Overview

overview

10

Static

static

3

2024-11-14...uk.exe

windows7-x64

10

2024-11-14...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14-11-2024 10:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-14_bebfd4dfaa73236ac92a8acbb322e3ff_cobalt-strike_hijackloader_ryuk.exe

  • Size

    4.7MB

  • MD5

    bebfd4dfaa73236ac92a8acbb322e3ff

  • SHA1

    ed4050809e09489962fd98762a8e468c145b59f2

  • SHA256

    b1c2ef39d20732dd1cacaa88637fd20c9ac3f1eb58463e6d6c722a4e8c2642f0

  • SHA512

    59137b676211de3e08f951f0b0de1262afe026e5ebd9a9f684191fa978f7691467381cfc7c98325e58b1005bb3c0014c3000a61ebe2566dd1232d8404500c77b

  • SSDEEP

    49152:Bz7rZIfffffffffWmvQi5e9ZyWNM4BKxvxNQQ7hJW6R0UklsBuVUiMFjfR2zediD:pVmMQK5JMFDgUnOF9

Score
10/10
phorphiexxmrigdiscoveryexecutionloaderminerpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
Attributes
  • mutex

    753f85d83d

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.66

http://185.215.113.84
Attributes
  • mutex

    Klipux

Signatures

  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 9 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\2024-11-14_bebfd4dfaa73236ac92a8acbb322e3ff_cobalt-strike_hijackloader_ryuk.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-11-14_bebfd4dfaa73236ac92a8acbb322e3ff_cobalt-strike_hijackloader_ryuk.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Users\Admin\AppData\Local\Temp\F853.exe
          "C:\Users\Admin\AppData\Local\Temp\F853.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Users\Admin\AppData\Local\Temp\2567515824.exe
            C:\Users\Admin\AppData\Local\Temp\2567515824.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2740
            • C:\Windows\sysnldcvmr.exe
              C:\Windows\sysnldcvmr.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2728
              • C:\Users\Admin\AppData\Local\Temp\1524831148.exe
                C:\Users\Admin\AppData\Local\Temp\1524831148.exe
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2180
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3052
                  • C:\Windows\system32\reg.exe
                    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                    8⤵
                      PID:1692
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3056
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /f /tn "Windows Upgrade Manager"
                      8⤵
                        PID:856
                  • C:\Users\Admin\AppData\Local\Temp\2257228946.exe
                    C:\Users\Admin\AppData\Local\Temp\2257228946.exe
                    6⤵
                    • Executes dropped EXE
                    PID:892
                  • C:\Users\Admin\AppData\Local\Temp\3321917675.exe
                    C:\Users\Admin\AppData\Local\Temp\3321917675.exe
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1792
                    • C:\Users\Admin\AppData\Local\Temp\2931911655.exe
                      C:\Users\Admin\AppData\Local\Temp\2931911655.exe
                      7⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2076
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1732
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2456
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
            2⤵
              PID:2612
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:928
              • C:\Windows\system32\schtasks.exe
                "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:916
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe
              2⤵
                PID:1676
              • C:\Windows\System32\dwm.exe
                C:\Windows\System32\dwm.exe
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2388
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {4688CA25-0FD5-4223-B656-437CC79C8230} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
              1⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:976
              • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                2⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:948

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\F853.exe
              Filesize

              9KB

              MD5

              8d8e6c7952a9dc7c0c73911c4dbc5518

              SHA1

              9098da03b33b2c822065b49d5220359c275d5e94

              SHA256

              feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

              SHA512

              91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
              Filesize

              7KB

              MD5

              807a8ae328288909fe33b8a79ec395e4

              SHA1

              f433b8114125004020d5a2ee5c242cc4b3b3acd5

              SHA256

              20d0ce68865b83df58aba1495b6be3413ad2f129d0ae1520800b7d9ce58e5b89

              SHA512

              3dd17ec85d79718c2054f0f75a8270468bb2127f8974f0bfed77cbd38567c4a9a72b9beb4223ee58d0de41e8c97f139a59ea264604bd299fb4822dc9cd555ec1

              Download Submit

            • \Users\Admin\AppData\Local\Temp\1524831148.exe
              Filesize

              8KB

              MD5

              cb8420e681f68db1bad5ed24e7b22114

              SHA1

              416fc65d538d3622f5ca71c667a11df88a927c31

              SHA256

              5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

              SHA512

              baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

              Download Submit

            • \Users\Admin\AppData\Local\Temp\2257228946.exe
              Filesize

              49KB

              MD5

              6946486673f91392724e944be9ca9249

              SHA1

              e74009983ced1fa683cda30b52ae889bc2ca6395

              SHA256

              885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

              SHA512

              e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

              Download Submit

            • \Users\Admin\AppData\Local\Temp\2567515824.exe
              Filesize

              79KB

              MD5

              0c883b1d66afce606d9830f48d69d74b

              SHA1

              fe431fe73a4749722496f19b3b3ca0b629b50131

              SHA256

              d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

              SHA512

              c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

              Download Submit

            • \Users\Admin\AppData\Local\Temp\2931911655.exe
              Filesize

              5.6MB

              MD5

              13b26b2c7048a92d6a843c1302618fad

              SHA1

              89c2dfc01ac12ef2704c7669844ec69f1700c1ca

              SHA256

              1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

              SHA512

              d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

              Download Submit

            • \Users\Admin\AppData\Local\Temp\3321917675.exe
              Filesize

              10KB

              MD5

              96509ab828867d81c1693b614b22f41d

              SHA1

              c5f82005dbda43cedd86708cc5fc3635a781a67e

              SHA256

              a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

              SHA512

              ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

              Download Submit

            • memory/928-74-0x0000000002330000-0x0000000002338000-memory.dmp

              Filesize

              32KB

              Download

            • memory/928-73-0x000000001B0C0000-0x000000001B3A2000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/948-79-0x000000013F7F0000-0x000000013FD87000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/1676-83-0x0000000140000000-0x0000000140029000-memory.dmp

              Filesize

              164KB

              Download

            • memory/1676-81-0x0000000140000000-0x0000000140029000-memory.dmp

              Filesize

              164KB

              Download

            • memory/1732-59-0x0000000001F00000-0x0000000001F08000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1732-58-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/2076-62-0x000000013F7C0000-0x000000013FD57000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/2180-32-0x000000013FA60000-0x000000013FA66000-memory.dmp

              Filesize

              24KB

              Download

            • memory/2388-82-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-80-0x00000000000B0000-0x00000000000D0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2388-84-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-86-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-88-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-90-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-102-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-104-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download

            • memory/2388-106-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

              Download