3816c836b3af21fcc7f05a71ad13b17aaa110be1ecee68aa18c22bf9729bca48

Analysis

max time kernel
86s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20241007-es
resource tags

arch:x64arch:x86image:win11-20241007-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
10-11-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Phxnt0m-malware-main/Phxnt0mware RAT - main/tools/drawling_studio/studio.py
Size

10KB
MD5

a24896fbb917fd04864740c1cdabdcd5
SHA1

667029049d6fe3ea3850c0ec52fb99ab107b2809
SHA256

726f57a8c71ddcdb2217c88ac2c198624a3784b4ad94a68edb8c6c357d959d73
SHA512

3432639374ee3422a9ed026485c5de49ab61ef42d0b3a2730e383f623de0792e5e7631780c39e4ca9a32ceb11bc60ecb87834eda5f0a8eed1e7eb9e2fb5dfbe7
SSDEEP

192:1TZyX4iWGyKiCkfHQHZFHJS5CWf0nqeBZQXoNv7CiJX9CWv:1lE4iWGyKiCkfHQPJSHf0nq6ZQXozCil

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3608 OpenWith.exe

pid	process
3608	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Phxnt0m-malware-main\Phxnt0mware RAT - main\tools\drawling_studio\studio.py"
1⤵
- Modifies registry class
PID:1692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads