Behavioral task
behavioral1
Sample
e58916ea022411560a19b0e56234775f703a72959d0e6a69c5eab6e26764756e.exe
Resource
win7-20241023-en
General
-
Target
e58916ea022411560a19b0e56234775f703a72959d0e6a69c5eab6e26764756e
-
Size
31KB
-
MD5
43debf98fc1c322bfcf9780416bb9870
-
SHA1
ea11dbb236f540c12c89b912cdee346ad8b40fcb
-
SHA256
e58916ea022411560a19b0e56234775f703a72959d0e6a69c5eab6e26764756e
-
SHA512
99e87280dd0dc61f763deb8481b99800bd5ae62e0fea1bcf9c9c74736283871ce767869e5f02726caa9187acb9e0c375d1ff9e4a38fa8d73bd4e114942a41054
-
SSDEEP
768:Ie0FjkG2nBIdAOjm20DyXDabBJ3+seF7krPox:Ck7nZOjQDyza7eFWq
Malware Config
Extracted
phorphiex
http://185.215.113.93/
http://feedmefile.top/
http://gotsomefile.top/
http://gimmefile.top/
15DBeUGFSQLbpYvWLJwzHUXSRrHNU9uQuS8c2wvFLZ7Nxz3N
1E5ZxnNUbbGQarWjMA7tCwp3Btm38GvRkv
3AcMV5pSUcxMmmcMbfSkJXRKbCrF3ysUDJ
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
XkcKjKZqNUkChwJXMj5uDjDns6etXvakir
D7MYki8urW3xq8sZJ8Q2v2ZrHxjzp7ACvb
0x76e4CB2fcf7f931Fd750e93F443536Ee068d1cdE
LfYFvpk2hccXw12tN3BBMWh7EcUBMbKoTG
rUQFcff9R1eKAwTtR1wbuQxmcoB236mz44
TEUaG7jyXdyrDS3JeEg1w1hotmmEMjx4TB
t1gTRxsrEXwky32j22jgFRZAafBzmCV2M2V
AT5Vm3ZrUg98s9kBue2g9YjnwK4kFKhQw3
bitcoincash:qqucl3fev20z4upudppa8p5hd6j3zzgyfuwae00pfr
44L2q3sPJ3DMJZiuSpHvehHMLbMXx3SAoVbLm5DWDw1A7PhUvcCPAGg5qAN98DWAUG7CuD4WmydP4JkewTz2aeVd4qhS822
GBLUYL3QTKP3NXVWCYNZ7ZH4CWFT6PVCXEYCNUNSHM34WKG2UL5EDQMV
bnb154sx9pdh8er33ujxlpfk3zwvlfp9rd5rskvvgc
bc1qn4r93am7rxxr4a5dwydhwx0p2kd4xfd7mz42f3
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule sample family_phorphiex -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e58916ea022411560a19b0e56234775f703a72959d0e6a69c5eab6e26764756e
Files
-
e58916ea022411560a19b0e56234775f703a72959d0e6a69c5eab6e26764756e.exe windows:5 windows x86 arch:x86
fbe38eac33127c8216f939b478d0cb1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
wcscmp
wcslen
strchr
strcmp
_wfopen
fseek
ftell
fclose
srand
rand
mbstowcs
memset
_mbsstr
strlen
isalpha
isdigit
wininet
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileW
shlwapi
StrCmpNW
PathMatchSpecW
PathFileExistsW
PathFindFileNameW
PathFileExistsA
kernel32
CopyFileW
lstrcmpiW
CreateDirectoryW
FindFirstFileW
lstrcmpW
MoveFileExW
FindNextFileW
FindClose
SetFileAttributesW
GetLogicalDrives
GetDriveTypeW
QueryDosDeviceW
lstrcpyW
GetTickCount
ExpandEnvironmentStringsW
WriteFile
CreateFileW
GetFileSize
GetVolumeInformationW
GetModuleFileNameW
CreateProcessW
GetLocaleInfoA
CreateThread
CopyFileA
GetLastError
CreateMutexA
ExitProcess
DeleteFileA
MoveFileA
MoveFileW
GetModuleHandleA
RemoveDirectoryW
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
ExitThread
Sleep
SetEndOfFile
SetFilePointer
CloseHandle
UnmapViewOfFile
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GetStartupInfoA
user32
SetFocus
CloseWindow
SetForegroundWindow
ShowWindow
FindWindowA
wsprintfA
wsprintfW
GetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
SetClipboardData
advapi32
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptVerifySignatureA
CryptHashData
CryptCreateHash
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegSetValueExW
CryptDestroyKey
shell32
ShellExecuteW
ole32
CoInitializeEx
CoCreateInstance
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE