Overview

overview

10

Static

static

10

file.exe

windows10-2004-x64

10

file.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/03/2026, 09:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 11KB
  • Sample260309-lnbaaads2q
  • SHA256 24c134595a2e38206674b3e4be0f57e00a29477c51103785dc18e937eebb6e57
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryphorphiexloaderpersistencespywarestealertrojanworm

Malware Config

Extracted

Family

  • phorphiex

C2

  • 178.16.54.109

Attributes
  • mutex

    TWIZTPEINF

Signatures

  • Phorphiex family
    phorphiex
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\2529231962.exe
      C:\Users\Admin\AppData\Local\Temp\2529231962.exe
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Users\Admin\AppData\Local\Temp\2635014898.exe
        C:\Users\Admin\AppData\Local\Temp\2635014898.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Windows\sysdvrnshost.exe
          C:\Windows\sysdvrnshost.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2104
          • C:\Users\Admin\AppData\Local\Temp\3112313153.exe
            C:\Users\Admin\AppData\Local\Temp\3112313153.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1384
          • C:\Users\Admin\AppData\Local\Temp\2491711613.exe
            C:\Users\Admin\AppData\Local\Temp\2491711613.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1132
          • C:\Users\Admin\AppData\Local\Temp\3523427163.exe
            C:\Users\Admin\AppData\Local\Temp\3523427163.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4596
      • C:\Users\Admin\AppData\Local\Temp\1451626582.exe
        C:\Users\Admin\AppData\Local\Temp\1451626582.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2460

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1451626582.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1451626582.exe
        • Size 1.7MB
        • SHA256 683e24e5ccf6d051ec121496b60703e25b45f59d78cac3be0928d2d4f8a38c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2491711613.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2491711613.exe
        • Size 9KB
        • SHA256 fbc9ebc86b7dad668f43b64368888652ebe610eae488e40c56b4033d3e62b6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2529231962.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2529231962.exe
        • Size 9KB
        • SHA256 d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2635014898.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2635014898.exe
        • Size 91KB
        • SHA256 98e5fdce85ab8e17472f95eecb4c22f08a28933828e0afd0b5db831fe222e373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3112313153.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3112313153.exe
        • Size 22KB
        • SHA256 62912d57d1863bfc672fb26ed3954b937ea83661ab8ae7ac4db4131ea8347000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3523427163.exe
        • Path C:\Users\Admin\AppData\Local\Temp\3523427163.exe
        • Size 18KB
        • SHA256 d2b94db6cb08e2b659d81e7746d669d09e70ae5d3bd675a011eced94ad66a7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2460-27-0x00000211FF6D0000-0x00000211FF79D000-memory.dmp
        Download