File name:	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe
Full analysis:	https://app.any.run/tasks/de410208-2f78-49de-b342-f82988ba379d
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Phorpiex is a malicious software that has been a significant threat in the cybersecurity landscape since 2016. It is a modular malware known for its ability to maintain an extensive botnet. Unlike other botnets, Phorpiex does not concentrate on DDoS attacks. Instead, it has been involved in numerous large-scale spam email campaigns and the distribution of other malicious payloads, such as LockBit. Malware Trends Tracker >>>
Analysis date:	December 18, 2024, 23:37:09
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	loader phorpiex
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	635A58029CE832A74876C3FFEC0C3ACF
SHA1:	BB00046E17CB65703A4435D6E30DF21D7A185159
SHA256:	DFF97CCDCD4842D8690B0530E0B98643A0C6B84A3B2AA30222784B807642A764
SSDEEP:	768:WyBhxtjwq8DMMCuzyz2cB+rN9qDk4HVDWeENYKl:ThCq8JCWYB+rNqk4HlWG8

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2009:12:04 13:35:59+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	9
CodeSize:	4096
InitializedDataSize:	5120
UninitializedDataSize:	-
EntryPoint:	0x5444
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI


(PID) Process:	(2072) dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(2072) dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(2072) dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4668) 20260.scr	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	Windows Settings
Value: C:\Users\admin\sysnldcvmr.exe
(PID) Process:	(4076) sysnldcvmr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(4076) sysnldcvmr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4076) sysnldcvmr.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\tdrpl[1].exe		executable
		MD5:0C883B1D66AFCE606D9830F48D69D74B	SHA256:D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	C:\Users\admin\AppData\Local\Temp\20260.scr		executable
		MD5:0C883B1D66AFCE606D9830F48D69D74B	SHA256:D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
4076	sysnldcvmr.exe	C:\Users\admin\tbtnds.dat		binary
		MD5:19F4EB7E134C8DF0F7ADFEBB5839A991	SHA256:A0C333B236AE31EA2A2E54DA38F1628FC248C5DDB70454B9AA1700BABF115C00
4668	20260.scr	C:\Users\admin\sysnldcvmr.exe		executable
		MD5:0C883B1D66AFCE606D9830F48D69D74B	SHA256:D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
440	svchost.exe	GET	200	2.16.164.106:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
440	svchost.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	GET	200	185.215.113.66:80	http://185.215.113.66/tdrpl.exe	unknown	—	—	malicious
4712	MoUsoCoreWorker.exe	GET	200	2.16.164.106:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4076	sysnldcvmr.exe	GET	404	185.215.113.66:80	http://185.215.113.66/2	unknown	—	—	malicious
4076	sysnldcvmr.exe	GET	404	185.215.113.66:80	http://185.215.113.66/1	unknown	—	—	malicious
4076	sysnldcvmr.exe	GET	404	185.215.113.66:80	http://185.215.113.66/3	unknown	—	—	malicious
4076	sysnldcvmr.exe	GET	404	185.215.113.66:80	http://185.215.113.66/4	unknown	—	—	malicious
4076	sysnldcvmr.exe	GET	404	185.215.113.66:80	http://185.215.113.66/5	unknown	—	—	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	2.23.209.130:443	www.bing.com	Akamai International B.V.	GB	whitelisted
—	—	192.168.100.255:138	—	—	—	whitelisted
4712	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
440	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4712	MoUsoCoreWorker.exe	2.16.164.106:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
440	svchost.exe	2.16.164.106:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
4712	MoUsoCoreWorker.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
440	svchost.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3976	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

Domain	IP	Reputation
www.bing.com	2.23.209.130 2.23.209.182 2.23.209.140 2.23.209.187 2.23.209.133 2.23.209.149	whitelisted
settings-win.data.microsoft.com	51.124.78.146	whitelisted
google.com	172.217.16.206	whitelisted
crl.microsoft.com	2.16.164.106 2.16.164.49	whitelisted
www.microsoft.com	104.79.89.142	whitelisted
www.update.microsoft.com	20.72.235.82	whitelisted
self.events.data.microsoft.com	13.89.179.8	whitelisted

PID	Process	Class	Message
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 33
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Potentially Bad Traffic	ET INFO Executable Download from dotted-quad Host
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	A Network Trojan was detected	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	A Network Trojan was detected	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
2072	dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
4076	sysnldcvmr.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 13
4076	sysnldcvmr.exe	A Network Trojan was detected	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
4076	sysnldcvmr.exe	A Network Trojan was detected	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
4076	sysnldcvmr.exe	A Network Trojan was detected	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC

General Info

dff97ccdcd4842d8690b0530e0b98643a0c6b84a3b2aa30222784b807642a764.exe

635A58029CE832A74876C3FFEC0C3ACF

BB00046E17CB65703A4435D6E30DF21D7A185159

DFF97CCDCD4842D8690B0530E0B98643A0C6B84A3B2AA30222784B807642A764

768:WyBhxtjwq8DMMCuzyz2cB+rN9qDk4HVDWeENYKl:ThCq8JCWYB+rNqk4HlWG8

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

PHORPIEX has been detected (YARA)

PHORPIEX has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Potential Corporate Privacy Violation

Starts application with an unusual extension

Connects to the server without a host name

Process requests binary or script from the Internet

Starts itself from another location

Connects to unusual port

INFO

Checks supported languages

Creates files or folders in the user directory

Reads the computer name

The process uses the downloaded file

Checks proxy server information

Process checks computer location settings

Create files in a temporary directory

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings