Overview

overview

10

Static

static

3

79ee1c91ea...46.exe

windows7-x64

10

79ee1c91ea...46.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-11-2024 22:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe

  • Size

    1.5MB

  • MD5

    d61e81f0e8eab297210d6ac0b971b1a2

  • SHA1

    0da339927bd348696a743915bc7b6499d32fc97f

  • SHA256

    79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046

  • SHA512

    d41007c500ec99b4dbadd319bebe7aa4bbe9e5e226cbd0f27632abdb8dd2954aefccb811c9579094b2a8c08fdec3973a0dcf8d64994c6a9338b381bdea3e6af6

  • SSDEEP

    24576:XfWzK0OUHSihN6Qr2/1A/g4jzkQlC+eEN7tbalAK6w6hC4O8b8ITDnloH2:OzK0OUymN29A/gu7eEJtbqAK6w6hC4O+

Score
10/10
phorphiexxmrigdiscoveryexecutionloaderminerpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
Attributes
  • mutex

    753f85d83d

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.66

http://185.215.113.84
Attributes
  • mutex

    Klipux

Signatures

  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 10 IoCs
    miner
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
        "C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Users\Admin\AppData\Local\Temp\AF6A.exe
          "C:\Users\Admin\AppData\Local\Temp\AF6A.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2856
          • C:\Users\Admin\AppData\Local\Temp\1441620776.exe
            C:\Users\Admin\AppData\Local\Temp\1441620776.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:1600
            • C:\Windows\sysnldcvmr.exe
              C:\Windows\sysnldcvmr.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4576
              • C:\Users\Admin\AppData\Local\Temp\2802026625.exe
                C:\Users\Admin\AppData\Local\Temp\2802026625.exe
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4188
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                    PID:1496
                    • C:\Windows\system32\reg.exe
                      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                      8⤵
                        PID:3404
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                      7⤵
                        PID:1028
                        • C:\Windows\system32\schtasks.exe
                          schtasks /delete /f /tn "Windows Upgrade Manager"
                          8⤵
                            PID:4356
                      • C:\Users\Admin\AppData\Local\Temp\3122314675.exe
                        C:\Users\Admin\AppData\Local\Temp\3122314675.exe
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2992
                      • C:\Users\Admin\AppData\Local\Temp\208963388.exe
                        C:\Users\Admin\AppData\Local\Temp\208963388.exe
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4124
                        • C:\Users\Admin\AppData\Local\Temp\2941726316.exe
                          C:\Users\Admin\AppData\Local\Temp\2941726316.exe
                          7⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:968
                      • C:\Users\Admin\AppData\Local\Temp\2148524255.exe
                        C:\Users\Admin\AppData\Local\Temp\2148524255.exe
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1764
                • C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe
                  "C:\Users\Admin\AppData\Local\Temp\79ee1c91ea5545d6de00ddedfeada11b71df432015127ea18692dd90827f0046.exe" --channel=5020.0.826378198 --type=renderer
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2788
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 780
                    4⤵
                    • Program crash
                    PID:4296
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3832
              • C:\Windows\System32\schtasks.exe
                C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
                2⤵
                  PID:5068
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1000
                • C:\Windows\System32\conhost.exe
                  C:\Windows\System32\conhost.exe
                  2⤵
                    PID:4408
                  • C:\Windows\System32\dwm.exe
                    C:\Windows\System32\dwm.exe
                    2⤵
                      PID:1176
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2788 -ip 2788
                    1⤵
                      PID:4048
                    • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                      "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                      1⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4664

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      3KB

                      MD5

                      fee026663fcb662152188784794028ee

                      SHA1

                      3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                      SHA256

                      dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                      SHA512

                      7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\1[1]
                      Filesize

                      108KB

                      MD5

                      1fcb78fb6cf9720e9d9494c42142d885

                      SHA1

                      fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

                      SHA256

                      84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

                      SHA512

                      cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      1KB

                      MD5

                      cc6cfea44f94d487d302fe97587a055e

                      SHA1

                      557162e994c02df41a16f0aec6ae9b6dab3ac9eb

                      SHA256

                      7569944335801a4a9ad619291599faab03d1f1e6915042b32c7c80aa49803fe3

                      SHA512

                      9a19216612bd0724d7f7d346966699766ac09e2480239d8af2036f6239c248c9df4b45d8b57c64e4016d1eb8b9e20fe0f45fb09cad37a96668db5ddefbf58ee6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1441620776.exe
                      Filesize

                      79KB

                      MD5

                      0c883b1d66afce606d9830f48d69d74b

                      SHA1

                      fe431fe73a4749722496f19b3b3ca0b629b50131

                      SHA256

                      d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

                      SHA512

                      c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\208963388.exe
                      Filesize

                      10KB

                      MD5

                      96509ab828867d81c1693b614b22f41d

                      SHA1

                      c5f82005dbda43cedd86708cc5fc3635a781a67e

                      SHA256

                      a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

                      SHA512

                      ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\2148524255.exe
                      Filesize

                      15KB

                      MD5

                      0c37ee292fec32dba0420e6c94224e28

                      SHA1

                      012cbdddaddab319a4b3ae2968b42950e929c46b

                      SHA256

                      981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

                      SHA512

                      2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\2802026625.exe
                      Filesize

                      8KB

                      MD5

                      cb8420e681f68db1bad5ed24e7b22114

                      SHA1

                      416fc65d538d3622f5ca71c667a11df88a927c31

                      SHA256

                      5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

                      SHA512

                      baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\2941726316.exe
                      Filesize

                      5.6MB

                      MD5

                      13b26b2c7048a92d6a843c1302618fad

                      SHA1

                      89c2dfc01ac12ef2704c7669844ec69f1700c1ca

                      SHA256

                      1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

                      SHA512

                      d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\3122314675.exe
                      Filesize

                      49KB

                      MD5

                      6946486673f91392724e944be9ca9249

                      SHA1

                      e74009983ced1fa683cda30b52ae889bc2ca6395

                      SHA256

                      885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

                      SHA512

                      e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\AF6A.exe
                      Filesize

                      9KB

                      MD5

                      8d8e6c7952a9dc7c0c73911c4dbc5518

                      SHA1

                      9098da03b33b2c822065b49d5220359c275d5e94

                      SHA256

                      feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

                      SHA512

                      91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pfsb0lda.k21.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • memory/968-85-0x00007FF767240000-0x00007FF7677D7000-memory.dmp

                      Filesize

                      5.6MB

                      Download

                    • memory/1176-106-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-117-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-123-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-121-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-119-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-114-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-108-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-110-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/1176-112-0x00007FF668E50000-0x00007FF66963F000-memory.dmp

                      Filesize

                      7.9MB

                      Download

                    • memory/3832-76-0x00000276A2100000-0x00000276A2122000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/4188-44-0x0000000000140000-0x0000000000146000-memory.dmp

                      Filesize

                      24KB

                      Download

                    • memory/4408-107-0x00007FF7C36A0000-0x00007FF7C36C9000-memory.dmp

                      Filesize

                      164KB

                      Download

                    • memory/4408-105-0x00007FF7C36A0000-0x00007FF7C36C9000-memory.dmp

                      Filesize

                      164KB

                      Download

                    • memory/4664-104-0x00007FF613740000-0x00007FF613CD7000-memory.dmp

                      Filesize

                      5.6MB

                      Download