Overview

overview

10

Static

static

3

79ee1c91ea...46.exe

windows7-x64

10

79ee1c91ea...46.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2024 22:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

  • Size

    1.5MB

  • MD5

    d61e81f0e8eab297210d6ac0b971b1a2

  • SHA1

    0da339927bd348696a743915bc7b6499d32fc97f

  • SHA256

    79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046

  • SHA512

    d41007c500ec99b4dbadd319bebe7aa4bbe9e5e226cbd0f27632abdb8dd2954aefccb811c9579094b2a8c08fdec3973a0dcf8d64994c6a9338b381bdea3e6af6

  • SSDEEP

    24576:XfWzK0OUHSihN6Qr2/1A/g4jzkQlC+eEN7tbalAK6w6hC4O8b8ITDnloH2:OzK0OUymN29A/gu7eEJtbqAK6w6hC4O+

Score
10/10
phorphiexxmrigdiscoveryexecutionloaderminerpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
Attributes
  • mutex

    753f85d83d

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.66

http://185.215.113.84
Attributes
  • mutex

    Klipux

Signatures

  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 8 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1124
      • C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
        "C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Users\Admin\AppData\Local\Temp\E9E2.exe
          "C:\Users\Admin\AppData\Local\Temp\E9E2.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2836
          • C:\Users\Admin\AppData\Local\Temp\673518148.exe
            C:\Users\Admin\AppData\Local\Temp\673518148.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:1728
            • C:\Windows\sysnldcvmr.exe
              C:\Windows\sysnldcvmr.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2792
              • C:\Users\Admin\AppData\Local\Temp\185484754.exe
                C:\Users\Admin\AppData\Local\Temp\185484754.exe
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3048
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                    PID:1996
                    • C:\Windows\system32\reg.exe
                      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                      8⤵
                        PID:1548
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                      7⤵
                        PID:984
                        • C:\Windows\system32\schtasks.exe
                          schtasks /delete /f /tn "Windows Upgrade Manager"
                          8⤵
                            PID:1784
                      • C:\Users\Admin\AppData\Local\Temp\2354925334.exe
                        C:\Users\Admin\AppData\Local\Temp\2354925334.exe
                        6⤵
                        • Executes dropped EXE
                        PID:568
                      • C:\Users\Admin\AppData\Local\Temp\1763513759.exe
                        C:\Users\Admin\AppData\Local\Temp\1763513759.exe
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:1216
                        • C:\Users\Admin\AppData\Local\Temp\1079436413.exe
                          C:\Users\Admin\AppData\Local\Temp\1079436413.exe
                          7⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1436
                      • C:\Users\Admin\AppData\Local\Temp\226361571.exe
                        C:\Users\Admin\AppData\Local\Temp\226361571.exe
                        6⤵
                        • Executes dropped EXE
                        PID:2424
                • C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
                  "C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe" --channel=2668.0.672440583 --type=renderer
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2916
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2344
                • C:\Windows\system32\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2936
              • C:\Windows\System32\schtasks.exe
                C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
                2⤵
                  PID:2692
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2624
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:2776
                • C:\Windows\System32\conhost.exe
                  C:\Windows\System32\conhost.exe
                  2⤵
                    PID:2404
                  • C:\Windows\System32\dwm.exe
                    C:\Windows\System32\dwm.exe
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2672
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {DC0AFAA6-26D5-41DD-A2FB-14A39E165F6A} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
                  1⤵
                  • Loads dropped DLL
                  PID:2604
                  • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                    "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                    2⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2828

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKZ95V4R\1[1]
                  Filesize

                  108KB

                  MD5

                  1fcb78fb6cf9720e9d9494c42142d885

                  SHA1

                  fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

                  SHA256

                  84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

                  SHA512

                  cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\E9E2.exe
                  Filesize

                  9KB

                  MD5

                  8d8e6c7952a9dc7c0c73911c4dbc5518

                  SHA1

                  9098da03b33b2c822065b49d5220359c275d5e94

                  SHA256

                  feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

                  SHA512

                  91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                  Filesize

                  7KB

                  MD5

                  f971568090cbd32c045f51c377190943

                  SHA1

                  eec01601cc2be76d217fea7d4a20f37d1f026570

                  SHA256

                  e23913f482cbea29b231a03ef75d83e9131252f08b515fbf59c70d29bed1c6b4

                  SHA512

                  96fd286788a40bd99d19d7375bfc8f00310251d366ce39911fa5bdc649af80c666cb95ad6546b7fae258414cac843fdbb9d3a8ab31ae472610993eea71c39437

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\1079436413.exe
                  Filesize

                  5.6MB

                  MD5

                  13b26b2c7048a92d6a843c1302618fad

                  SHA1

                  89c2dfc01ac12ef2704c7669844ec69f1700c1ca

                  SHA256

                  1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

                  SHA512

                  d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\1763513759.exe
                  Filesize

                  10KB

                  MD5

                  96509ab828867d81c1693b614b22f41d

                  SHA1

                  c5f82005dbda43cedd86708cc5fc3635a781a67e

                  SHA256

                  a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

                  SHA512

                  ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\185484754.exe
                  Filesize

                  8KB

                  MD5

                  cb8420e681f68db1bad5ed24e7b22114

                  SHA1

                  416fc65d538d3622f5ca71c667a11df88a927c31

                  SHA256

                  5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

                  SHA512

                  baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\226361571.exe
                  Filesize

                  15KB

                  MD5

                  0c37ee292fec32dba0420e6c94224e28

                  SHA1

                  012cbdddaddab319a4b3ae2968b42950e929c46b

                  SHA256

                  981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

                  SHA512

                  2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\2354925334.exe
                  Filesize

                  49KB

                  MD5

                  6946486673f91392724e944be9ca9249

                  SHA1

                  e74009983ced1fa683cda30b52ae889bc2ca6395

                  SHA256

                  885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

                  SHA512

                  e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\673518148.exe
                  Filesize

                  79KB

                  MD5

                  0c883b1d66afce606d9830f48d69d74b

                  SHA1

                  fe431fe73a4749722496f19b3b3ca0b629b50131

                  SHA256

                  d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

                  SHA512

                  c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

                  Download Submit

                • memory/1436-151-0x000000013F1C0000-0x000000013F757000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2344-147-0x000000001B620000-0x000000001B902000-memory.dmp

                  Filesize

                  2.9MB

                  Download

                • memory/2344-148-0x0000000002200000-0x0000000002208000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2404-170-0x0000000140000000-0x0000000140029000-memory.dmp

                  Filesize

                  164KB

                  Download

                • memory/2404-168-0x0000000140000000-0x0000000140029000-memory.dmp

                  Filesize

                  164KB

                  Download

                • memory/2624-160-0x000000001B500000-0x000000001B7E2000-memory.dmp

                  Filesize

                  2.9MB

                  Download

                • memory/2624-161-0x0000000002750000-0x0000000002758000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/2672-169-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2672-167-0x0000000000250000-0x0000000000270000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2672-171-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2672-173-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2672-175-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2672-178-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2672-180-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2672-182-0x0000000140000000-0x00000001407EF000-memory.dmp

                  Filesize

                  7.9MB

                  Download

                • memory/2828-166-0x000000013F240000-0x000000013F7D7000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2916-8-0x0000000000C20000-0x0000000000C22000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/3048-112-0x000000013FF70000-0x000000013FF76000-memory.dmp

                  Filesize

                  24KB

                  Download