phantom_stealer | 2bb8102520f01a3b242a66e164ea24597a7eab7bacf789e59e3264e175b9d4d7

Analysis

max time kernel
298s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instant Transfer - 260514208656.vbs
Size 1.2MB
Sample260525-rmqw8sdz21
SHA256 2bb8102520f01a3b242a66e164ea24597a7eab7bacf789e59e3264e175b9d4d7
MD5 806502e36c4feacefd927eae002425bf
SHA1 b9b9a28d5ed8c9126ea4a77ea7b52497a03a2e7c
SHA512 2691edf9788fdd02d5579a3d37821dd2eff8b63da7e7756940aca31e87ef57c90830043af34411692fdce44cf047cf3316d9eac150b1620dfed4b178390a22a8
SSDEEP 24576:2YH1NumlVZ3nlAfrOlQCzdzocA/LJWSNedl4qchAy4vZb7L:vVrAS5dKJW94/RGL
TLSH
T1304523214F48DD9D7708E138DE5F37511BE08EC28478A6E34BE1848A256AF6F79B7039
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution phantom_stealer stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

1YA6UHTISPAQ669J8KKQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/2268-37-0x0000000000590000-0x000000000064E000-memory.dmp	family_phantomstealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 2268	2212	powershell.exe	95

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2212	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4728	2268	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	powershell.exe
2212	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2212	940	WScript.exe	84
PID 2212 wrote to memory of 1600	2212	powershell.exe	91
PID 1600 wrote to memory of 4884	1600	csc.exe	92
PID 2212 wrote to memory of 2268	2212	powershell.exe	95
PID 2212 wrote to memory of 2268	2212	powershell.exe	95
PID 2212 wrote to memory of 2268	2212	powershell.exe	95
PID 2212 wrote to memory of 2268	2212	powershell.exe	95
PID 2212 wrote to memory of 2268	2212	powershell.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Instant Transfer - 260514208656.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\160D2A7F.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2i2aixsl\2i2aixsl.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES555E.tmp" "c:\Users\Admin\AppData\Local\Temp\2i2aixsl\CSCC9FA56DBF97E4389AB74CE9EB5C7D43.TMP"
      4⤵
      PID:4884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 168
      4⤵
      Program crash
      PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2268 -ip 2268
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

160D2A7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\160D2A7F.ps1
Size 1.2MB
SHA256 97f3d2e277580847a66c924d6a5b35666ea5364f4f33c4100aa86d0f988ac96a
MD5 8bc3126f98c6297fda9c04a794810da9
SHA1 fb0233d51ea0eb569a3a2d8dc596c62d4eca561f
SHA512 5593e04ce6bc84379e0f38159ad84573700a38ce60a039fa75f9d8301a7a6f19077bdcd3cdaefa57a0baea172594173662070407a775d8df619a4005da63676d
SSDEEP 24576:YYH1NumlVZ3nlAfrOlQCzdzocA/LJWSNedl4qchAy4vZb7t:NVrAS5dKJW94/RGt
TLSH
T1474533124F88AC5D870831386A5707561B908BC6846D77D30FE295DB3ABDFA3B67703A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2i2aixsl.dll

Path C:\Users\Admin\AppData\Local\Temp\2i2aixsl\2i2aixsl.dll
Size 5KB
SHA256 5bec29a7209f98c83926923b261193da53828c03c2ad20ed6d5c7c86fd9b88d0
MD5 0b3d806b2045b687cd034035a2386365
SHA1 76b365df0be3818a8ddf419a84c41d4bc3358774
SHA512 53aa51193905dec7d6529b599f3b0fefe642230bd03f6295d3390ed14d80a218a2407781e6095ba4c34fd9927177be0b064986822c3e2d3760affc13531f249d
SSDEEP 48:6KnjY3k8xLJpXsOVXWZY/Mc8FfxO3vhpzmmIfib1gbmgDngdJspjBvYoB1ulya3j:vYZx9pXsO837EpkrZvYXEK
TLSH
T1E6C17411D79C1293FCA7033CADE30712DB70A8914F7B875B0AD5A21A6CABB741A71760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES555E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES555E.tmp
Size 1KB
SHA256 5e1dcb2e664f78b5c1f265fa0ed81d602002b9a0472df3847a52757b31d3b420
MD5 8cd7e852af024a1aea4cedc83e532c9e
SHA1 a2895a1b3c65d11b06c4341bbe3fe467c0749957
SHA512 b3fec55b8d7bb730bc335317dfde50c429ee9cba1e6b0c078894a6900e2971169cf1cbc83fc774bd3f9438410de9df3e1b52e8f4b1f93de2a7bdbe7864df106c
TLSH
T13F215C0947E9471EF4739B31A9F6172F9239FD64EFA1535B8540522C1C51504EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_essyzlk2.3o0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_essyzlk2.3o0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2i2aixsl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2i2aixsl\2i2aixsl.0.cs
Size 3KB
SHA256 9578f1935441fa1f73ff75db335d4a8693ca649925853908d83e6e4b8a3838d7
MD5 e77027a3d1f4e8d99e8aaac444f615a1
SHA1 12d313fa966c5e0c37c30fa4d056f220d3062349
SHA512 44038a7674713e57557a33d9c1da9a3986eb5e720fe4fe7a3a1a11c3fad781fd60f7fda25ca1dfb3ca1831ef9040adb0a99da0ac3180fc605ec059a2d64b0727
TLSH
T1EE71DF3C5346976258761119FA81A1CEE70310732AFF5A2039FD83626F7B109E176B2E
MD5 SHA1 SHA512 TLSH

Submit Download

2i2aixsl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2i2aixsl\2i2aixsl.cmdline
Size 369B
SHA256 4920b83337f44acfa529c05d503adf7507ffbf7fef7a2d920c1c44c620f1a049
MD5 c394232954fb152388a4e548edc6af05
SHA1 a1e67598d9d79cf1585bdfa8a55d84bff789ad7c
SHA512 3b06fccdd9e12e7547a7fe0f0fe5c6254e39eea8f6b78d7a450a0660ae8d14b2c846e8134c227e6126c078f0d32b008c00111c49c52da6e510553c7b741718f5
TLSH
T15AE0C02B428AC67D01DD340721A9C4BCC27607632F403F84E741844DD01700327E1F41
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC9FA56DBF97E4389AB74CE9EB5C7D43.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2i2aixsl\CSCC9FA56DBF97E4389AB74CE9EB5C7D43.TMP
Size 652B
SHA256 a7cd4caacb0c1cbb4c7bca7ec9cb4b8fd7eaef79209a0795eb3105c2c0e65e49
MD5 21a62d47b72d19308c33ff626e891b23
SHA1 73860f7b141c4157e0de99c1b7f4651d4fb82854
SHA512 e897c62a8be1c976800c2534bc5d20316a464bf6cc590087478aaed20b1b0f4059ca3524d08b67e6f5ac65073ced7a7dedd28aa74fc720cc81690bf977403802
TLSH
T1D0F05E0D63F8020EF4F38B30BEF6436391A9BC64DE7293ED5480131928A45109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-20-0x0000000006070000-0x000000000608A000-memory.dmp

Download

memory/2212-4-0x0000000004C00000-0x0000000005228000-memory.dmp

Download

memory/2212-16-0x0000000005B10000-0x0000000005B2E000-memory.dmp

Download

memory/2212-17-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Download

memory/2212-6-0x0000000005330000-0x0000000005396000-memory.dmp

Download

memory/2212-1-0x0000000000870000-0x0000000000880000-memory.dmp

Download

memory/2212-19-0x0000000007530000-0x0000000007BAA000-memory.dmp

Download

memory/2212-7-0x00000000053A0000-0x0000000005406000-memory.dmp

Download

memory/2212-5-0x0000000004B00000-0x0000000004B22000-memory.dmp

Download

memory/2212-15-0x0000000005510000-0x0000000005864000-memory.dmp

Download

memory/2212-3-0x0000000000870000-0x0000000000880000-memory.dmp

Download

memory/2212-35-0x00000000060F0000-0x00000000060F8000-memory.dmp

Download

memory/2212-2-0x00000000021B0000-0x00000000021E6000-memory.dmp

Download

memory/2212-40-0x0000000007BB0000-0x0000000008154000-memory.dmp

Download

memory/2212-38-0x0000000006EB0000-0x0000000006F46000-memory.dmp

Download

memory/2212-39-0x0000000006BA0000-0x0000000006BC2000-memory.dmp

Download

memory/2268-37-0x0000000000590000-0x000000000064E000-memory.dmp

Download