phorpiex: 32f29422 — Earliest-build thin MSVC9 downloader sibling (4-payload chain, grab.exe fallback)

Executive Summary

A 10 KB MSVC 9.0 PE32 thin downloader compiled 2026-05-22 06:19:01 UTC — the earliest confirmed build timestamp in the dropped-by-phorpiex thin-downloader campaign chain. It fetches four payloads (peinf.exe, xmr.exe, xmrget.exe, grab.exe) from 178.16.54.109 using a dual WinInet+URLMon fetch path, gated by marker files in %appdata%, and guarded by RtlGetVersion OS-build checks. No packing, no obfuscation, honest main() flow (no initterm hijack). Static-only — CAPE skipped due to no Windows guest.

What It Is

OpenCTI labels this dropped-by-phorpiex ^[metadata.json]. This is the earliest-build sibling in a confirmed campaign chain:

• 32f29422 (this sample) — 2026-05-22 06:19:01 UTC
• 2ffc3203 — 2026-05-22 07:45:34 UTC (reported; payload chain: peinf/xmr/xmrget) ^[/intel/analyses/2ffc320332ff30d80c0a1da728aa59db136438338409cf01a96b71e488d21b67.html]
• 025f5798 — 2026-05-22 13:06:00 UTC (reported; omits 15.exe) ^[/intel/analyses/025f57988953e3d23e1657a9af5610887e57c5390a82f73b4b2b99c30eef3b70.html]
• 6b8527a7 — 2026-05-22 16:56:00 UTC (reported; adds x64+build gating) ^[/intel/analyses/6b8527a7f761e8a5489b81ea8a79cbbbd9c09485b9b5d7c28cd892ef66599339.html]

How It Works

Entry Flow

main() at 0x004014b3 ^[r2:main] follows an honest C runtime path — no initterm hijack. Sequence:

1. Sleep(2000) — initial delay.
2. Download http://178.16.54.109/peinf.exe via fcn.004010a8 (WinInet primary + URLMon fallback).
3. Check marker file %appdata%\d3333333333333333333.txt via fcn.004012fb ^[r2:fcn.004012fb]. If it exists, proceed.
4. Download http://178.16.54.109/xmr.exe via same dual-fetch routine.
5. Download http://178.16.54.109/xmrget.exe via same routine.
6. If any prior step fails (or marker absent), fall back to http://178.16.54.109/grab.exe.

Dual Download Routine (WinInet + URLMon)

fcn.004010a8 ^[r2:fcn.004010a8] implements the wininet-urlmon-dual-download pattern already documented in this corpus:

• Primary path: InternetOpenW (Chrome 128 UA) → InternetOpenUrlW → InternetReadFile → CreateFileW → WriteFile.
• Post-write: deletes Zone.Identifier ADS via DeleteFileW ^[strings.txt:62].
• Fallback path: if primary fails or execution helper returns false, sleeps a random duration (rand() % 0xea60), regenerates a random %TEMP%\<rand><rand>.exe filename, and retries via URLDownloadToFileW.
• Post-fallback: same Zone.Identifier deletion.

x64 / Build Gating

fcn.004013e5 ^[r2:fcn.004013e5] checks for %SYSTEMDRIVE%\Program Files (x86) via PathFileExistsW. fcn.00401435 ^[r2:fcn.00401435] loads ntdll.dll, resolves RtlGetVersion, and checks OSVersionInfoEx.dwBuildNumber >= 0x55f0 (22000 = Windows 11). If the build is too old or the x86 Program Files directory is missing, the payload branch is skipped.

Marker File Gating

Two marker files are referenced:

• %appdata%\d3333333333333333333.txt ^[strings.txt:71]
• %appdata%\f3f3f3d3d.txt ^[strings.txt:73]

fcn.004012fb and fcn.00401370 ^[r2:fcn.00401370] both expand %appdata% and attempt CreateFileW with OPEN_EXISTING. Return true if the file exists. This is the marker-file-mutex-gating pattern.

Decompiled Behavior

Radare2 analysis (level 3) recovered 45 functions ^[r2:analysis]. The entry point (0x00401865) is a standard MSVC CRT startup that calls main after CRT init. No anti-debug beyond IsDebuggerPresent in the IAT (likely CRT-linked, not author-intentional) ^[pefile.txt:331].

Notable functions:

• fcn.004010a8 — dual download + write + Zone.Identifier cleanup.
• fcn.004012fb / fcn.00401370 — marker-file gate checks (identical logic, different filenames).
• fcn.004013e5 — x64 program-files check.
• fcn.00401435 — RtlGetVersion OS build gating (>= 22000).
• main — orchestrates the 4-payload fetch chain.

C2 Infrastructure

All over cleartext HTTP. No TLS. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 ^[strings.txt:56].

Interesting Tidbits

• Earliest build in the chain: This sample predates the next sibling (2ffc3203) by ~1h 26m, suggesting active iterative development or A/B testing of payload names within the same campaign window.
• Grab.exe is new: Prior siblings (2ffc3203, 025f5798, 6b8527a7) did not reference grab.exe. This sample adds it as a fallback-only payload when the primary chain fails.
• No initterm hijack: Unlike the larger Phorpiex screensaver masquerade stubs (e.g. 755bed07), this thin downloader uses an honest main(). The initterm hijack technique ^[techniques/phorpiex-loader-initterm-hijack.md] is reserved for the heavier dropper variants.
• Chrome 128 UA: Recent Chrome version suggests the builder was updated in May 2026; earlier Phorpiex samples used older UAs.

Deployable Signatures

YARA

rule phorpiex_thin_downloader_may2026 {
    meta:
        description = "Phorpiex thin MSVC9 downloader — May 2026 campaign"
        author = "PacketPursuit"
        date = "2026-06-11"
        hash = "32f29422435896b7a09888a1bb42e622004fbb11d4cad2f6d6613c97ee94823f"
    strings:
        $c2_1 = "http://178.16.54.109/peinf.exe" ascii wide
        $c2_2 = "http://178.16.54.109/xmr.exe" ascii wide
        $c2_3 = "http://178.16.54.109/xmrget.exe" ascii wide
        $c2_4 = "http://178.16.54.109/grab.exe" ascii wide
        $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36" ascii wide
        $marker1 = "d3333333333333333333.txt" ascii wide
        $marker2 = "f3f3f3d3d.txt" ascii wide
        $zone = "%s:Zone.Identifier" ascii wide
        $temp_fmt = "%s\\%d%d.exe" ascii wide
        $progfiles = "%s\\Program Files (x86)" ascii wide
        $ntdll = "ntdll.dll" ascii wide
        $rtlget = "RtlGetVersion" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($c2_*)) and
        ($ua or $zone or $temp_fmt) and
        filesize < 15 KB
}

Behavioral Fingerprint

This binary expands %TEMP% and %appdata%, seeds srand with GetTickCount, generates a random filename of pattern %TEMP%\<n><n>.exe, and attempts HTTP fetch via InternetOpenUrlW with a Chrome 128 User-Agent. On success it writes the payload to disk, deletes the Zone.Identifier ADS, then checks for %appdata%\d3333333333333333333.txt before fetching additional payloads from the same C2 IP. If WinInet fails, it falls back to URLDownloadToFileW after a random sleep.

IOC List

Detection Signatures (capa→ATT&CK)

References

• phorpiex — Entity page for the Phorpiex family
• wininet-urlmon-dual-download — Technique page for the dual-fetch pattern
• marker-file-mutex-gating — Technique page for marker-file runtime gating
• rtlgversion-build-gating — Technique page for RtlGetVersion anti-sandbox
• OpenCTI artifact: 94468ab7-3a55-4d9d-892c-9a02ca802472
• Sibling analysis: /intel/analyses/2ffc320332ff30d80c0a1da728aa59db136438338409cf01a96b71e488d21b67.html
• Sibling analysis: /intel/analyses/025f57988953e3d23e1657a9af5610887e57c5390a82f73b4b2b99c30eef3b70.html
• Sibling analysis: /intel/analyses/6b8527a7f761e8a5489b81ea8a79cbbbd9c09485b9b5d7c28cd892ef66599339.html

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, rabin2-info.txt, triage.json, metadata.json — generated by triage-fast pipeline (2026-05-26)
• Radare2 analysis: auto-analysis level 3, 45 functions recovered (2026-06-11)
• FLOSS: invocation error (invalid CLI argument); no decoded strings recovered
• capa: signature path missing; no capability report generated
• CAPE: skipped — no Windows guest available