Overview

overview

10

Static

static

3

2fe59a0eaf...40.exe

windows10-2004-x64

10

2fe59a0eaf...40.exe

windows11-ltsc_2024-x64

10

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40.exe
  • Size 285KB
  • Sample260720-rfqb5aew6x
  • SHA256 2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
phantom_stealercollectiondiscoveryexecutioninstallerpersistencespywarestealer

Malware Config

Extracted

Family

  • phantom_stealer

Version

  • v3.5.0

C2

  • https://api.telegram.org/bot8699401592:AAEL5LfW5R9smJQ81vuPeK7KHFDp2nikcFc/sendMessage?chat_id=5378579895

Mutex

  • QLPUCCCE51FMQVUACXAE

Attributes
  • anti_analysis

    0

  • cb_enables_ssl

    0

  • debug

    0

  • keylogger

    1

  • start_delay

    1

  • startup

    1

Targets

    • Target
      2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40.exe
    • Size 285KB
    • SHA256 2fe59a0eaf50f0836f9ce92ef8a08f553c836421823c5b3067caf54dbc2f4e40
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectiondiscoveryexecutionphantom_stealerpersistencespywarestealer

    • Detects PhantomStealer written in C#

    • Family: PhantomStealer

      Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

      stealerphantom_stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks