File name:

VolDriver.exe

Full analysis: https://app.any.run/tasks/66f878e0-b1c8-46f1-9f83-4a10e1f81eb3
Verdict: Malicious activity
Threats:

Phorpiex is a malicious software that has been a significant threat in the cybersecurity landscape since 2016. It is a modular malware known for its ability to maintain an extensive botnet. Unlike other botnets, Phorpiex does not concentrate on DDoS attacks. Instead, it has been involved in numerous large-scale spam email campaigns and the distribution of other malicious payloads, such as LockBit.

Malware Trends Tracker     >>>
Analysis date: November 13, 2023, 16:07:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phorpiex
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E3FB1EB78C7E953D76DE0B973E069D16

SHA1:

613B6A678C28AE0291865739C7DEEEA4923B52C5

SHA256:

4B355796A710BEC51E37958A39CA0FB28F462F80B15B3E42162BF47CDF0FCA79

SSDEEP:

3072:5jKXgtOA6UplhQpgJNj846xbjq4KLooLaebKektovo/930o9iYYUl8SEynRH2Vtl:35tF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VolDriver.exe (PID: 3212)

    • PHORPIEX has been detected (SURICATA)

      • wdrvmgrmp.exe (PID: 3456)

    • Connects to the CnC server

      • wdrvmgrmp.exe (PID: 3456)

  • SUSPICIOUS

    • Starts itself from another location

      • VolDriver.exe (PID: 3212)

    • Reads the Internet Settings

      • wdrvmgrmp.exe (PID: 3456)

    • Connects to the server without a host name

      • wdrvmgrmp.exe (PID: 3456)

    • Connects to unusual port

      • wdrvmgrmp.exe (PID: 3456)

  • INFO

    • Checks supported languages

      • wdrvmgrmp.exe (PID: 3456)
      • VolDriver.exe (PID: 3212)
      • wmpnscfg.exe (PID: 3420)
      • wmpnscfg.exe (PID: 3752)

    • Checks proxy server information

      • wdrvmgrmp.exe (PID: 3456)

    • Reads the computer name

      • wdrvmgrmp.exe (PID: 3456)
      • wmpnscfg.exe (PID: 3420)
      • wmpnscfg.exe (PID: 3752)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3420)
      • wmpnscfg.exe (PID: 3752)

    • Creates files or folders in the user directory

      • wdrvmgrmp.exe (PID: 3456)

    • Reads the machine GUID from the registry

      • wdrvmgrmp.exe (PID: 3456)
      • wmpnscfg.exe (PID: 3420)
      • wmpnscfg.exe (PID: 3752)

    • Create files in a temporary directory

      • wdrvmgrmp.exe (PID: 3456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:11:04 20:45:48+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 56832
InitializedDataSize: 20992
UninitializedDataSize: -
EntryPoint: 0x59a0
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start voldriver.exe no specs #PHORPIEX wdrvmgrmp.exe wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Users\admin\AppData\Local\Temp\VolDriver.exe" C:\Users\admin\AppData\Local\Temp\VolDriver.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\voldriver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3420"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3456C:\Users\admin\wdrvmgrmp.exeC:\Users\admin\wdrvmgrmp.exe
VolDriver.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\wdrvmgrmp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3752"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
3 693
Read events
3 675
Write events
12
Delete events
6

Modification events

(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3456) wdrvmgrmp.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3420) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{BB6EAEF5-962A-4FD4-8302-702E16BA500A}\{4B7F9FC5-C620-4B99-90AD-FAB842384872}
Operation:delete keyName:(default)
Value:
(PID) Process:(3420) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{BB6EAEF5-962A-4FD4-8302-702E16BA500A}
Operation:delete keyName:(default)
Value:
Executable files
1
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3456wdrvmgrmp.exeC:\Users\admin\nodesinfo.datbinary
MD5:E8E3AAFD3E8EA93F440080F4FD11FE3F
SHA256:D3C35008CC636DA680F32372050A2C77DB2A7A1096E15A1AB5927EA091A78B42
3212VolDriver.exeC:\Users\admin\wdrvmgrmp.exeexecutable
MD5:E3FB1EB78C7E953D76DE0B973E069D16
SHA256:4B355796A710BEC51E37958A39CA0FB28F462F80B15B3E42162BF47CDF0FCA79
3456wdrvmgrmp.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\1[1]binary
MD5:3CB366F6BD08BFFA76A628DF69887ADE
SHA256:88AAF8DD8523CDC461D94385921E98B97823C145DC9D2BFDE9342577CBF49C21
3456wdrvmgrmp.exeC:\Users\admin\AppData\Local\Temp\2917139678.exebinary
MD5:3CB366F6BD08BFFA76A628DF69887ADE
SHA256:88AAF8DD8523CDC461D94385921E98B97823C145DC9D2BFDE9342577CBF49C21
3456wdrvmgrmp.exeC:\Users\admin\AppData\Local\Temp\1461636097.exebinary
MD5:3CB366F6BD08BFFA76A628DF69887ADE
SHA256:88AAF8DD8523CDC461D94385921E98B97823C145DC9D2BFDE9342577CBF49C21
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
46
DNS requests
5
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3456
wdrvmgrmp.exe
GET
—
185.215.113.84:80
http://185.215.113.84/1
unknown
—
—
unknown
3456
wdrvmgrmp.exe
GET
200
185.215.113.84:80
http://185.215.113.84/1
unknown
binary
23.2 Kb
unknown
3456
wdrvmgrmp.exe
GET
404
185.215.113.84:80
http://185.215.113.84/4
unknown
html
564 b
unknown
3456
wdrvmgrmp.exe
GET
404
185.215.113.84:80
http://185.215.113.84/3
unknown
html
564 b
unknown
3456
wdrvmgrmp.exe
GET
404
185.215.113.84:80
http://185.215.113.84/6
unknown
html
564 b
unknown
3456
wdrvmgrmp.exe
GET
404
185.215.113.84:80
http://185.215.113.84/5
unknown
html
564 b
unknown
3456
wdrvmgrmp.exe
GET
404
185.215.113.84:80
http://185.215.113.84/2
unknown
html
564 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
3456
wdrvmgrmp.exe
20.72.235.82:80
www.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3456
wdrvmgrmp.exe
185.215.113.84:80
—
1337team Limited
SC
unknown
868
svchost.exe
23.218.208.137:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
3456
wdrvmgrmp.exe
239.255.255.250:1900
—
—
—
whitelisted
3456
wdrvmgrmp.exe
2.177.43.194:40555
—
Iran Telecommunication Company PJS
IR
unknown
3456
wdrvmgrmp.exe
46.224.180.246:40555
—
—
—
unknown

DNS requests

Domain
IP
Reputation
www.update.microsoft.com
  • 20.72.235.82
whitelisted
armmf.adobe.com
  • 23.218.208.137
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3456
wdrvmgrmp.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 21
7 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VolDriver.exe