Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 18:41

General

  • Target

    2024-10-09_55ca57c96f10cbfb63d111669c93e6e2_avoslocker_revil.exe

  • Size

    4.6MB

  • MD5

    55ca57c96f10cbfb63d111669c93e6e2

  • SHA1

    24201abececbf2c55acbf1ac3e9b402a259751f2

  • SHA256

    83e93a32bca4d65458218f81f088af7b4dbdce9ef6c231084d2f731b77e7ab30

  • SHA512

    506698a126f26bf7a771d1ec1921a8abab6ffc9b855883f106423d287b5d07b6625d20cbce43a948fc9a091ba5e942c101f2509861cc425951eaaa19ea26680c

  • SSDEEP

    98304:BtuiUQocm9mxVJ/xH2Na7dLa/gaBqPQ61vsxwskCXLRhl3m2drIgIJ9:BNnocm9mxVJ/pUadLaH6Wxwsv1m0URL

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LTK4xdKPAgFHPLan8kriAD7eY4heyy73mB

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4BB7ckkaPTyADc8trtuwDoZxywaR4eNL5cDJ3KBjq9GraN4mUFztf7mLS7WgT7Bh7uPqpjvA4ypVwXKCJ1vvLWWAFvSmDoD

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes
  • mutex

    l9ll8dd6x

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Windows security bypass 2 TTPs 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-09_55ca57c96f10cbfb63d111669c93e6e2_avoslocker_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-09_55ca57c96f10cbfb63d111669c93e6e2_avoslocker_revil.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Local\Temp\D68A.exe
      "C:\Users\Admin\AppData\Local\Temp\D68A.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Users\Admin\AppData\Local\Temp\1404521379.exe
        C:\Users\Admin\AppData\Local\Temp\1404521379.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1040
        • C:\Windows\sysvplervcs.exe
          C:\Windows\sysvplervcs.exe
          4⤵
          • Modifies security service
          • Windows security bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2348
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1144
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4896
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1640
            • C:\Windows\SysWOW64\sc.exe
              sc stop UsoSvc
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:392
            • C:\Windows\SysWOW64\sc.exe
              sc stop WaaSMedicSvc
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:2840
            • C:\Windows\SysWOW64\sc.exe
              sc stop wuauserv
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3092
            • C:\Windows\SysWOW64\sc.exe
              sc stop DoSvc
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:4464
            • C:\Windows\SysWOW64\sc.exe
              sc stop BITS /wait
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3056
          • C:\Users\Admin\AppData\Local\Temp\22226399.exe
            C:\Users\Admin\AppData\Local\Temp\22226399.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:744
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4400
              • C:\Windows\system32\reg.exe
                reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                7⤵
                  PID:3604
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3868
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /f /tn "Windows Upgrade Manager"
                  7⤵
                    PID:900
              • C:\Users\Admin\AppData\Local\Temp\592830483.exe
                C:\Users\Admin\AppData\Local\Temp\592830483.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4428

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\1[1]

        Filesize

        108KB

        MD5

        1fcb78fb6cf9720e9d9494c42142d885

        SHA1

        fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

        SHA256

        84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

        SHA512

        cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

      • C:\Users\Admin\AppData\Local\Temp\1404521379.exe

        Filesize

        96KB

        MD5

        930c41bc0c20865af61a95bcf0c3b289

        SHA1

        cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

        SHA256

        1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

        SHA512

        fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

      • C:\Users\Admin\AppData\Local\Temp\22226399.exe

        Filesize

        8KB

        MD5

        cb8420e681f68db1bad5ed24e7b22114

        SHA1

        416fc65d538d3622f5ca71c667a11df88a927c31

        SHA256

        5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

        SHA512

        baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

      • C:\Users\Admin\AppData\Local\Temp\592830483.exe

        Filesize

        15KB

        MD5

        0c37ee292fec32dba0420e6c94224e28

        SHA1

        012cbdddaddab319a4b3ae2968b42950e929c46b

        SHA256

        981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

        SHA512

        2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

      • C:\Users\Admin\AppData\Local\Temp\D68A.exe

        Filesize

        9KB

        MD5

        8d8e6c7952a9dc7c0c73911c4dbc5518

        SHA1

        9098da03b33b2c822065b49d5220359c275d5e94

        SHA256

        feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

        SHA512

        91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tepaodvn.fax.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\Montserrat-Regular.eot

        Filesize

        314KB

        MD5

        2dd0a1de870af34d48d43b7cad82b8d9

        SHA1

        440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e

        SHA256

        057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32

        SHA512

        83df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff

      • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\preloader.html

        Filesize

        687B

        MD5

        a9c237c6645d55240cdda002fef26737

        SHA1

        8a7f5c4cf2fd1c924dd1ec754b1b4c5f65bdda80

        SHA256

        0271d97e4e245364c5c52e66d95baf24b3e00c1c8ea6e2b0da59291115cb6087

        SHA512

        480f28bffb5cb96eaf89f601fbf2de03fc5db04f579108b60de1e5be36ede324fc924f624bc29b42747e96f173a860a6fdbaf6da271b6bffb5b7906d11065555

      • memory/744-97-0x0000000000A30000-0x0000000000A36000-memory.dmp

        Filesize

        24KB

      • memory/4896-57-0x000000006CEB0000-0x000000006CEFC000-memory.dmp

        Filesize

        304KB

      • memory/4896-72-0x0000000007460000-0x00000000074F6000-memory.dmp

        Filesize

        600KB

      • memory/4896-54-0x0000000005EA0000-0x0000000005EBE000-memory.dmp

        Filesize

        120KB

      • memory/4896-55-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

        Filesize

        304KB

      • memory/4896-56-0x0000000006480000-0x00000000064B2000-memory.dmp

        Filesize

        200KB

      • memory/4896-42-0x0000000005770000-0x00000000057D6000-memory.dmp

        Filesize

        408KB

      • memory/4896-67-0x0000000007070000-0x000000000708E000-memory.dmp

        Filesize

        120KB

      • memory/4896-68-0x00000000070A0000-0x0000000007143000-memory.dmp

        Filesize

        652KB

      • memory/4896-69-0x0000000007880000-0x0000000007EFA000-memory.dmp

        Filesize

        6.5MB

      • memory/4896-70-0x0000000007200000-0x000000000721A000-memory.dmp

        Filesize

        104KB

      • memory/4896-71-0x0000000007250000-0x000000000725A000-memory.dmp

        Filesize

        40KB

      • memory/4896-53-0x0000000005AC0000-0x0000000005E14000-memory.dmp

        Filesize

        3.3MB

      • memory/4896-73-0x00000000073F0000-0x0000000007401000-memory.dmp

        Filesize

        68KB

      • memory/4896-74-0x0000000007420000-0x000000000742E000-memory.dmp

        Filesize

        56KB

      • memory/4896-75-0x0000000007430000-0x0000000007444000-memory.dmp

        Filesize

        80KB

      • memory/4896-76-0x0000000007520000-0x000000000753A000-memory.dmp

        Filesize

        104KB

      • memory/4896-77-0x0000000007500000-0x0000000007508000-memory.dmp

        Filesize

        32KB

      • memory/4896-43-0x00000000057E0000-0x0000000005846000-memory.dmp

        Filesize

        408KB

      • memory/4896-41-0x0000000004E80000-0x0000000004EA2000-memory.dmp

        Filesize

        136KB

      • memory/4896-40-0x0000000004F10000-0x0000000005538000-memory.dmp

        Filesize

        6.2MB

      • memory/4896-39-0x00000000048A0000-0x00000000048D6000-memory.dmp

        Filesize

        216KB