Extracted

Extracted

• • Target

    9d512e372cbc60a9d7ff6c44f21403dd82782f1f975444333d4870b54f23d9e7.exe

  • Size

    903KB

  • MD5

    3d6b93c4450b7b152f405e50fb321450

  • SHA1

    4ea66c1fa7a5f7e03b5e5c028f757aa9bc61863c

  • SHA256

    9d512e372cbc60a9d7ff6c44f21403dd82782f1f975444333d4870b54f23d9e7

  • SHA512

    a46a1843ab3bd3213f6146ecd6c2a4b48d90a29e95fde7ed1c2e7e3523999e6ecb71a4aaeef64b4cac658482684e9898b06cc0d4222b8c1cad86b0b4aac6dd42

  • SSDEEP

    24576:PivtCXWeGK+FGXFmUPz4s6nZ3p6NaAH/0:qtCXWPnc1mQz4s6Ziac0

  Score

  10^/10

  phorphiexdiscoveryevasionexecutionloaderpersistencetrojanwormxmrigminer

  • Modifies security service

    evasion

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Windows security bypass

    evasiontrojan

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2