phorphiex | f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

General

Target

f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
Size

215KB
MD5

ab97f71125a89d4d3d0855b8a419d3e1
SHA1

2442d4a7cfbe7fd22708034c853faf9aa4337907
SHA256

f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066
SHA512

5abcab63f953a04d4c4a0eeb38f1716003fdecd2a8b465687e39f5bd492efe587bff06fedcc0724246f59a0b1e799765a6e49169b17728960c2cb066236f6038
SSDEEP

3072:krVZV7IFJc/+mKda7FpoXaoxRypPzB1DuFYJPrbLxYpj5S3BugoIvc/:krNEFJndso2vD3RrbLxYpj5gRy

Score

10^/10

phorphiex discovery evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.176.27.132/

http://urusurofhsorhfuuhp.su/

http://aeifaeifhutuhuhusp.su/

http://rzhsudhugugfugugsp.su/

http://bfagzzezgaegzgfaip.su/

http://eaeuafhuaegfugeudp.su/

http://aeufuaehfiuehfuhfp.su/

http://daedagheauehfuuhfp.su/

http://aeoughaoheguaoehdp.su/

http://eguaheoghouughahsp.su/

http://huaeokaefoaeguaehp.su/

http://afaeigaifgsgrhhafp.su/

http://afaigaeigieufuifip.su/

http://geauhouefheuutiiip.su/

http://gaoheeuofhefefhutp.su/

http://gaouehaehfoaeajrsp.su/

http://gaohrhurhuhruhfsdp.su/

http://gaghpaheiafhjefijp.su/

http://gaoehuoaoefhuhfugp.su/

http://aegohaohuoruitiiep.su/

Wallets

19mduWVW9QphW5W2caWF84wcGVSmASRYpf

qp5d3zpgldngtzf0xg2swnqaedfhn3kmsyhk7kp0yt

Xj2EfZ34QwSskhx4aRjWjGpLpMgNQWgYeV

DRkCr8Qum86fMBT3ceyzYBAGzD8pbRZmba

0xab1b250d67d08bf73ac864ea57af8cf762a29649

LVvqtuuqxcPbmqZ7VQju6kFTmQKZ58yXH2

t1dWznNU9rPvPLhmgUQTivyFYmCk4FhDKRc

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	sysekrc.exe

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

resource	yara_rule
behavioral1/memory/2388-3-0x0000000000460000-0x000000000046A000-memory.dmp	family_phorphiex
behavioral1/memory/2264-16-0x0000000000320000-0x000000000032A000-memory.dmp	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysekrc.exe

Executes dropped EXE 1 IoCs

pid	Process
2264	sysekrc.exe

Loads dropped DLL 2 IoCs

pid	Process
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysekrc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysekrc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\263721518\\sysekrc.exe"	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\263721518\\sysekrc.exe"	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\263721518\sysekrc.exe	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
File opened for modification	C:\Windows\263721518\sysekrc.exe	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
File opened for modification	C:\Windows\263721518	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysekrc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe
2264	sysekrc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
Token: SeDebugPrivilege	2264	sysekrc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2264	2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe	31
PID 2388 wrote to memory of 2264	2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe	31
PID 2388 wrote to memory of 2264	2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe	31
PID 2388 wrote to memory of 2264	2388	f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe	31

C:\Users\Admin\AppData\Local\Temp\f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe
"C:\Users\Admin\AppData\Local\Temp\f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\263721518\sysekrc.exe
  C:\Windows\263721518\sysekrc.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\263721518\sysekrc.exe

Filesize
215KB

MD5
ab97f71125a89d4d3d0855b8a419d3e1

SHA1
2442d4a7cfbe7fd22708034c853faf9aa4337907

SHA256
f4909c420e208e4728116e8b0f4254c9f741d864f9618cddbe3f51b71f602066

SHA512
5abcab63f953a04d4c4a0eeb38f1716003fdecd2a8b465687e39f5bd492efe587bff06fedcc0724246f59a0b1e799765a6e49169b17728960c2cb066236f6038

Download Submit
memory/2264-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2264-16-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2388-1-0x0000000000413000-0x000000000041C000-memory.dmp

Filesize
36KB

Download
memory/2388-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2388-3-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/2388-4-0x0000000000413000-0x000000000041C000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads