Extracted

Extracted

• • Target

    260f4bd4d9f08e29026f540d60aa1d54f1d1b8965141dae3defa112b688651dfN.exe

  • Size

    2.8MB

  • MD5

    cc98eb6a147cf80ce8eded7842d4eb90

  • SHA1

    7ef3a84fea0deee9705da930483a36a8a0c9ed31

  • SHA256

    260f4bd4d9f08e29026f540d60aa1d54f1d1b8965141dae3defa112b688651df

  • SHA512

    5881d2112725bdd6ec996c2812e093a604252bb1a31428f58bf8aa5946f6cade72a5111b08ac10a29f8a7e18b1fe7977130fd2aa215d2efe7a7068dffb931290

  • SSDEEP

    49152:0ljHdG8GcuzCO4XKaYRwXUtyqcM8pdIcA69j7GUsRTd8sxjOPJnUl68QFy13Tgbw:UjxDuzCOQg+9j7YdOPJ8xQxw

  Score

  10^/10

  phorphiexdiscoveryloaderpersistencetrojanwormxmrigexecutionminer

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2