| File name: | VolDriver.exe |
| Full analysis: | https://app.any.run/tasks/19d79618-982f-4594-a36f-313b120ea6c9 |
| Verdict: | Malicious activity |
| Threats: | Phorpiex is a malicious software that has been a significant threat in the cybersecurity landscape since 2016. It is a modular malware known for its ability to maintain an extensive botnet. Unlike other botnets, Phorpiex does not concentrate on DDoS attacks. Instead, it has been involved in numerous large-scale spam email campaigns and the distribution of other malicious payloads, such as LockBit. |
| Analysis date: | September 17, 2024, 13:39:05 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | E3FB1EB78C7E953D76DE0B973E069D16 |
| SHA1: | 613B6A678C28AE0291865739C7DEEEA4923B52C5 |
| SHA256: | 4B355796A710BEC51E37958A39CA0FB28F462F80B15B3E42162BF47CDF0FCA79 |
| SSDEEP: | 3072:5jKXgtOA6UplhQpgJNj846xbjq4KLooLaebKektovo/930o9iYYUl8SEynRH2Vtl:35tF |
MALICIOUS
PHORPIEX has been detected (SURICATA)
- wdrvmgrmp.exe (PID: 3240)
Connects to the CnC server
- wdrvmgrmp.exe (PID: 3240)
SUSPICIOUS
Connects to unusual port
- wdrvmgrmp.exe (PID: 3240)
Starts itself from another location
- VolDriver.exe (PID: 4052)
Executable content was dropped or overwritten
- VolDriver.exe (PID: 4052)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:11:04 19:45:48+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 56832 |
| InitializedDataSize: | 20992 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x59a0 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 980 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2472 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3240 | C:\Users\admin\wdrvmgrmp.exe | C:\Users\admin\wdrvmgrmp.exe | VolDriver.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 4052 | "C:\Users\admin\Desktop\VolDriver.exe" | C:\Users\admin\Desktop\VolDriver.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
2 386
Read events
2 350
Write events
30
Delete events
6
Modification events
| (PID) Process: | (4052) VolDriver.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Microsoft Windows Update Service |
Value: C:\Users\admin\wdrvmgrmp.exe | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | FirewallOverride |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | FirewallDisableNotify |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | AntiSpywareOverride |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | AntiVirusOverride |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | AntiVirusDisableNotify |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | UpdatesOverride |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center |
| Operation: | write | Name: | UpdatesDisableNotify |
Value: 1 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3240) wdrvmgrmp.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyServer |
Value: | |||
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3240 | wdrvmgrmp.exe | C:\Users\admin\nodesinfo.dat | binary | |
MD5:D0A23C41F683A5A9FF82570EC37F2D53 | SHA256:28BD25040E27F081D2A3DD84258CA0D67043E63465DE00904B2A1EFE069DEF25 | |||
| 4052 | VolDriver.exe | C:\Users\admin\wdrvmgrmp.exe | executable | |
MD5:E3FB1EB78C7E953D76DE0B973E069D16 | SHA256:4B355796A710BEC51E37958A39CA0FB28F462F80B15B3E42162BF47CDF0FCA79 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
18
DNS requests
2
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3240 | wdrvmgrmp.exe | GET | 404 | 185.215.113.84:80 | http://185.215.113.84/1 | unknown | — | — | unknown |
3240 | wdrvmgrmp.exe | GET | 404 | 185.215.113.84:80 | http://185.215.113.84/3 | unknown | — | — | unknown |
3240 | wdrvmgrmp.exe | GET | 404 | 185.215.113.84:80 | http://185.215.113.84/2 | unknown | — | — | unknown |
3240 | wdrvmgrmp.exe | GET | 404 | 185.215.113.84:80 | http://185.215.113.84/4 | unknown | — | — | unknown |
3240 | wdrvmgrmp.exe | GET | 404 | 185.215.113.84:80 | http://185.215.113.84/6 | unknown | — | — | unknown |
3240 | wdrvmgrmp.exe | GET | 404 | 185.215.113.84:80 | http://185.215.113.84/5 | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
3240 | wdrvmgrmp.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3240 | wdrvmgrmp.exe | 20.72.235.82:80 | www.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3240 | wdrvmgrmp.exe | 185.215.113.84:80 | — | 1337team Limited | SC | unknown |
3240 | wdrvmgrmp.exe | 42.248.182.188:40555 | — | Chinanet | CN | unknown |
3240 | wdrvmgrmp.exe | 87.237.236.124:40555 | — | — | — | unknown |
3240 | wdrvmgrmp.exe | 42.248.183.34:40555 | — | — | — | unknown |
3240 | wdrvmgrmp.exe | 213.230.121.128:40555 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
www.update.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3240 | wdrvmgrmp.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 32 |
6 ETPRO signatures available at the full report