Extracted

Extracted

• • Target

    97d8010f133ccb2d66ee26b1877923706887e3a977aa7d073ac81b271b965450N.exe

  • Size

    6KB

  • MD5

    6284c5a4335f91c1f8bda761ac59c720

  • SHA1

    cd46cc2a86807823aa2f6897150aa31dbbbe5926

  • SHA256

    97d8010f133ccb2d66ee26b1877923706887e3a977aa7d073ac81b271b965450

  • SHA512

    c7963b98b0224235e3b4b7d5bef9a1dd308d3c6bab0f1bcaa3de8595c67efdca6a2287ac76635662a9830598d34fd19f2d4cd1ddabd380fccf9e86f2be952d6f

  • SSDEEP

    48:ighipnso2K9iWuB1UwSSYuFaHHZ9gdGW1SWhseXxPP4Bx0Hll/kzK8cv/gnLaGpN:pTo2d4wSSYum3goW9XfHczK1voLaGR4

  Score

  10^/10

  phorphiexxmrigdiscoveryexecutionloaderminerpersistencespywarestealertrojanworm

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2