Extracted

• • Target

    d4faa174ec5639ad52079050b3c9d540N.exe

  • Size

    199KB

  • MD5

    d4faa174ec5639ad52079050b3c9d540

  • SHA1

    30b5882420654fcf2fc95d4d1ced20f5734d5c7b

  • SHA256

    863e0c00ddef17df0842cfda7d6577eb7f5768f49130aba25ca5d1fa1d091f4e

  • SHA512

    46f4539f1b580f51c2b8c1e502ed6f32047ba0fb22c192df3ef5f9fea93d28e2b9b2ad993ee56b0d02631ff402a2fceaba8005c3679ee512e7aefafa55cfa1c5

  • SSDEEP

    3072:T+fjzka/5RQPy7GWZz/IbIWucgnE9P6gNIjaPmVGY+5xS9Yl/y3:T+Xka/nTz/zmgniCgNlzoqdy3

  Score

  10^/10

  phorphiexxmrigdiscoveryevasionexecutionloaderminerpersistencetrojanworm

  • Modifies security service

    evasion

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2