phantomstealer | 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd

Sharing

Copy URL Twitter E-mail

General

Target
4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd
Size 3.1MB
Sample251031-erblwsfv2a
SHA256 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd
MD5 735081e30afa0446d16243f6d9a7156a
SHA1 b5eb5dabae1a86cd48cdb5a2433b5d5c1e6a2b8a
SHA512 52c626bf17f96de9e30cceb32dc5c3f91233578e7013d21aada1074a44ac88d5a37f04b4e1568f67ca49c226d28f6fae6d2552b49f15137394bf4ac9a63d9cc1
SSDEEP 49152:8KsAiy5CE9ArcceIpoWKCHHl6Q+Uz/TB18kNkDC0p9KkkJmcklopu//lC16L9XJR:NPudL7KCobUTNuHo8cklSYa6L9XRLb1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Targets

- Target
  .RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe
- Size 184KB
- SHA256 5376b0fea8d666fdcc1f330bd6f34aa5623dcbcad4b0ffed53087456ee849214
- MD5 8d8309a795cb4b5c7e66bf202d111037
- SHA1 5b3c7143d89938948f1df45f64d08d64b1e5177b
- SHA512 8d38e2c0efbde236fb23ed56a9e024e9723ad8dc6f02b553f11bf1e2eb70d6ea32fbcebd8812230a1abeccdccb84fb6c46ca811f7f7d7cc149d342af439140ca
- SSDEEP 3072:pEqn/irEsrD3xo2vYsWwY6JOXnVvqAKesWu4OauYfI92YETrc3M7:l/irEgNWoJOXnVvqAKesQOauYfa2YETt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery phantomstealer persistence
- Phantomstealer family
  phantomstealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  MSVCP140.dll
- Size 5.7MB
- SHA256 363022bd7bf8deb61785a3ec95d107893370f329ae2460effc5a1addd100995d
- MD5 64837a9c4b7165f305ea9b6d1554a68e
- SHA1 2cb5e9901bc76ecbd303c765e035f228e3e0b291
- SHA512 f92bd14c9798c27138f9a07eceb8099101d209dd5e281cbdf7b45809cb8d324c1f0206195950cebee86c4542c545a29bb4f0418670fdf10abc1fb0a6f763086c
- SSDEEP 49152:BlClpF9AqFx3mqO0+rjJEipVb/sC6aF/Sad0H7/UAeVCux70BEsHIMY3LkYP2GuS:rqOrpV7Fld0bSaKMkP8BR3WKc
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection discovery phantomstealer persistence
- Phantomstealer family
  phantomstealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  VCRUNTIME140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  VCRUNTIME140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  concrt140e.dll
- Size 735KB
- SHA256 661412c324e935bbbbde27105ea706e55485a527b565fc55a9b43880cbe5885a
- MD5 8d1c5478ff8da98b10bf4f66da33220d
- SHA1 5236174d24c7309a3eecd9cd76375d2bd93cfbb0
- SHA512 3bcf38c9f86bbc40c487f7e8c833d1b390573e8e8751732468fee57cd31e74b4271ddbbb5429f513677fd651a5bac1d72f44db2b8373556596fb8a4bcda670d6
- SSDEEP 12288:PXt2CdJI5hqMNk97b9Gu3hK7kZOLhrwJVckSG6ZCoLONH523u/kaIvVmQPNOOK:PpK0AG9GTkwLufcXG6ZMT/VI9Ps
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Phantomstealer family

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Phantomstealer family

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10