General

  • Target

    syscceb.exe

  • Size

    480KB

  • Sample

    241206-l78d5ayjbr

  • MD5

    34e58603627f492a9602130f25025f96

  • SHA1

    ded14cfd26427f6d57721560f90fbbd288a98551

  • SHA256

    80a2f5e6f0d6e2577808ccd5b850ddb8703573422fe72539c344bcc16f82e4df

  • SHA512

    b0938c35699021b67d4f44acca6417c0fe4404aa8e190689d080ecb7381825053d7e5151cc1c7575e5cc3cc27207545ed2a6c5a325bfa1d377aad468e3dd28fe

  • SSDEEP

    12288:ziTWzHoGfF4MRqtg681Xb7nEyOX6JryOAxAa:zvfF4K7D53nyX6S5

Malware Config

Extracted

Family

phorphiex

C2

http://185.176.27.132/

http://urusurofhsorhfuuhk.su/

http://aeifaeifhutuhuhusk.su/

http://rzhsudhugugfugugsk.su/

http://bfagzzezgaegzgfaik.su/

http://eaeuafhuaegfugeudk.su/

http://aeufuaehfiuehfuhfk.su/

http://daedagheauehfuuhfk.su/

http://aeoughaoheguaoehdk.su/

http://eguaheoghouughahsk.su/

http://huaeokaefoaeguaehk.su/

http://afaeigaifgsgrhhafk.su/

http://afaigaeigieufuifik.su/

http://geauhouefheuutiiik.su/

http://gaoheeuofhefefhutk.su/

http://gaouehaehfoaeajrsk.su/

http://gaohrhurhuhruhfsdk.su/

http://gaghpaheiafhjefijk.su/

http://gaoehuoaoefhuhfugk.su/

http://aegohaohuoruitiiek.su/

Wallets

13cQ2H6oszrEnvw1ZGdsPix9gUayB8tzNa

qr5pm4d27z250wpz4sfy08ytghxn56kryvsw5tdw99

XfrM8P9YWSg8mQTxSCCxyHUeQjMEGx8vnE

DSG5PddW9wu1eKdLcx4f3KBF4wUvaBFaGc

0x373b9854c9e4511b920372f5495640cdc25d6832

LSermtCTLWeS683x17AtYuhNT8MpMmVmi8

t1XgRHyGj6YDNqkS5EWwdcXG1rjQPFFdUsR

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Targets

    • Target

      syscceb.exe

    • Size

      480KB

    • MD5

      34e58603627f492a9602130f25025f96

    • SHA1

      ded14cfd26427f6d57721560f90fbbd288a98551

    • SHA256

      80a2f5e6f0d6e2577808ccd5b850ddb8703573422fe72539c344bcc16f82e4df

    • SHA512

      b0938c35699021b67d4f44acca6417c0fe4404aa8e190689d080ecb7381825053d7e5151cc1c7575e5cc3cc27207545ed2a6c5a325bfa1d377aad468e3dd28fe

    • SSDEEP

      12288:ziTWzHoGfF4MRqtg681Xb7nEyOX6JryOAxAa:zvfF4K7D53nyX6S5

    • Modifies Windows Defender Real-time Protection settings

    • Phorphiex family

    • Phorphiex payload

    • Phorphiex, Phorpiex

      Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Windows security bypass

    • Windows security modification

MITRE ATT&CK Enterprise v15

Tasks