3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48

Analysis

max time kernel
91s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
10-11-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Phxnt0m-malware-main/Phxnt0mware RAT - main/resources/source_code/process.py
Size

18KB
MD5

c14ce0cb99efc40c6fbc634919ab27ef
SHA1

3b7b0e55a9f5cb9f8b2a5ed9d73f67884581f239
SHA256

9b77de8a32127a812aa3086a4192162463ec150df128d3da4cff6c2484f560ac
SHA512

b0e19ed71c3cb05eed311af13b02aa3b5ccff287f9871cc1448490b54ffb32a07bfddbcd9c36689fed4e954b3c67ca2ca6939495a6578f068ffb3bc34ac80d55
SSDEEP

192:qOeP15yK+nEXP0iq5f03ep0nqpxYDYl/TC/Y8EeepxYDYl/TCVYLJ0LeHe0F7Roj:bA1YEfXnC/TCp2/TCLUeF/TCO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4812 OpenWith.exe

pid	process
4812	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Phxnt0m-malware-main\Phxnt0mware RAT - main\resources\source_code\process.py"
1⤵
- Modifies registry class
PID:1488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads