Overview

overview

10

Static

static

3

2026-10-22...at.exe

windows10-2004-x64

10

2026-10-22...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
  • Size 6.9MB
  • Sample261024-j4bvmss1fx
  • SHA256 56e46fc1b72123e8db23722e7cb5cffef5e507909cd89d12f4f778e8cb860e2a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryphorphiexloaderspywarestealertrojanworm

Malware Config

Extracted

Family

  • phorphiex

C2

  • http://178.16.54.109

Signatures

  • Family: Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Downloads MZ/PE file 1 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_770351c65bd8bae2c3e4679f31a27e9c_akira_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\8449.exe
      "C:\Users\Admin\AppData\Local\Temp\8449.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4640

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Agent.dat
        • Path C:\Users\Admin\AppData\Local\Agent.dat
        • Size 5B
        • SHA256 a4f93818d96e26f295f4cfc6aacaeac365dd01b261eb0e5086d4c2ccf8437b09
        • MD5 SHA1 SHA512
        Submit Download

        32[1].exe
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QG8FQWMQ\32[1].exe
        • Size 12KB
        • SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Agent-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\Agent-20261024T081303.log
        • Size 761B
        • SHA256 0d99a598129d41e7fe95fa9d7b7ecc86b3b0b2c974c54fd0227fa0290b1b1f57
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AgentErrors-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20261024T081303.log
        • Size 308B
        • SHA256 a2a309045c8d082705f803aacd325b0e333c44c5c7bc3d8b20bd91c085155844
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AgentErrors-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20261024T081303.log
        • Size 3KB
        • SHA256 2c8ba7037f59715ac94042fbd9956de70f0bfcd07de73cc19675f65f2e793b38
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AgentErrors-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\AgentErrors-20261024T081303.log
        • Size 4KB
        • SHA256 72dcacaee9a113287def4cf9b62adbac3c6b5aac7852f6b278f66075d9707802
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Features-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\Features-20261024T081303.log
        • Size 91B
        • SHA256 be5ff6485a88e454b167932e5217cc38f3c0df77ce6d6eda8fd72dd4d2a0ba59
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Operations-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\Operations-20261024T081303.log
        • Size 159B
        • SHA256 2f3069bcc7c087e0a4d0f6b584ddd397a7d1cd94e66d942d0cf743b1dc1bf2e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Version-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\Version-20261024T081303.log
        • Size 456B
        • SHA256 bc63e2db98f776c74ffb9db6c74a80884b260d6c75da5277683402fc8afe2256
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Version-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\Version-20261024T081303.log
        • Size 742B
        • SHA256 76bfa41cf845096c7bcde31423a04d835768ddd0d60d2a2f0dd890102ceb259e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        telemetry-20261024T081303.log
        • Path C:\Users\Admin\AppData\Local\Temp\Logs\telemetry-20261024T081303.log
        • Size 444B
        • SHA256 d8e5832dffed2e1c541bf965af537378d44da6047f34efc129358281edbc5fdc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        bf4bddf3db7a5e2eb9f36b9304b47816
        • Path C:\Users\Admin\AppData\Local\data\cache\bf\4b\bf4bddf3db7a5e2eb9f36b9304b47816
        • Size 7KB
        • SHA256 db090aaadd0bd59615e6209075795ae377adaa3abf7954e06b4483aba83e7542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cdn-agent-3433090
        • Path C:\Users\Admin\AppData\Local\data\cache\cdn-agent-3433090
        • Size 1KB
        • SHA256 4a5a67e6d7ebc02f2bbbd8060614889d8f57ae2bd5d85445aa686ea0ff7343c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cdn-bts-2248514
        • Path C:\Users\Admin\AppData\Local\data\cache\cdn-bts-2248514
        • Size 771B
        • SHA256 996cec1cf904d298550ea073b5b15287ed9dc29d2afaabf830b16bf2ab66e082
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e8a9e3b2b36cc844d7a26a18fce57792
        • Path C:\Users\Admin\AppData\Local\data\cache\e8\a9\e8a9e3b2b36cc844d7a26a18fce57792
        • Size 308B
        • SHA256 861e375dcdfe06f23998a42e9c9d2204d3dae197bcfac37d6ce54284e7a4a2a3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        summary--4097988
        • Path C:\Users\Admin\AppData\Local\data\cache\summary--4097988
        • Size 25KB
        • SHA256 236670cbfdd06403d73e29204a9a8b9437b6b5e5d3315e3a39e4e5c45c1c70e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        version-agent-4051779
        • Path C:\Users\Admin\AppData\Local\data\cache\version-agent-4051779
        • Size 742B
        • SHA256 0c22cba2b47d592db264d9bf70500809114664cca9709bdd4b45f31b1d1c4d6a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        version-bts-4080386
        • Path C:\Users\Admin\AppData\Local\data\cache\version-bts-4080386
        • Size 3KB
        • SHA256 feff22b93130b7b86f1a875ce10c42fa97d1a9fac702a5f5a802c8f0e75a92c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        product.db
        • Path C:\Users\Admin\AppData\Local\product.db
        • Size 193B
        • SHA256 c30cb790cb99616606eb33590029a589a69e9138de37b13cde660438b392c1de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        product.db
        • Path C:\Users\Admin\AppData\Local\product.db
        • Size 236B
        • SHA256 884755485cdc562ada61abd43fa792bac53926fa5d2bd7defceafb80b7b01da5
        • MD5 SHA1 SHA512 TLSH
        Submit Download