phorphiex | d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9

General

Target

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
Size

110KB
MD5

373f3708061660dc78060c9259640e42
SHA1

b3771d48eb54913c946afa42a1eb6a4968e10277
SHA256

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9
SHA512

44efbfb595da8009d156cf84a8fc2543f16ed283110c3b9f2969cda45d570f898002a6e97252586eab5eef82720fcf148556ec41b2464a89e1c336a663b7be17
SSDEEP

1536:D3Mz8vZz71dUwH4pHfwbpBeSGStfFTReeeeeeeeWeeeeedAEVhB5N9B/2DMpWNr:Iw57zbH4xfwd7GStfFTf1Vt5a

Score

10^/10

phorphiex loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysqxrdsvc.exe"	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Drops file in Windows directory 2 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	ioc	process
File created	C:\Windows\sysqxrdsvc.exe	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
File opened for modification	C:\Windows\sysqxrdsvc.exe	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

pid process

1648 d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

pid	process
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description pid process

Token: SeDebugPrivilege 1648 d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	pid	process
Token: SeDebugPrivilege	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe

description	pid	process	target process
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 376	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	wininit.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 388	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	csrss.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 424	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	winlogon.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 468	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	services.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 484	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsass.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 492	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	lsm.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 608	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 688	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 772	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe
PID 1648 wrote to memory of 824	1648	d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe	svchost.exe

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:824

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:276

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1080

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:868

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:2304

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:484

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:388

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe
"C:\Users\Admin\AppData\Local\Temp\d5c1d8bd71be39701023cc7ff87aae6f858f4e2dab7a4faeaec1e85078aa82b9.exe"
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1648-2-0x0000000077E00000-0x0000000077E01000-memory.dmp

Filesize
4KB

Download
memory/1648-1-0x0000000077DFF000-0x0000000077E00000-memory.dmp

Filesize
4KB

Download
memory/1648-6-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads