phorphiex

General

Target

508bc81bf6a736b3f6ff1c2cb2613418.exe
Size

75KB
Sample

230222-nffadach5t
MD5

508bc81bf6a736b3f6ff1c2cb2613418
SHA1

c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256

e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512

d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
SSDEEP

1536:gE3Mz8byyu11Lc3niGhAX5WKxqlfF+XEdeeeeeeeeeeeeeeeeeeeWeeeee:Qwbk1LSiGepvqlfFj

Score

10^/10

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0x77BC9dDbaf423139eC0C7F699B676c72Ab34fcc7

TCX5ybBsuZE2BZk6GJMqZaCjBEjiuX1zPP

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Targets

- Target
  
  508bc81bf6a736b3f6ff1c2cb2613418.exe
- Size
  
  75KB
- MD5
  
  508bc81bf6a736b3f6ff1c2cb2613418
- SHA1
  
  c0a6c581783273794c54d5c4622e5af6e0e5b755
- SHA256
  
  e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
- SHA512
  
  d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
- SSDEEP
  
  1536:gE3Mz8byyu11Lc3niGhAX5WKxqlfF+XEdeeeeeeeeeeeeeeeeeeeWeeeee:Qwbk1LSiGepvqlfFj
Score

10^/10

phorphiex evasion loader persistence trojan worm xmrig miner upx
- Phorphiex
  Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

xmrig

XMRig Miner payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

UPX packed file

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2