phorphiex | e0fa830fae317de959f388ef4c8ae19c38bb7ddbd9ab95ed76d56a1838e8b5c2

General

Target

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
Size

30KB
MD5

6a702ef477c5006b5a8f98ac6d10d4b2
SHA1

1698df30c71382a2d14b56d5047ce4ef8db4eb54
SHA256

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1
SHA512

3ff2bbcdf8b6eac5e6e513973309e096be857f90542ee1c79c50ef789fd207fc65c99f5daacd91f63745f05ad496ea483ada981427991563ef3364ccb4becf2c
SSDEEP

384:PtkpcwLsYEaysekAM1PsLwApaKZ5IRvKztY2Gci0WhYzJjn2Cb1Bg3cW53Yllyt3:PAAxPuPsLwA9ZuYztzYhY0oBEcWGl

Score

10^/10

phorphiex discovery evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://b0t.to/

http://gshrghirhgsgrao.to/

http://hehfaofiehgggao.to/

http://soghrrsoeuhugao.to/

http://eiiiaoihoaeruao.to/

http://roiriorisioroao.to/

http://ouhgousgoahutao.to/

http://oeoaoueuoeuoaao.to/

http://aiaizzzezeezeao.to/

http://ouauooaoaoeeuao.to/

http://oeeoeuueueuueao.to/

http://eobbeaubfeuueao.to/

http://aauaaaeieiieeao.to/

http://aaaeieiiiofffao.to/

http://infineinfinigao.to/

http://baoefubfbfigoao.to/

http://aaauuwiifoogeao.to/

http://plporsiszsgetao.to/

http://gshrghirhgsgrla.co/

http://hehfaofiehgggla.co/

Wallets

1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh

qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0xa5228127395263575a4b4f532e4f132b14599d24

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

syszubb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	syszubb.exe

Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\2010525289\syszubb.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

syszubb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syszubb.exe

Executes dropped EXE 1 IoCs

Processes:

syszubb.exe

pid process

2960 syszubb.exe
Loads dropped DLL 4 IoCs

Processes:

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exeWerFault.exe

pid process

2396 980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
1892 WerFault.exe
1892 WerFault.exe
1892 WerFault.exe

pid	process
2960	syszubb.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

syszubb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syszubb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syszubb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Operating System = "C:\\Windows\\2010525289\\syszubb.exe"	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Operating System = "C:\\Windows\\2010525289\\syszubb.exe"	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

Drops file in Windows directory 3 IoCs

Processes:

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

description	ioc	process
File created	C:\Windows\2010525289\syszubb.exe	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
File opened for modification	C:\Windows\2010525289\syszubb.exe	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
File opened for modification	C:\Windows\2010525289	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1892 2960 WerFault.exe syszubb.exe

pid	pid_target	process	target process
1892	2960	WerFault.exe	syszubb.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

syszubb.exe980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syszubb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exesyszubb.exe

pid	process
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe
2960	syszubb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exesyszubb.exe

description	pid	process
Token: SeDebugPrivilege	2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
Token: SeDebugPrivilege	2960	syszubb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exesyszubb.exe

description	pid	process	target process
PID 2396 wrote to memory of 2960	2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe	syszubb.exe
PID 2396 wrote to memory of 2960	2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe	syszubb.exe
PID 2396 wrote to memory of 2960	2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe	syszubb.exe
PID 2396 wrote to memory of 2960	2396	980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe	syszubb.exe
PID 2960 wrote to memory of 1892	2960	syszubb.exe	WerFault.exe
PID 2960 wrote to memory of 1892	2960	syszubb.exe	WerFault.exe
PID 2960 wrote to memory of 1892	2960	syszubb.exe	WerFault.exe
PID 2960 wrote to memory of 1892	2960	syszubb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
"C:\Users\Admin\AppData\Local\Temp\980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\2010525289\syszubb.exe
  C:\Windows\2010525289\syszubb.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 580
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1892

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\2010525289\syszubb.exe

Filesize
30KB

MD5
6a702ef477c5006b5a8f98ac6d10d4b2

SHA1
1698df30c71382a2d14b56d5047ce4ef8db4eb54

SHA256
980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1

SHA512
3ff2bbcdf8b6eac5e6e513973309e096be857f90542ee1c79c50ef789fd207fc65c99f5daacd91f63745f05ad496ea483ada981427991563ef3364ccb4becf2c

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads