phorphiex | 56e46fc1b72123e8db23722e7cb5cffef5e507909cd89d12f4f778e8cb860e2a

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
Size 6.9MB
Sample261024-j4bvmss1fx
SHA256 56e46fc1b72123e8db23722e7cb5cffef5e507909cd89d12f4f778e8cb860e2a
MD5 770351c65bd8bae2c3e4679f31a27e9c
SHA1 faa246515a3e6b9401f886796464a197a68dd906
SHA512 48ca7afa0577650974b6766ca8895fed54450f96066c5ef1198242fe615e722430c6bd9443d527926caf490013e184552f51a6b618941a9758ae11252286b3c9
SSDEEP 196608:ursVYxyoZA6EWQ+QmWy2IjCZxPFHZX4GMrikaIwpxbL0s:ursyy76NQmWy7CZHHZaikaxxb
TLSH
T1D976AE63B6408032C55203B06939BBB99EFDFDB00B76D197AF88215CAA725D1D73A353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery phorphiex loader spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	976	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
3076	9239.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
38	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9239.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9239.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3076	976	2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\9239.exe
  "C:\Users\Admin\AppData\Local\Temp\9239.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Agent.dat

Path C:\Users\Admin\AppData\Local\Agent.dat
Size 5B
SHA256 cd31a53c8e95e36066423cbbb36072090446eb964f8fef82bf54c49d30e2572f
MD5 261b1aa10d3ea399f1b404f3bfee137d
SHA1 45018d3964c5fa3621adffd3fb7c2e031d842f3a
SHA512 af0bfda9adf5d25af0f52388a47df9caf6a34e7fc0e6f55419b1b9462ddec2f96867de4c5a99b32f47da837cf997bc1890317e45b5bee7f65d97eff31ebfbcac
MD5 SHA1 SHA512

Submit Download

32[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9JFLGHHP\32[1].exe
Size 12KB
SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
MD5 362fc53afbda6450184b73746802a6fa
SHA1 4c289f978c4c464da05cee4c33101ea7f5291d7b
SHA512 d137b29e9a9ae7ec47dcdb6733e618566cb66d910e33058c5681b61cd3ef0d07e346d4cee19f39c0e1e6918215bb5281caaa5fac204156f46b37c2b63e1b7c81
SSDEEP 192:yW0eU9Y0G5msXhBee6JPJXJxTNerBthIHMzQoh:P0TYgsXhAh9xBerBgMz
TLSH
T11742290AA8091831F3E204B2573E82938BBD19A337D5F9DBFB8067090DB53D5D17966E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agent-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Agent-20261024T081302.log
Size 761B
SHA256 74f8ccf1cc19e48c68e1d3bfd17a141a3ead831d96ab1e084a9074ad5aab4a34
MD5 5a4f35e073985c4eaf24b9d6012564af
SHA1 2c649737fc7b0380bae212748b9aceaf8f431d80
SHA512 5615cbbe0c50f7e5a207ef85948b22efcbf5fc81fd326f0a033d0348f20796bb94c7940b2885c41582fcd097ad792a748b52d8deedc473dfc21c1da36b9e6fa5
TLSH
T14101B8015026D12A4B8077A044C866F5C7B07754070207EA72F18339A12C3E7AF3E7D9
MD5 SHA1 SHA512 TLSH

Submit Download

AgentErrors-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20261024T081302.log
Size 308B
SHA256 333d639c1e9929943520103bebb725fa7e043acda5a3d2f4bbb58a152f8106a8
MD5 ecbd059142e48f867ffa7dd3b46230c5
SHA1 d2fe3967ee0231fe46b75ca7199f16e547d0812f
SHA512 d8a40a1183b41be15e559d3ca27afa0785d1806a42753ce081214d400646e207f9d246d6c2926d00fd9f5de059c0d2d03e7e10021379560c79c99cc453acf306
TLSH
T1D7E01231C1FBA023D86824730CD5E1A92E617519A38417952776E62D304DE8E3F95594
MD5 SHA1 SHA512 TLSH

Submit Download

AgentErrors-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20261024T081302.log
Size 6KB
SHA256 1f3abab8413e2f08600721a3517b5e3bf0ebaa81aafd9ab6f5eebdfae528dfaf
MD5 7945030426fb5cab9a712162f7c9c088
SHA1 a0a900475d9bf37ffe991d184192d73902647208
SHA512 3218ae242ad3bf3037e37aac2e341e8e841480825b2a52277574e3ccb519e1b6225ed4a95d77600942cecb8306eccb887f00f33fa7ddd45ab97440b1130a7ec4
SSDEEP 96:7rBPBmsWs0WvsSsXWvs5sGWvsGgsG8NsssgNsBsTNsXs9NsFsEcsPsWcsCsZcsuF:71pwWQWKWVK8v15mxblwvH5/N3v
TLSH
T143D14711C487927BCC90694315A87DF0A6B0F6AEB3E9036463B3E056741CDCA7BE6AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Features-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Features-20261024T081302.log
Size 91B
SHA256 2c28b19f3d33f00bbddf6a6f01d73182b3729b90f747802ecc85528573dcd8ff
MD5 17d828c20e7183ab2901ecefc62a1957
SHA1 cbefb8a252a0f2479a6e1383c373abe4406132bc
SHA512 0116d28d24e31f6d6a8dea6b42cb58ce673f638ad50e93cfd5d54a18af16f8ab23986c3d0f3a557b214e6d8e9134190fa1ba206699c88b941f9869b3e8800999
TLSH
T19CB01200698C83088CA0589505E52092C66076600B1400582150C6A930EA889757E110
MD5 SHA1 SHA512 TLSH

Submit Download

Operations-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Operations-20261024T081302.log
Size 159B
SHA256 58bb86211aea274d8cbea4c987094c9fcd9e77435caf2b8966d2b75d5e03501a
MD5 f5656e8fc4fee25823bd0a38cc733e2c
SHA1 d9b6d253425e84103e3b2e9605745ea9a1378819
SHA512 76ac13b8daed28ad7a767f9af45dba68d57e36f0a156408ff39cefcef515e4734d098317b8f24733d91d68fa9cd5d5a274c7bcd463ced18a89a1d9e4c0933f38
TLSH
T1E9C08CA51246A0024A495BC2A47DB0F0CEB8B200232219CC3FCDC307E09D0BA3F3AD02
MD5 SHA1 SHA512 TLSH

Submit Download

Version-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\Version-20261024T081302.log
Size 742B
SHA256 2c075f8784c17e1fe6ee13f2f67c78fef991b5d9840d8c8de63f564e2f64b125
MD5 ce315a85dfa48cdb8fc46081dace73ac
SHA1 8b28c905659a29d92751a6ff0c06e5fc262f0e30
SHA512 91fea6ef1259e457fdd3469e9c6d6be5247bd2a1212c0af207cec24101745643940109987d67abbeac1b2b9c1adbae4aa28425243ddea9f391798db9a9b9a73a
TLSH
T17301F94B50AAE53385107B804DCD37D0F7B536512691018AA2B2DE30D11CDE77737A4B
MD5 SHA1 SHA512 TLSH

Submit Download

telemetry-20261024T081302.log

Path C:\Users\Admin\AppData\Local\Temp\Logs\telemetry-20261024T081302.log
Size 444B
SHA256 8ef911cbf878b46490bde68dfa600ac8771644e8dedf7b1fd6a07f5a786469ab
MD5 dab9662c8a6c9c84b5a4677faef39879
SHA1 a13d584f7d19b379f8bac9e3b80ad137eb84245c
SHA512 a9a61bf47c2587c8ba440d86518534293f62663bfb0066e2d58d946e79290a1bf938a788d883da31d02b50e7bb65273f567a7bd899358d46fadaf4ba36303251
TLSH
T1FCF05C04141768B58854D6A7847697F28781E62C1B3803B411C2C377208C8E53BDFEA4
MD5 SHA1 SHA512 TLSH

Submit Download

bf4bddf3db7a5e2eb9f36b9304b47816

Path C:\Users\Admin\AppData\Local\data\cache\bf\4b\bf4bddf3db7a5e2eb9f36b9304b47816
Size 7KB
SHA256 db090aaadd0bd59615e6209075795ae377adaa3abf7954e06b4483aba83e7542
MD5 bf4bddf3db7a5e2eb9f36b9304b47816
SHA1 f320cd22c48cd10e8128c6dab740d0e318e00030
SHA512 d12d4bbdc5c6ab8e2e11dd85d8964469d7c04b5f81588334742630c0d7d2859532b635d20296c2f5f80c1a27a9f1fa5ec3e7997090eae9f6cb2d08fd6b43dd1e
SSDEEP 192:dEePvrCmNMUjpBQhn7DXJM1wyXl50KkDSzeMR6O:dZvGmNMUjpBQhn7MlaKkm61O
TLSH
T1FBF1A93188D8D53A9DBABFD5537FFD43B7D9916A64081490EBFDE80C413987E012684B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdn-agent-3433090

Path C:\Users\Admin\AppData\Local\data\cache\cdn-agent-3433090
Size 1KB
SHA256 4a5a67e6d7ebc02f2bbbd8060614889d8f57ae2bd5d85445aa686ea0ff7343c4
MD5 f18339bef74ce70d6911571243d88f1c
SHA1 04e0356dcf2aa1551c633665f2cfcb2682f9611b
SHA512 49961fd1eab80725abc438e9aa3fc402207663d8b43ed9169a6f5e54206fe0ed68f5874de0a56733e35389bf7f2e8e2ea81f43231acac75b3be879298b1af807
TLSH
T192216FA6C419C7087B3DEE8D624712CEE52F29D52ED398CC7181793B215292B2232F10
MD5 SHA1 SHA512 TLSH

Submit Download

cdn-bts-2248514

Path C:\Users\Admin\AppData\Local\data\cache\cdn-bts-2248514
Size 771B
SHA256 996cec1cf904d298550ea073b5b15287ed9dc29d2afaabf830b16bf2ab66e082
MD5 b6c07a5c1e6daff3cefa8498078942c3
SHA1 c21b57af00c0ecdafbf3d7c4e9da40a3a4e3c39a
SHA512 85063057dd51f07b994124378d6bce018cc9e72cafc184c96dc139ab48320f3e3e6e7b0022ff4e3d02890ddd4e4f8862f547119f30fb201247bbaff57d3577f6
TLSH
T1B10184A8D01CDF09B67BEF4867960349951B1EC82CC394C9B295BA3F5502A36B532F18
MD5 SHA1 SHA512 TLSH

Submit Download

e8a9e3b2b36cc844d7a26a18fce57792

Path C:\Users\Admin\AppData\Local\data\cache\e8\a9\e8a9e3b2b36cc844d7a26a18fce57792
Size 308B
SHA256 861e375dcdfe06f23998a42e9c9d2204d3dae197bcfac37d6ce54284e7a4a2a3
MD5 e8a9e3b2b36cc844d7a26a18fce57792
SHA1 49be54edf2f73bd6108b3e70beefc6c6ca7a41e9
SHA512 90c4e61fde0dbac2a529b2dbc99a600be7e4f0edbc7868b5a894e10f66e543d11a92781f758d3070d465ad5c5bd2a9b774ba278a8fa2e26f724411558aa84fd5
TLSH
T140E0CD119D357476EAD66E4CF4863E070F36037349C4BDC4A41CB018D7D703E440554B
MD5 SHA1 SHA512 TLSH

Submit Download

summary--4097988

Path C:\Users\Admin\AppData\Local\data\cache\summary--4097988
Size 25KB
SHA256 236670cbfdd06403d73e29204a9a8b9437b6b5e5d3315e3a39e4e5c45c1c70e6
MD5 2b1354663746a15dc8ddc92ee9c78043
SHA1 a0f5ed4c6158ba32ffb557dcee5265363a05b406
SHA512 202fbfbe658fcb54d96fdacfa5b5314a250ec56a2c3139daaeac17c257b84b9f3c655b5495bca0f7bfb7c1f25de9ecf52a039cad691182efa775e417acd46ad1
SSDEEP 384:fsqvg07Q3a98jVHZrRJWL8xf8+YOvJbxnLO5/hD5qA79InSaOBRyYaa4x6NeOu5d:f207Qqr90SaOfhhAxDBPfO+TYg5vb
TLSH
T108C252F6B48901F0F6EE6645A8896ECD0F3A39521E5D3A85478139FF1F22B7BE425C01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version-agent-4051779

Path C:\Users\Admin\AppData\Local\data\cache\version-agent-4051779
Size 742B
SHA256 0c22cba2b47d592db264d9bf70500809114664cca9709bdd4b45f31b1d1c4d6a
MD5 bfe31bd8a233362f8d130caafce37aa1
SHA1 97b8be4b7c94cfa2205c0d1497f333e2d80388e5
SHA512 0f64b704be34d5f7a38f5584b73565b89578a58c3cb8c57d1d338daf2fb0b3d0b98464d504a5b81acd4bb9f1307a79909d6746f057504290bc3b23806ddab85a
TLSH
T1740145B21A260F54390013FC33B8E44E973D68D6FF101006B699F03A229D4A43824CF0
MD5 SHA1 SHA512 TLSH

Submit Download

version-bts-4080386

Path C:\Users\Admin\AppData\Local\data\cache\version-bts-4080386
Size 3KB
SHA256 feff22b93130b7b86f1a875ce10c42fa97d1a9fac702a5f5a802c8f0e75a92c4
MD5 782796200b939e8399c0aa7d7b1cebfc
SHA1 d1e6557544ea0100b545bd4b5e0fa6591b16f523
SHA512 b0c009518b87ec3a2f77c098c6a328c37c070eab9350042eb78add993fe34c011541be1b49a08aedb3d303e3fc20a88f45032c93d2fac735bd4ec00958081417
TLSH
T1147148E2171418A193CF9DA4C987C2E4CDB56C4564AE4E2987E137E345BD70CDDE383A
MD5 SHA1 SHA512 TLSH

Submit Download

product.db

Path C:\Users\Admin\AppData\Local\product.db
Size 193B
SHA256 c30cb790cb99616606eb33590029a589a69e9138de37b13cde660438b392c1de
MD5 1db46ec4daf7303029be5569f1976107
SHA1 add7a01db9e1e8e847814e6d023d547d999764b3
SHA512 d6a386dc4591575fedd94f48315dd69d3d54b4a9fc7d053cf081135e46c401549f27e460ba6e89a34fd4def186b60b68db1f75f21b68b4c0e8911793bece8df3
TLSH
T19FC0C016CC44CE3BC3481C33E0A18D8801F0CC4CA9D867211B733D8A9D3375F6299300
MD5 SHA1 SHA512 TLSH

Submit Download

product.db

Path C:\Users\Admin\AppData\Local\product.db
Size 236B
SHA256 884755485cdc562ada61abd43fa792bac53926fa5d2bd7defceafb80b7b01da5
MD5 89e06a485c13b620225a7d67764d1687
SHA1 da6467d8ef9c427a9ef857433fef8828c57616aa
SHA512 8a398384d77e682f8d03241ab3abb168be86042c2ddedf93ba8dd6fc21793fde9a61f2df242fc76f31ffcde055062c822edc728fc00431ac450948bcaf0c55d0
TLSH
T19BD09720CC008C3AC6890C7270628C4A11B4CC4808D453200B227E490B379AF629E600
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads