Extracted

• • Target

    babdc434b7ad8f289cd2159505fe0170N.exe

  • Size

    113KB

  • MD5

    babdc434b7ad8f289cd2159505fe0170

  • SHA1

    bb9ac828ed809beffd2dd7851aa6dd3bc2168c53

  • SHA256

    82b51380d3a8c5e574087a113c15fe3634d6b20fa3af387947695e5bbf07dc63

  • SHA512

    74d9fe88b9788b15f18767fc5bc7fde034315c1b1953bc1a30a963df4ff733e302f6c1101904bb154eea7d548f8aafcd0da424099e70396b0f2578c4d1fc5492

  • SSDEEP

    3072:OVS1/eI4pnTfEFYJE3nwzPdCNU/efHYTo+:OEHGnTcFYOXwJigT

  Score

  10^/10

  phorphiexxmrigdiscoveryevasionexecutionloaderminerpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2