbd77b

        SHA512

        7950798db7601b96a585fd4e7a8f471944e7d09fa3a1cbc4ae256eb6d4817850ab3454d83a06b7c8449f6cd190b8206b6497a8570a2f010456c14e48651331df

      • \Users\Admin\AppData\Local\Temp\254388261.exe

        Filesize

        92KB

        MD5

        9d5d9c05478676448e711c067bfac5fc

        SHA1

        9de1e4e02e8b9c2e998f92b5e2b7ec0a6bc832ef

        SHA256

        b4f3a86dc3d34a311aec138b02208b181fb9f767203df3bd26d779a28e3d71ed

        SHA512

        1d47c1d17f968304aa2cfe2e8100d309f95f7303c94455c1098a8ae238fc1e1fbfcb86368836750b48b7a47c67bbcd35f901c4fb9457ab43b7f3ef1cb376e7a3

      • memory/2760-117-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

        Filesize

        4KB

      • memory/2868-118-0x0000000002860000-0x0000000002861000-memory.dmp

        Filesize

        4KB