phorphiex | 882cd8797f417c8898ee087d0ad158ac7b61ac41dd9cb82d0fd26cd55d7fe75e

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10KB
Sample260928-w7taba11dz
SHA256 882cd8797f417c8898ee087d0ad158ac7b61ac41dd9cb82d0fd26cd55d7fe75e
MD5 d024d63c31d57b7c7b45d26705e7755f
SHA1 1f2d875b57aec1a0e02ab1cd5985f660343c0d7c
SHA512 39f1a2df006e2768180b4e456c212e0cbac8832bc0a3da4c70a48c32c45d6bb510487b115fb463f213230e413da8962fe258b633e1542070bf8db18ec30cad2b
SSDEEP 96:8Md/ozKYz/J4hOEe6B2dypaDL1x+ZQxSTzjjPFJxGE9mZ2FFhxC7tCEeczFX:88olx6B6x+exkPFJxTEZmFhSecRX
TLSH
T17E221A2F7E494231D39048B416B5474F953D1633A787B7EFF773E58A0BA92488840EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution phorphiex xmrig loader miner persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109/us/
http://178.16.54.109/c/
http://178.16.54.109/ot/
http://178.16.54.109/b/
http://178.16.54.109/s/
http://178.16.54.109/spmm/

Mutex

8r68r6r

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4e2-47.dat	family_xmrig
behavioral2/files/0x000d00000001c4e2-47.dat	xmrig

Downloads MZ/PE file 7 IoCs

flow	pid	Process
6	432	file.exe
6	432	file.exe
6	432	file.exe
6	432	file.exe
6	432	file.exe
6	432	file.exe
15	4696	2759129654.exe

Executes dropped EXE 10 IoCs

pid	Process
2732	3126130440.exe
4964	220419307.exe
3216	2106019969.exe
5312	3082730635.exe
5256	2432641196.exe
1020	2595819041.exe
4696	2759129654.exe
5708	sysmgnrsv.exe
5344	sysfrodolv.exe
1432	sysmgnrsv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Config = "\\sysfrodolv.exe"	2759129654.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	220419307.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3082730635.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2432641196.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sysmgnrsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sysmgnrsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2432641196.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2759129654.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2106019969.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2106019969.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3082730635.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3126130440.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3126130440.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2595819041.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2595819041.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	220419307.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3126130440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2595819041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	220419307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2106019969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3082730635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2432641196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2759129654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysfrodolv.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1432	sysmgnrsv.exe
Token: SeLockMemoryPrivilege	1432	sysmgnrsv.exe
Token: SeIncBasePriorityPrivilege	1432	sysmgnrsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1432	sysmgnrsv.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2732	432	file.exe	89
PID 432 wrote to memory of 4964	432	file.exe	90
PID 432 wrote to memory of 3216	432	file.exe	91
PID 432 wrote to memory of 5312	432	file.exe	92
PID 432 wrote to memory of 5256	432	file.exe	93
PID 432 wrote to memory of 1020	432	file.exe	94
PID 432 wrote to memory of 4696	432	file.exe	95
PID 4696 wrote to memory of 5708	4696	2759129654.exe	96
PID 4696 wrote to memory of 5344	4696	2759129654.exe	99
PID 5344 wrote to memory of 3948	5344	sysfrodolv.exe	100
PID 3948 wrote to memory of 1432	3948	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\3126130440.exe
  C:\Users\Admin\AppData\Local\Temp\3126130440.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\220419307.exe
  C:\Users\Admin\AppData\Local\Temp\220419307.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\2106019969.exe
  C:\Users\Admin\AppData\Local\Temp\2106019969.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\3082730635.exe
  C:\Users\Admin\AppData\Local\Temp\3082730635.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5312
- C:\Users\Admin\AppData\Local\Temp\2432641196.exe
  C:\Users\Admin\AppData\Local\Temp\2432641196.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5256
- C:\Users\Admin\AppData\Local\Temp\2595819041.exe
  C:\Users\Admin\AppData\Local\Temp\2595819041.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\2759129654.exe
  C:\Users\Admin\AppData\Local\Temp\2759129654.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\sysmgnrsv.exe
    C:\Users\Admin\sysmgnrsv.exe
    3⤵
    - Executes dropped EXE
    PID:5708
- - C:\sysfrodolv.exe
    \sysfrodolv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Users\Admin\sysmgnrsv.exe
        
        C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2106019969.exe

Path C:\Users\Admin\AppData\Local\Temp\2106019969.exe
Size 18KB
SHA256 c515019419a3ea506f0adec86ef45c9f8e786236324f96b8c7769b41f1948208
MD5 d932537b9ac0c16f9294d7a4a007c196
SHA1 dcb561abd73d653cc1e0f6987955500df1927445
SHA512 4a56852ed21cc064cab35ce1e63fc80c946b644fb02fd858d8540ee4c58885153f0ed3c4506a54279a5d938984258ea0b35483336380d97717c3b148b78fdede
SSDEEP 192:hJY86SCngTBv8vVaFXq651ln5aZuyMGleQJrQKUSiu9zwDi7OZTgbOBqmEiLnTG1:hj6I8vVaF6OjGUQgu94ibUyav8U9c3l
TLSH
T1EA824B0FB8424316E0E11070A275867BDA79A8BA37C814DBF7D489DD0A686D5FC3315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

220419307.exe

Path C:\Users\Admin\AppData\Local\Temp\220419307.exe
Size 18KB
SHA256 ce5102dbdb561d469ea91100b1fc7d8c800882df4d67a78d88fa9aeb7fd187bd
MD5 b7b1ef1e1dfcbd63f757c68f372e529b
SHA1 07a6144050cf63c34a1023e72e673afea9e5a2ee
SHA512 ad44722843b50375ccfa2566d074b30efeab6855ddb02851d15f00c054c6d151723763b458544400fea1af56bd47cfc3937ab93ecd693edd0ace9506e58a983e
SSDEEP 192:0/UY86SCngTBv8/V6lXq65FlnJqpu3Wlew7QKUSiu9zwDi7OZTgbOBqmEiLnDGJ:0/66I8/V6l6O3W0fu94ibUCav8U9cUl
TLSH
T17F823A0FB8424316E0D210B09676867BEA79A87937C814DBF7D48ADE0A686D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2432641196.exe

Path C:\Users\Admin\AppData\Local\Temp\2432641196.exe
Size 18KB
SHA256 09b94f3a07f29998b71f3ed7ead8ebdd754d4e918b4112248a19e69d9715f4de
MD5 38bc5b9fc0ede4fef1e28e892edb5deb
SHA1 2a69296abedf6bb91f1b47ae1440c524890b584c
SHA512 4095ccee6e01bc32bf12285fe3dd43b5f2e05ee6f41fcbf9a6b8fab6bc120719ae2f1519354cc795b4185eca2b194aac3cb692faac3b29b247a7467079b16ee2
SSDEEP 192:yHY86SCngTBv8vVaFXq651ln5aZuyMGleQJrQKUSiu9zwDi7OZTgbOBqmEiLnTGR:y56I8vVaF6OjGUQgu94ibUyav8U9czl
TLSH
T199824B0FB8424316E0E11070A276867FEA79A8BA37C914DBF7D489DD0A686D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2595819041.exe

Path C:\Users\Admin\AppData\Local\Temp\2595819041.exe
Size 18KB
SHA256 8849b6f4a97c8e33640f85319cbff7446d7969225d37179ca91900b92cad33ad
MD5 d788aaf3d00ef5d0ded9d149c7d99376
SHA1 5892cfb310e1c0fc1c9a94a4910e7eeb0143ba01
SHA512 e55283aa54dad64c081cc713c0ea80821da2ba464ee574a9fbb1431c0b7ffab2cab870e8f11b1c4852075af75ced69f56c6c89dcaed817a388acc9b6168d349c
SSDEEP 192:X6Y86SCngTBv8/V6lXq65FlnJqpu3Wlew7QKUSiu9zwDi7OZTgbOBqmEiLnDGJxb:XA6I8/V6l6O3W0fu94ibUCav8U9c5l
TLSH
T181824B0FB8424316E0D210B09675867FEA79A87973C814DBF7D48ADE0A686D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2759129654.exe

Path C:\Users\Admin\AppData\Local\Temp\2759129654.exe
Size 12KB
SHA256 01f64c61767bc41f039cf2080e61da49c96b14e4d558da6c03128e40ca816799
MD5 07bd5d0edaca14204802b8ff7db346ce
SHA1 660784d4aa65c5914978fae86d4f493e26a9b2b1
SHA512 7ba6ede3f8f94eda823241898465fcd71ac5935ed46ed679a525360d44ab6eb9a1298bd7c1c0e7fab28fe096471a62a014c8e147abf752d42118d880b4ad614e
SSDEEP 192:PeeTbgOhmKM84zleg7zL/mmPJxTZ3lk9nAthBsuNOk:mITwG4z0A2oZK9nABsk
TLSH
T1D3421A07AD998121E7F00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3082730635.exe

Path C:\Users\Admin\AppData\Local\Temp\3082730635.exe
Size 18KB
SHA256 0decf104ecf4e26c41e4b852deafd3b1dcec928be7fc5508f072b889ab767179
MD5 61ab126c877d224850b46fd7f0a61ce1
SHA1 e6a54c51b5255409194ea054266b772936ed379e
SHA512 7ad76660809986a7b9f5b233c599f5c157b690b20a04cb0478e88043c9d51da5481e89fa1b2019b8eb5c6c0fa557800d537014874055e6c5b4bea38cd8e12630
SSDEEP 192:ezY86SCngTBv8vVaFXq651ln5aZuyMGleQJrQKUSiu9zwDi7OZTgbOBqmEiLnTGa:ed6I8vVaF6OjGUQgu94ibUyav8U9c8l
TLSH
T1E5824B0FB8424316E0E11070A275867BEA79A87A37C814DBF7D449DD0A686D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3126130440.exe

Path C:\Users\Admin\AppData\Local\Temp\3126130440.exe
Size 18KB
SHA256 15eb799f44da58693e6c43fdbd894299e02308c9f6cae8f8e00b8fc8176fc754
MD5 9fb21889c132ac78880f966496cc3e62
SHA1 9214f9b10082ef2f9804b5f216bc405fb75a3531
SHA512 cc3c25d2255880e5e19e8cba3e35abd151ba60866961ca73bad91fda6a46ec3f0ccd7638f350e86050d0cbbfd87c9877fc669f4cf788bf1a0202e103cab6f75f
SSDEEP 384:lh06I8vVaF6OjGUQgu94ibUyav8U9cHl:lh0PsUQZ9va0U
TLSH
T174824B0FB8424316E0E11070A276867BDA79A87A37C914DBF7D489DD0A786D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysmgnrsv.exe

Path C:\Users\Admin\sysmgnrsv.exe
Size 6.2MB
SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
MD5 ac458ece671fdde066ce60e448f12bc0
SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
TLSH
T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5708-49-0x000001EC495B0000-0x000001EC495D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads