Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 07:31
General
- Target RFQ Clinica Radiologia.PDF.js
- Size 1.5MB
- Sample260724-jctalstyfy
- SHA256 395064a72a02086b3ea1dc613cbeb42cc951fc39111ec380fa496f7d41f0f804
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
ftp
-
Host
ftp.waterwheelproject.site
-
Username
-
Password
w8((SVGj,)OoA4Is
-
UYIRHYK227GF3HYV49DX
-
cookies
true
-
credit_cards
true
-
ftp_enabled
true
-
passwords
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ Clinica Radiologia.PDF.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ese9rl8s\log_99455_e75b.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ese9rl8s\log_99550_e746.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d1acdfbn\d1acdfbn.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C77.tmp" "c:\Users\Admin\AppData\Local\Temp\d1acdfbn\CSC3A7B5F4AE171429E8457732D876FAFB7.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES8C77.tmp
d1acdfbn.dll
log_88620_e745
log_99455_e75b.vbs
log_99550_e746.ps1
svc_74948_e746
CSC3A7B5F4AE171429E8457732D876FAFB7.TMP
d1acdfbn.0.cs
d1acdfbn.cmdline
memory/4452-15-0x0000000006410000-0x000000000642E000-memory.dmp
memory/4452-36-0x0000000005240000-0x0000000005248000-memory.dmp
memory/4452-39-0x0000000007750000-0x00000000077E6000-memory.dmp
memory/4452-14-0x0000000006070000-0x00000000063CB000-memory.dmp
memory/4452-20-0x0000000007A60000-0x00000000080DC000-memory.dmp
memory/4452-21-0x00000000073E0000-0x00000000073FA000-memory.dmp
memory/4452-22-0x0000000007630000-0x0000000007644000-memory.dmp
memory/4452-11-0x0000000005E30000-0x0000000005E96000-memory.dmp
memory/4452-10-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/4452-35-0x0000000007660000-0x0000000007668000-memory.dmp
memory/4452-9-0x0000000005630000-0x0000000005652000-memory.dmp
memory/4452-8-0x0000000005700000-0x0000000005D4A000-memory.dmp
memory/4452-7-0x0000000002FB0000-0x0000000002FE6000-memory.dmp
memory/4452-16-0x0000000006470000-0x00000000064BC000-memory.dmp
memory/4452-40-0x00000000076E0000-0x0000000007702000-memory.dmp
memory/5540-1-0x00000203BD130000-0x00000203BD54E000-memory.dmp
memory/5540-44-0x00000203BD130000-0x00000203BD54E000-memory.dmp
memory/5540-47-0x00000203BD130000-0x00000203BD54E000-memory.dmp
memory/5568-38-0x0000000005830000-0x0000000005DEA000-memory.dmp
memory/5568-37-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5568-42-0x0000000006650000-0x0000000006812000-memory.dmp
memory/5568-43-0x0000000006520000-0x0000000006596000-memory.dmp
memory/5568-48-0x0000000007470000-0x000000000799C000-memory.dmp
memory/5568-53-0x0000000007340000-0x00000000073D2000-memory.dmp
memory/5568-54-0x0000000007310000-0x000000000731A000-memory.dmp