phorphiex | b23c1d8012cbca60bc3116fce597cb8cd5d582e3a76913f23861bb22f3ce9788 | Triage

Sharing

General

Target

020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe
Size

272KB
Sample

240606-lej6tsdc83
MD5

020ff160669157c4cb8013f1987beb70
SHA1

ad7701d1d749652e899d8a953b96b3990dd0c434
SHA256

b23c1d8012cbca60bc3116fce597cb8cd5d582e3a76913f23861bb22f3ce9788
SHA512

a7f6017c3767ad3dd998f86118298692fdad9b8afc6ca4e019421d539885a346e51e30f5842eac3207f5ef97ae62f8437ddb7d018a32d306d05863edb909b0d0
SSDEEP

3072:+33mUyfOhAt33UwIFUCuwE5jJ6xwfB/G1Vi6eXXEm5aaNwKbuAs0FNmhMn+IhNsM:+byWhAZ3xIFUCKj7J/GhTvYl7

Score

10^/10

phorphiex xmrig evasion loader miner persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://5.42.96.117/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes

mutex
plo7udsa2s
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Targets

- Target
  
  020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe
- Size
  
  272KB
- MD5
  
  020ff160669157c4cb8013f1987beb70
- SHA1
  
  ad7701d1d749652e899d8a953b96b3990dd0c434
- SHA256
  
  b23c1d8012cbca60bc3116fce597cb8cd5d582e3a76913f23861bb22f3ce9788
- SHA512
  
  a7f6017c3767ad3dd998f86118298692fdad9b8afc6ca4e019421d539885a346e51e30f5842eac3207f5ef97ae62f8437ddb7d018a32d306d05863edb909b0d0
- SSDEEP
  
  3072:+33mUyfOhAt33UwIFUCuwE5jJ6xwfB/G1Vi6eXXEm5aaNwKbuAs0FNmhMn+IhNsM:+byWhAZ3xIFUCKj7J/GhTvYl7
Score

10^/10

phorphiex xmrig evasion loader miner persistence trojan worm
- Modifies security service
  evasion
- Phorphiex payload
- Phorphiex, Phorpiex
  Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
  worm trojan loader phorphiex
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Windows security bypass
  evasion trojan
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

phorphiexxmrigevasionloaderminerpersistencetrojanworm

behavioral2

phorphiexxmrigevasionloaderminerpersistencetrojanworm