phorphiex | 7a9e806b9ab83059465a45e4a5ef4027a551f433682e0e124f9ddde891c41321

General

Target

sysbybt.exe
Size

480KB
MD5

3282f6c806a89359ec94f287cf6c699c
SHA1

c21f0c289d247a5b8cf2526d09d2d443a1068704
SHA256

64d187bed40d023e14d41b1a80d528f5c12dcf743fcb4de91530567d3244e09e
SHA512

88b3edd6865e4bb5ca2ba931c39f33ce0bc1363a694426115c489d85ee043ae28842785aafe1147fcc79d5c1644295794fa38c5a399fb4b27bc85327898f0185
SSDEEP

12288:8oNcRxBnd9Zf/Y0wZB64czrTRUIFUNCY+8HX:4Lnd9Zf/05cfyIFU/

Score

10^/10

phorphiex discovery evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://b0t.to/

http://gshrghirhgsgrao.to/

http://hehfaofiehgggao.to/

http://soghrrsoeuhugao.to/

http://eiiiaoihoaeruao.to/

http://roiriorisioroao.to/

http://ouhgousgoahutao.to/

http://oeoaoueuoeuoaao.to/

http://aiaizzzezeezeao.to/

http://ouauooaoaoeeuao.to/

http://oeeoeuueueuueao.to/

http://eobbeaubfeuueao.to/

http://aauaaaeieiieeao.to/

http://aaaeieiiiofffao.to/

http://infineinfinigao.to/

http://baoefubfbfigoao.to/

http://aaauuwiifoogeao.to/

http://plporsiszsgetao.to/

http://gshrghirhgsgrla.co/

http://hehfaofiehgggla.co/

Wallets

1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh

qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0xa5228127395263575a4b4f532e4f132b14599d24

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sysbybt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sysbybt.exe

Phorphiex payload 3 IoCs

resource	yara_rule
behavioral1/memory/2368-2-0x00000000002E0000-0x00000000002EB000-memory.dmp	family_phorphiex
behavioral1/memory/2368-20-0x00000000002E0000-0x00000000002EB000-memory.dmp	family_phorphiex
behavioral1/files/0x0006000000018c31-114.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysbybt.exe

Executes dropped EXE 2 IoCs

pid	Process
2976	21484.exe
1908	sysblvrvcr.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	sysbybt.exe
2368	sysbybt.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysbybt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysbybt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysblvrvcr.exe"	21484.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysblvrvcr.exe	21484.exe
File opened for modification	C:\Windows\sysblvrvcr.exe	21484.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysbybt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysblvrvcr.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe
2368	sysbybt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	sysbybt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2368	sysbybt.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2976	2368	sysbybt.exe	31
PID 2368 wrote to memory of 2976	2368	sysbybt.exe	31
PID 2368 wrote to memory of 2976	2368	sysbybt.exe	31
PID 2368 wrote to memory of 2976	2368	sysbybt.exe	31
PID 2976 wrote to memory of 1908	2976	21484.exe	32
PID 2976 wrote to memory of 1908	2976	21484.exe	32
PID 2976 wrote to memory of 1908	2976	21484.exe	32
PID 2976 wrote to memory of 1908	2976	21484.exe	32

C:\Users\Admin\AppData\Local\Temp\sysbybt.exe
"C:\Users\Admin\AppData\Local\Temp\sysbybt.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\21484.exe
  C:\Users\Admin\AppData\Local\Temp\21484.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\sysblvrvcr.exe
    C:\Windows\sysblvrvcr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\2[1]

Filesize
8KB

MD5
39f45edb23427ebf63197ca138ddb282

SHA1
4be1b15912c08f73687c0e4c74af0979c17ff7d5

SHA256
77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

SHA512
410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

Download Submit
\Users\Admin\AppData\Local\Temp\21484.exe

Filesize
107KB

MD5
f437204b3e1627d8b03eefdf360281ad

SHA1
c824e787a9786d5fdd19effdec54abef217e5b39

SHA256
d4bbc125a9e94de44f4deea9d6b10adc87a1ec1aedd753b39d26bb15817fdadb

SHA512
bdb6fc7d1e7f61df6a7ff3036fd56793e1096937fb07fbe033692f20de1bc81ca0215c5eff5a21627607c1ca514296d9598490c244bba5ec60c74653e1978910

Download Submit
memory/2368-1-0x0000000000458000-0x000000000045E000-memory.dmp

Filesize
24KB

Download
memory/2368-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2368-3-0x0000000000458000-0x000000000045E000-memory.dmp

Filesize
24KB

Download
memory/2368-2-0x00000000002E0000-0x00000000002EB000-memory.dmp

Filesize
44KB

Download
memory/2368-20-0x00000000002E0000-0x00000000002EB000-memory.dmp

Filesize
44KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads