Overview
overview
10Static
static
7PhoenixC2-main.zip
windows10-ltsc 2021-x64
10PhoenixC2-...rk.dll
windows10-ltsc 2021-x64
1PhoenixC2-...ys.dll
windows10-ltsc 2021-x64
1PhoenixC2-...64.dll
windows10-ltsc 2021-x64
1PhoenixC2-...tm.dll
windows10-ltsc 2021-x64
3PhoenixC2-...PS.dll
windows10-ltsc 2021-x64
1PhoenixC2-...ts.dll
windows10-ltsc 2021-x64
1PhoenixC2-...ts.pdb
windows10-ltsc 2021-x64
3PhoenixC2-...C2.exe
windows10-ltsc 2021-x64
10PhoenixC2-...DME.md
windows10-ltsc 2021-x64
3Analysis
-
max time kernel
74s -
max time network
75s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
13-01-2025 02:41
Behavioral task
behavioral1
Sample
PhoenixC2-main.zip
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
PhoenixC2-main/DrakeUI.Framework.dll
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
PhoenixC2-main/GeoIPCitys.dll
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
PhoenixC2-main/HVMRun64.dll
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
PhoenixC2-main/HVMRuntm.dll
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
PhoenixC2-main/LiveCharts.MAPS.dll
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
PhoenixC2-main/LiveCharts.dll
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
PhoenixC2-main/LiveCharts.pdb
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
PhoenixC2-main/PhoenixC2.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
5 signatures
900 seconds
Behavioral task
behavioral10
Sample
PhoenixC2-main/README.md
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
3 signatures
900 seconds
General
-
Target
PhoenixC2-main.zip
-
Size
6.8MB
-
MD5
767721f2bb542638e90ce369b07067e0
-
SHA1
ced60d212b9f2a154eba8cb08681ab80dd8d5f2e
-
SHA256
e441d90716cf4bcb4e180616193e4b69cd090757ed5ead4bef6b8f003ed25781
-
SHA512
e841ac0eac63906353dd5d011d6117a016dfa57e1ba229d0748a1468b604150e61724f18cb767ebf1c9a526578ade1b6160e860a703e67e4f24e8b02ee6f3de8
-
SSDEEP
196608:vq2Com15bpXRCX2Xmb8jYYr3t/WaEbfUogn/M2fd:2rNXRW2XOWvrd/WaEDUoSNd
Malware Config
Extracted
Family
lumma
C2
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
Signatures
-
Lumma family
-
Executes dropped EXE 15 IoCs
pid Process 384 PhoenixC2.exe 3952 PhoenixC2.exe 3792 PhoenixC2.exe 960 PhoenixC2.exe 4932 PhoenixC2.exe 1424 PhoenixC2.exe 3772 PhoenixC2.exe 4280 PhoenixC2.exe 4260 PhoenixC2.exe 1940 PhoenixC2.exe 2904 PhoenixC2.exe 2324 PhoenixC2.exe 4668 PhoenixC2.exe 1520 PhoenixC2.exe 1868 PhoenixC2.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 384 set thread context of 4932 384 PhoenixC2.exe 101 PID 1424 set thread context of 3772 1424 PhoenixC2.exe 104 PID 4280 set thread context of 4260 4280 PhoenixC2.exe 107 PID 1940 set thread context of 2904 1940 PhoenixC2.exe 110 PID 2324 set thread context of 4668 2324 PhoenixC2.exe 113 PID 1520 set thread context of 1868 1520 PhoenixC2.exe 116 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PhoenixC2.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1448 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 1448 7zFM.exe Token: 35 1448 7zFM.exe Token: SeSecurityPrivilege 1448 7zFM.exe Token: SeSecurityPrivilege 1448 7zFM.exe Token: SeSecurityPrivilege 1448 7zFM.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe 1448 7zFM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 384 wrote to memory of 3952 384 PhoenixC2.exe 98 PID 384 wrote to memory of 3952 384 PhoenixC2.exe 98 PID 384 wrote to memory of 3952 384 PhoenixC2.exe 98 PID 384 wrote to memory of 3792 384 PhoenixC2.exe 99 PID 384 wrote to memory of 3792 384 PhoenixC2.exe 99 PID 384 wrote to memory of 3792 384 PhoenixC2.exe 99 PID 384 wrote to memory of 960 384 PhoenixC2.exe 100 PID 384 wrote to memory of 960 384 PhoenixC2.exe 100 PID 384 wrote to memory of 960 384 PhoenixC2.exe 100 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 384 wrote to memory of 4932 384 PhoenixC2.exe 101 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 1424 wrote to memory of 3772 1424 PhoenixC2.exe 104 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 4280 wrote to memory of 4260 4280 PhoenixC2.exe 107 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1940 wrote to memory of 2904 1940 PhoenixC2.exe 110 PID 1448 wrote to memory of 2324 1448 7zFM.exe 111 PID 1448 wrote to memory of 2324 1448 7zFM.exe 111 PID 1448 wrote to memory of 2324 1448 7zFM.exe 111 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 2324 wrote to memory of 4668 2324 PhoenixC2.exe 113 PID 1448 wrote to memory of 1520 1448 7zFM.exe 114 PID 1448 wrote to memory of 1520 1448 7zFM.exe 114
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PhoenixC2-main.zip"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\7zO8A5785A8\PhoenixC2.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A5785A8\PhoenixC2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7zO8A5785A8\PhoenixC2.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A5785A8\PhoenixC2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4668
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO8A5D3798\PhoenixC2.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A5D3798\PhoenixC2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\7zO8A5D3798\PhoenixC2.exe"C:\Users\Admin\AppData\Local\Temp\7zO8A5D3798\PhoenixC2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4692
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
PID:3952
-
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
PID:3792
-
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
PID:960
-
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932
-
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3772
-
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260
-
-
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"C:\Users\Admin\Downloads\PhoenixC2-main\PhoenixC2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
393KB
MD53c4161be295e9e9d019ce68dae82d60a
SHA136447fc6418e209dff1bb8a5e576f4d46e3b3296
SHA2560f6481dabf7871823f259eb95f3b85c37d1de8a7d1884ac77a97d887cf96f75d
SHA512cfa2d491a5d28beb8eb908d5af61254ac4c4c88e74c53d5d00ae15ef0731df1654304199996545d1074814c0ea8a032957b28d70774f05347616428e667f70e6