phorphiex | 0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73 | Triage

Resubmissions

18-04-2024 11:23

240418-nhhhhscg6v 10

18-04-2024 11:22

240418-ngsbbsbe43 10

18-04-2024 11:22

240418-ngr1kacg5w 10

18-04-2024 11:22

240418-ngrd2acg5v 10

18-04-2024 11:22

240418-ngqgqscg5t 10

18-04-2024 10:00

240418-l1qwhahg77 10

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18-04-2024 11:23

Sharing

Report Analysis Logs

General

Target

0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe
Size

104KB
MD5

e28889b5f98d8ed1a00835e1ca8a3b21
SHA1

b665e89468ac7ae566aa996aeec203b25bf24b0c
SHA256

0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73
SHA512

d3f1708274dd84045c46c3315aeba5c16f890d94ddfcda0df29e96bc3a0159ead0f8945898d6dde25ad01981e385a41b69b1bdfd700e08f47249bffece941cbd
SSDEEP

3072:Xl58BV2ZjooGTb5PjMdhS3KV3/jjKwcNHjo86r8X7FS8EFc:158BIFveZjMrS3q3/jjKwcNHjo86r8r6

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\16529817528707\smss.exe	family_phorphiex

Windows security bypass 2 TTPs 12 IoCs

Disable or Modify Tools

Modify Registry

Processes:

smss.exesylsplvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe

Executes dropped EXE 3 IoCs

Processes:

smss.exe1863626093.exesylsplvc.exe

pid process

1972 smss.exe
5044 1863626093.exe
552 sylsplvc.exe

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

Processes:

smss.exesylsplvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe

Adds Run key to start application 2 TTPs 3 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe1863626093.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\16529817528707\\smss.exe"	0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\16529817528707\\smss.exe"	0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe"	1863626093.exe

Drops file in Windows directory 2 IoCs

Processes:

1863626093.exe

description ioc process

File created C:\Windows\sylsplvc.exe 1863626093.exe
File opened for modification C:\Windows\sylsplvc.exe 1863626093.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exesmss.exe1863626093.exe

description	pid	process	target process
PID 3200 wrote to memory of 1972	3200	0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe	smss.exe
PID 3200 wrote to memory of 1972	3200	0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe	smss.exe
PID 3200 wrote to memory of 1972	3200	0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe	smss.exe
PID 1972 wrote to memory of 5044	1972	smss.exe	1863626093.exe
PID 1972 wrote to memory of 5044	1972	smss.exe	1863626093.exe
PID 1972 wrote to memory of 5044	1972	smss.exe	1863626093.exe
PID 5044 wrote to memory of 552	5044	1863626093.exe	sylsplvc.exe
PID 5044 wrote to memory of 552	5044	1863626093.exe	sylsplvc.exe
PID 5044 wrote to memory of 552	5044	1863626093.exe	sylsplvc.exe

C:\Users\Admin\AppData\Local\Temp\0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe
"C:\Users\Admin\AppData\Local\Temp\0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3200

C:\16529817528707\smss.exe
C:\16529817528707\smss.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\1863626093.exe
C:\Users\Admin\AppData\Local\Temp\1863626093.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5044

C:\Windows\sylsplvc.exe
C:\Windows\sylsplvc.exe
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\16529817528707\smss.exe
Filesize
104KB

MD5
e28889b5f98d8ed1a00835e1ca8a3b21

SHA1
b665e89468ac7ae566aa996aeec203b25bf24b0c

SHA256
0429bed4098d95e68e4686ed79cb3967e7396956a095433dd56f4e3d49135d73

SHA512
d3f1708274dd84045c46c3315aeba5c16f890d94ddfcda0df29e96bc3a0159ead0f8945898d6dde25ad01981e385a41b69b1bdfd700e08f47249bffece941cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1863626093.exe
Filesize
79KB

MD5
1e8a2ed2e3f35620fb6b8c2a782a57f3

SHA1
e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

SHA256
3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

SHA512
ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

Download Submit