Behavioral task
behavioral1
Sample
721cf6bc50c06dc671136c1e82b6dc27c9c18e6f84149212c22877e78cf6d697.exe
Resource
win7-20240704-en
General
-
Target
721cf6bc50c06dc671136c1e82b6dc27c9c18e6f84149212c22877e78cf6d697
-
Size
37KB
-
MD5
2e46a434392830b26d972171ff401fef
-
SHA1
242c68e650d6df34e39dc6ecf0e94620f663ecdf
-
SHA256
721cf6bc50c06dc671136c1e82b6dc27c9c18e6f84149212c22877e78cf6d697
-
SHA512
878e5d7c32e320d0ade876de6ee13bc6df799476097d983ae72356f227b81bdd6a82909c3997645069ff6f9a0f9f0c5884699aceacd9c7bf2744d2d466bd4f7e
-
SSDEEP
768:H6Dx41k4HelZgEgcyNyXIhquBJ3+seFelZV:f1LHelXJIy4Y+eFCV
Malware Config
Extracted
phorphiex
http://185.215.113.93/
http://gimmefile.top/
http://feedmefile.top/
http://gotsomefile.top/
http://thaus.ws/
http://thaus.top/
15DBeUGFSQLbpYvWLJwzHUXSRrHNU9uQuS8c2wvFLZ7Nxz3N
1E5ZxnNUbbGQarWjMA7tCwp3Btm38GvRkv
3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
XkcKjKZqNUkChwJXMj5uDjDns6etXvakir
D7MYki8urW3xq8sZJ8Q2v2ZrHxjzp7ACvb
0x76e4CB2fcf7f931Fd750e93F443536Ee068d1cdE
LfYFvpk2hccXw12tN3BBMWh7EcUBMbKoTG
rUQFcff9R1eKAwTtR1wbuQxmcoB236mz44
TEUaG7jyXdyrDS3JeEg1w1hotmmEMjx4TB
t1gTRxsrEXwky32j22jgFRZAafBzmCV2M2V
AT5Vm3ZrUg98s9kBue2g9YjnwK4kFKhQw3
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
44L2q3sPJ3DMJZiuSpHvehHMLbMXx3SAoVbLm5DWDw1A7PhUvcCPAGg5qAN98DWAUG7CuD4WmydP4JkewTz2aeVd4qhS822
GBLUYL3QTKP3NXVWCYNZ7ZH4CWFT6PVCXEYCNUNSHM34WKG2UL5EDQMV
bnb154sx9pdh8er33ujxlpfk3zwvlfp9rd5rskvvgc
bc1qn4r93am7rxxr4a5dwydhwx0p2kd4xfd7mz42f3
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule sample family_phorphiex -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 721cf6bc50c06dc671136c1e82b6dc27c9c18e6f84149212c22877e78cf6d697
Files
-
721cf6bc50c06dc671136c1e82b6dc27c9c18e6f84149212c22877e78cf6d697.exe windows:5 windows x86 arch:x86
fbe38eac33127c8216f939b478d0cb1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
wcscmp
wcslen
strchr
strcmp
_wfopen
fseek
ftell
fclose
srand
rand
mbstowcs
memset
_mbsstr
strlen
isalpha
isdigit
wininet
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileW
shlwapi
StrCmpNW
PathMatchSpecW
PathFileExistsW
PathFindFileNameW
PathFileExistsA
kernel32
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
lstrcmpW
MoveFileExW
FindNextFileW
FindClose
SetFileAttributesW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
GetTickCount
ExpandEnvironmentStringsW
WriteFile
CreateFileW
GetFileSize
GetVolumeInformationW
GetModuleFileNameW
CreateProcessW
GetLocaleInfoA
CreateThread
CopyFileA
GetLastError
CreateMutexA
ExitProcess
DeleteFileA
MoveFileA
MoveFileW
GetModuleHandleA
RemoveDirectoryW
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
ExitThread
Sleep
SetEndOfFile
SetFilePointer
CloseHandle
UnmapViewOfFile
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GetStartupInfoA
user32
SetFocus
CloseWindow
SetForegroundWindow
ShowWindow
FindWindowA
wsprintfA
wsprintfW
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
advapi32
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptVerifySignatureA
CryptHashData
CryptCreateHash
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegSetValueExW
CryptDestroyKey
shell32
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ