donutloader | hxxps://gofile[.]io/d/N8QBcW

Analysis

user interaction
yes
max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/N8QBcW
Sample260724-v48edsvbpg

Score

10^/10

costura defense_evasion discovery execution donutloader loader packer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral1/memory/212-223-0x0000000000B50000-0x0000000000D3A000-memory.dmp	family_donutloader
behavioral1/memory/8-397-0x000001D050F10000-0x000001D0510FA000-memory.dmp	family_donutloader

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
106	8	powershell.exe
108	2584	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com
12	api.gofile.io
15	api.gofile.io
73	raw.githubusercontent.com
79	raw.githubusercontent.com
106	raw.githubusercontent.com

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2728	certutil.exe
1332	certutil.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\WindowsPowerShell\v1.0\bin\latestversion	powershell.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\bin\settings.json	powershell.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\bin\latestversion	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5072	wscript.exe
4504	wscript.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/8-397-0x000001D050F10000-0x000001D0510FA000-memory.dmp	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
8	powershell.exe
2584	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2428	cmd.exe
3164	cmd.exe
3672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phantom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phantom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2656	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293880351928585"	chrome.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Phantom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "8"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 5600310000000000f85c5c8c10005068616e746f6d00400009000400efbef85c5c8cf85c5c8c2e000000a1550200000007000000000000000000000000000000f0f79e005000680061006e0074006f006d00000016000000	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\NodeSlot = "7"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 5600310000000000f85c5c8c100052656c6561736500400009000400efbef85c5c8cf85c5c8c2e000000af550200000007000000000000000000000000000000e693bb00520065006c006500610073006500000016000000	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 4a00310000000000f85c5c8c100062696e00380009000400efbef85c5c8cf85c5c8c2e000000ae550200000007000000000000000000000000000000a5bbc200620069006e00000012000000	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 6200310000000000f85c5c8c10005048414e544f7e3100004a0009000400efbef85c538cf85c5c8c2e000000f0da010000001200000000000000000000000000000075e2c9005000680061006e0074006f006d002d006d00610069006e00000018000000	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Phantom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = ffffffff	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Phantom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	Phantom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	Phantom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Phantom.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Phantom.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Phantom.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Phantom.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
4900	chrome.exe
4900	chrome.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	Phantom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe
Token: SeShutdownPrivilege	4316	chrome.exe
Token: SeCreatePagefilePrivilege	4316	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
8	powershell.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe
4316	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
568	Phantom.exe
568	Phantom.exe
568	Phantom.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2532	4316	chrome.exe	86
PID 4316 wrote to memory of 4648	4316	chrome.exe	87
PID 4316 wrote to memory of 4648	4316	chrome.exe	87
PID 4316 wrote to memory of 2656	4316	chrome.exe	88
PID 4316 wrote to memory of 3032	4316	chrome.exe	89
PID 4316 wrote to memory of 3032	4316	chrome.exe	89
PID 4316 wrote to memory of 4888	4316	chrome.exe	91
PID 4316 wrote to memory of 4988	4316	chrome.exe	92
PID 4316 wrote to memory of 4888	4316	chrome.exe	91
PID 4316 wrote to memory of 4988	4316	chrome.exe	92
PID 4316 wrote to memory of 2228	4316	chrome.exe	93
PID 4316 wrote to memory of 2228	4316	chrome.exe	93
PID 4316 wrote to memory of 4616	4316	chrome.exe	94
PID 4316 wrote to memory of 4616	4316	chrome.exe	94
PID 4316 wrote to memory of 4244	4316	chrome.exe	99
PID 4316 wrote to memory of 2536	4316	chrome.exe	110
PID 4316 wrote to memory of 2536	4316	chrome.exe	110
PID 4316 wrote to memory of 4324	4316	chrome.exe	111
PID 4316 wrote to memory of 4324	4316	chrome.exe	111
PID 4316 wrote to memory of 2764	4316	chrome.exe	112
PID 4316 wrote to memory of 1164	4316	chrome.exe	115
PID 4316 wrote to memory of 1640	4316	chrome.exe	116
PID 4316 wrote to memory of 1836	4316	chrome.exe	117
PID 4316 wrote to memory of 2652	4316	chrome.exe	118
PID 568 wrote to memory of 1176	568	Phantom.exe	133
PID 1176 wrote to memory of 2200	1176	csc.exe	135
PID 2428 wrote to memory of 2728	2428	cmd.exe	141
PID 2428 wrote to memory of 8	2428	cmd.exe	142
PID 8 wrote to memory of 4500	8	powershell.exe	143
PID 4500 wrote to memory of 3804	4500	csc.exe	144
PID 4316 wrote to memory of 4900	4316	chrome.exe	146
PID 568 wrote to memory of 3140	568	Phantom.exe	147
PID 3140 wrote to memory of 3012	3140	csc.exe	149
PID 3164 wrote to memory of 5072	3164	cmd.exe	152
PID 5072 wrote to memory of 3672	5072	wscript.exe	153
PID 3672 wrote to memory of 1332	3672	cmd.exe	155
PID 3672 wrote to memory of 4504	3672	cmd.exe	156
PID 4504 wrote to memory of 2584	4504	wscript.exe	157
PID 2584 wrote to memory of 3240	2584	powershell.exe	159
PID 3240 wrote to memory of 2072	3240	csc.exe	160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/N8QBcW
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7fff4ed8c728,0x7fff4ed8c734,0x7fff4ed8c740
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,8238156764213209315,1915628675854513082,262144 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,1992583024834149971,11650578389056749703,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,15850779131067959024,12730401013919420682,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,9171868042482967622,7962803067159417699,2097152 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,13709980394080143459,2195425816794205397,2097152 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=1696,i,1204620575223272774,4568144451296103315,2097152 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4564,i,16602075057188691051,8066441153275321804,2097152 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5312,i,7073149845368530773,17741399109379607330,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5600,i,16365309143262278509,12679379655203063315,2097152 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4752,i,7827462320287846246,12067228216747963535,2097152 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,6365756559463772531,4970344177223066018,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,18413742868784706503,15668802330856407338,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,6958798359579241259,12500846639710775931,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,10051843109994192054,11789958589728200404,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,12836490137830884970,10495117389087302665,524288 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3904,i,10662999963939375956,18080754273893777632,262144 --field-trial-handle=1988,i,10482046436208482668,15159147882163065343,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2228

C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.exe
"C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:212

C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.exe
"C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k02yz45t\k02yz45t.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4586.tmp" "c:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\CSCDE535E8DA4E445AA0A118E973EB48AE.TMP"
    3⤵
    PID:2200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sisxm0z5\sisxm0z5.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC303.tmp" "c:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\CSCD3478B11BF2644CCBF2F09EFE5CCB93.TMP"
    3⤵
    PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Phantom.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\certutil.exe
  certutil -decode C:\Users\Admin\AppData\Local\Temp\cRfGaCRn.b64 C:\Users\Admin\AppData\Local\Temp\iatpOpRT.ps1
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\iatpOpRT.ps1 "C:\Users\Admin\Desktop\Phantom.bat"
  2⤵
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xi0q3cr\0xi0q3cr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7178.tmp" "c:\Users\Admin\AppData\Local\Temp\0xi0q3cr\CSC8B6C0B17888842D48140FFB0632AD1F7.TMP"
      4⤵
      PID:3804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\wscript.exe
  wscript //B C:\Users\Admin\AppData\Local\Temp\fOEg.vbs
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.bat" _gyC_
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\system32\certutil.exe
      certutil -decode C:\Users\Admin\AppData\Local\Temp\ZUmRzTBm.b64 C:\Users\Admin\AppData\Local\Temp\GGkBsgfC.ps1
      4⤵
      Deobfuscate/Decode Files or Information
      PID:1332
  - - C:\Windows\system32\wscript.exe
      wscript //B C:\Users\Admin\AppData\Local\Temp\piDf.vbs
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\GGkBsgfC.ps1" "C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.bat" _gyC_
        5⤵
        Badlisted process makes network request
        Drops file in System32 directory
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3t4dzqwh\3t4dzqwh.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4B4.tmp" "c:\Users\Admin\AppData\Local\Temp\3t4dzqwh\CSCDB1D9AA9B4C04C0490CB12CDF6897622.TMP"
        7⤵
        
        PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4bbce8c901180fe6dfcb98080b55210ad44c5cdaf5864e7dbebb8bc3fa8bf234
MD5 9c61014856649668d3ddb3c1885edc44
SHA1 7565fd37a6d3094979853595a0e631ebb39431f8
SHA512 3f1df80450e4d59aa2f296a7c2eae3b96e682c9a03d93c83a89687941312365f348a2c25621bc5fb4677c09c821a6dd98f79684dbc5a00592673be259341ec2c
TLSH
T140E02B9ACD31EC371DFD475D90504745DA5223572B61845B3B3C8248CFB06670685D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 69894fcb2dd0278cc4e8f4d323b479474b8bf1808e631b1a108893eb0f29364f
MD5 1daa792f4f441563877fa2a01da7b193
SHA1 a4e1ea5b0d51219bf9732f29a1089bcee63397cb
SHA512 a747bad96036d4052134dde29d804c8645e22489de23715c7856031cfd72d86b3321c1ec5f96fa69aacdf50ea9a21d64c2931d24cb94688bc3027cb4c3ae9b54
TLSH
T18B01F13244E7A295D3287735A7C6B5E034F33A308A0B4E252156CEB06425F806D1673C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 43c6ffb7c6bcfd4bcb25e8b312cc9b606fa117d51552e80726393d887b1c2de7
MD5 09016cdef813f4bb1cefe203fa7feafc
SHA1 99c8ee57d333fbe3a2e670df2892037f3c3f889d
SHA512 62003478c9b7845c381d8bd321468f66de57ec0be062cf2cfd4e23ade2e0ad5cf167931439ed0efe07d20109731edbdab8f727ee99eeff4d73a245bde677ad5d
TLSH
T13A51BAF783F8952E8A2192E4AB116E1FCE690524432C3C66C8D46E1B93E3972D24478E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ddbbcd4f87dcbb17cbc38cfbd8aa2a3f0f97b85dbda2140a0f91762c6fcce89f
MD5 5c61998fb13e81c9dce8463405f0e036
SHA1 0737765f3b584eb3f76e945893ab4f368cf1d786
SHA512 f80b0f6399b308d750a65595d107d47665946c0afbb5cc51b3b80acec2430c5ecc3497d81bf342696b33d8bb63e2cd0eea9ce8a06a779501a466378b2493a1a8
SSDEEP 192:IRL0E8N8gbbv7ApAPRp2XlW9qHsb+WNnA9Qud203wkwI5VyIsnAUge:IRL0tTjkUXTkwIn2awGe
TLSH
T1F642C72EFE10693B9CDBC229F9257B53E7F6102562D42E94EAFC8A1C14D76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c7cf0b84eaa403d29593a632259aa080a123247f286f302b799c3eacb9bb0cb
MD5 f1302adfdcf1c5e1b195b255c8a640e8
SHA1 7e8879170b5b835c0c8438fb1f8fbdbcb68942f5
SHA512 fca710971024550d2ad49468cfd1e6c5f4f943a77f2213133dc2b3d1b2780413d5f2755f69c8d142dedf219dbf566f34e9fb05daa00ec4a2ac13af2a330e18f3
SSDEEP 192:IR/O0E8N8gbxv7ApAPRp2XlW9qHsb+WNnA9QI3eq3wkwI5VyIsnAUge:IRm0tThkUXTkwITeswGe
TLSH
T1D642B72EEE10693B9CDBD229F9257763E7F6202572D42E94EAFC891C14D76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1d53758ae8f0118858c55ad37c9a7d8cb01c625ac4f1b23a581ab135d51fd9e8
MD5 6f757ac700ba62311334d68ab96143e4
SHA1 6568c9991400fad745e33200ae5163d1278e1b3b
SHA512 d52d075f685ba8ece837c442a83c4379483b61b5c28f168253ff831aa34c2e89f52376cb146ca6a253a46eaab3dec0541d08153619ef675c2d6dcd4a7514d1cd
SSDEEP 192:IRB0E8N8gbKv7ApAPRp2XlW9qHsb+WNnA9QI3eV3wkwIFVyIsnAUgE:IRB0tTGkUXTkwITeJwuE
TLSH
T10F42B76EEE10697B9CDBD215F9157B23E7F6202562D02E94EAFCCA1C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5a425278bfe2a62f6499a2e8f9fa27f4a5a1c994de22d70b67a005c6fc45450a
MD5 24e77070a8c3b192fad39920529772b8
SHA1 fafea69e08e7f717e2cf923e018b9eddf6373a1b
SHA512 ea2fed9ea2bd635a22a0373756f0639c9d5fab3f4daef90fc2e974c6905c1c9456b288a0fcfb31e5e1cc08cc05be78dbec8f6af79fc7f9f1a8eaced943f53213
SSDEEP 192:IRB0I8N8gbKv7ApOqPRpJhXlW9qHsb+WNnA9QI3e83wkwIBVyIsnAUgE:IRB0xTGkZXQkwITeiwAE
TLSH
T13252B76EEE10693B9CDBD219F9157B63E7F5202562D02E94EAFC8A1C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cf4bcc4b3bbb139cb37f243c711e51904d3a19888887e0b124dbeac929702051
MD5 1100516ef11cf9d7b817dc1bfe274a95
SHA1 849e5a3abd6008d2252515257f3289839627a43d
SHA512 a969d75535f25b66a83fa28345538817522ad427e20554bce0c1e727b88f36fe454e09b34b98ecdfe9c679fdba599e62f3602e0ce935b304a75a394db934b99c
TLSH
T1A2B0124880026102C44306F411463498B114AF10960E170143F479638C265508114062
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591cb6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591cb6.TMP
Size 96B
SHA256 b6a08fb6ba23941e6d97a2710cae86828733e30ca825bde1eb84f9a88aea76a1
MD5 965eadde5a40b8d5f369ba64d2fe634b
SHA1 590ace96992e710a148eb3cf307a7eaba5e96ee2
SHA512 a807fbf396727b074dc6f0c96f5ee67c8027f7291125955d23c5367fd03218283478307f0e25b030b55c09a4fc0b226a96a5c9abae1636b4666504738fbfe07f
TLSH
T1F9B00269C103729EC14203F03DAA9AD871A0FF75D643121692F01A67ED76660C565962
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 42c8ba15ddff29bf17ef448ee68002445e663f8d9bdce6695feb02f43288305e
MD5 0dfa5e7f57fce7b909a0d958ccaba3de
SHA1 7209f98989f984665c8f1b0c72f303f51c04e8eb
SHA512 2fb0183375ae498ada8537fe877921ba2d5fd3a9d57fffd67d822cc431824484dd4ad15b051cff143ee87e84ffdd5df817eba302bc877d1a7148a6083309196b
SSDEEP 3072:qWGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Um7Rkm1tYpBeh2BAog
TLSH
T198C3123B5D74E8375DB5B75EB08E0A1F1EF249A7C924DE92C8C85B0423E97CD0A44A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ec9a1211883ff3dc788878aa3ecc991048c60635b0e21302691bea97202025e1
MD5 c6afd06e51d0d61fbca446f7f32f0681
SHA1 67f6f8c4567fdadf853b9a0a0ffb887cef970069
SHA512 9e830adfc86064993dc86d06ae628c520eab3bfc45fcc4a6ed5e6e74f34515e12192cc58eb2e0dd96c64e1a5a075f1b90500dcf26e8a1e97c12a981089b2def2
SSDEEP 3072:TWGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:dm7Rkm1tYpBeh2BAog
TLSH
T198C3123B5D74E8375DB5A75EB08E0B1F1EF249A7C924DE92C8C85B0423E97CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 44c16617269177648f3164a94a5c2473f18e85036c2e9e9b490ddb90be00b523
MD5 7f5304a4c01854ba0ac3140a1b904305
SHA1 67d3aaba20075b2a3439dea27e70e270bd1ce1fb
SHA512 052fa2808fa58d7e454d2c54aa20d4661b2d9e26ca03522f3650da0b539a940089e6f1fa3925276721230aa6acc953d5958d4cb47129fc85cda50c5431e997e4
SSDEEP 3072:qGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Qm7Rkm1tYpBeh2BAog
TLSH
T187C3023B9D75A83759B9B74FB04E0A1F1EF249A7C924DE52C8D85B0423F97CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e00e6ca47d8e73fad139697e45d7a606ec3475249faf26dfd537b77600f5fa5d
MD5 912ed8007f60a00ce92edbefa0ad0bc6
SHA1 12f2260f0327faba39e2dac1b2c252f482645854
SHA512 a917bd80281ca12364f0414a40cb264844f21606b639b97ae6c10f2a66afd763c675ac47ce6c827f8736680a70351fca440938cb73d6196b144c77d27ba5e64f
SSDEEP 3072:AhGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:nm7Rkm1tYpBeh2BAog
TLSH
T1C5C3023B5D75EC3B5CB5A74EB48E0B1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 d9a35778ef7a451d4e89e6c83c2ed8fb8809a07eef2a077ab044164abf1ab948
MD5 97ccbd30cbe5c0a3965260ae57e6fcaf
SHA1 41e28612cc7fc76ecd6142699489dd693065b82c
SHA512 255fec1e8c3ea0c384e8bdfa93bf68272b9d3b9fedd050fdd0ea50975cf526f8352d238c0e594530dc8bca6d10b6ad700406b1a62f0c9a9dcf10d12f7c3fb9ed
TLSH
T18D71CC713375B0D889167F471E2919C053BF4356AAA4AF4CB698625EE92600B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

Phantom.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Phantom.exe.log
Size 1KB
SHA256 1986c5a00286a7bbb272103161f960b11d47e6b67900eaa14e0160bc7d27ca94
MD5 3da8c0e0973f3328da5363ce1d655b26
SHA1 12e5547ce28ac5e8b8cfea10cb228fdb207f3d6f
SHA512 7a351d62d80a19a1682b54a8850afbb58819f03a7beae9b1feac7246a2d7f275e253ed40e4a9f3ecfecbca4420dae2571cf88872c8543221d490b51949e949c4
TLSH
T1A43169303262B4D54D022F930C18AAC522FF474D6674AE5CB959325ED92A4579B321F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bb386cfc6dc85a9a732977592e0e6424b5b5d3480b5daa99aa57c612441c5404
MD5 c962bc75337db25fad581ef325397c70
SHA1 d41109d85d9df18410ba58fb284d202117269079
SHA512 2c5a1d25adb42308d2d3a6375072fe2e3b9b0a0d27c0aa09388853d078aee9d051f16c05313306b36cd0da66f13d5514f5e1fdaaa61e7332418f0a3cca8600be
TLSH
T12E216873B78C8961DC8A413A94DD9C10767583D740AE9ECF7A84D614E17F684CB611A0
MD5 SHA1 SHA512 TLSH

Submit Download

0xi0q3cr.dll

Path C:\Users\Admin\AppData\Local\Temp\0xi0q3cr\0xi0q3cr.dll
Size 5KB
SHA256 f649823db6006d85768f4c708d6b19f2f913cfb573226bd34aa6e26ff517a380
MD5 eeae3161c10ae1f53f0c45d6994bbfce
SHA1 780a24a0a3e3223363236057e27945679d44c341
SHA512 2c76aff1f62bc70201dfd798dff171c10a2e4e143c36f7ed25a876d18e75fabf85181203c2ba18f5d161d9f7641630296fba2ae5c96fe10cd48f6fcd400915d0
SSDEEP 48:6zSGlqzc1e+ams6l1shOrIOSApil5AaBQdb1JY9AYok3Ol6l8FpIt71ulea36q:5Gl51k6l6cUApiUa+43Ol6lCIOwK
TLSH
T19EB1B70B87E44A67D4FF477598F303632678EC105BB3679F108421693DA13B89E35BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3t4dzqwh.dll

Path C:\Users\Admin\AppData\Local\Temp\3t4dzqwh\3t4dzqwh.dll
Size 5KB
SHA256 067e3ad9b1ebcac98b739654b574e70c57d1849dd6dacc3dfd81464375be4c18
MD5 6901f779f4d6bd9d0a61690b94ea3aa5
SHA1 147cd619231e087d32fb28dd7a52e74220cda226
SHA512 89298c23589f67552dd60472f045be1c2dc94b997329ebe6bb077a64428085df4b8aaa117c13020cdee7ede5d4233f08ef3470736bab5821d0dd2911471d6551
SSDEEP 48:6SSGlqzc1e+ams6l1shOrIYAEApoyCJaBQdb1JJAYok3Ol6l8FhIt71ulJa31q:qGl51k6l6cWEApjoa+v3Ol6leIO7K
TLSH
T1B5B1B80B93E94A23E4FF473558F3032722B8E8155FB3975F108522697CA13B85E35BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GGkBsgfC.ps1

Path C:\Users\Admin\AppData\Local\Temp\GGkBsgfC.ps1
Size 4KB
SHA256 872c7256b9c474b175f7621c360cc02bde01b5845a41208011b38c4159610e01
MD5 71479a8cebfb7658f3e36a38f187ecb6
SHA1 04f70820e3e1a4757fcc3c8c7390ff9327914258
SHA512 4a04caf543edaa9e2558985b92a3bb7d0d488c1a86dbac6104addfaff0918f0fe8719fc5a8596b6f55a15640e80b6a69b4c5df12f3b79299a09368c276e0ca88
SSDEEP 96:AopsvqHl29M8qjfRF7znujJ23EqKlDteM72BJDjBp3t2K94J9RE9OCKO2ZP:oiH/jfRF7qjJ2UFrqt1+A4PQGZP
TLSH
T1959146782729E65CC0F6142E4BBE8119E6192023575B6E00FADEC7D0AFB9534C3B1B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4586.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4586.tmp
Size 1KB
SHA256 3fc03470e953e8bc419160652c24288ddd0eb8adc75483374f53da12ec855529
MD5 4ee441f1f9be6a129544539eadba92e5
SHA1 8a374f907378a1bd45879e7e777e18a24e72eac0
SHA512 4726456483e4b33ab5cb55c44d2420fba2a62ae2ae902352b1c816d780afc04fee9991b26ee1bf6c3331853769ae254c65fb4f93dcdccd71f2929ad36cc6a074
TLSH
T14C416600A3EC072BF173433368F64319A638BE54EEA9534E7184112E2E12340DD835B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES7178.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7178.tmp
Size 1KB
SHA256 993c5fc329d931da7bf73495a4667d83c93dea610274c3fa7b9e53d03a6fda65
MD5 d983a1b6948b344ced60c833ca2f6c81
SHA1 1c0f3db67faaea2ae5189787a3bbd94f1d67041b
SHA512 cfd4348a01dd8470ba4fdecc6dce9131231491557779f74839d30e1ee6928c74a0d79f8f971fc0e0a53a6622e647c3ee87c805f70248fa3fcef588026a475c4e
TLSH
T1C821AF0587EC471FF0B35B32A9FA175FA628FD65EF62539B844002292C51504DEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESC303.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC303.tmp
Size 1KB
SHA256 90704baf06188bab21cf8c5b0f62d3d124ab7e89d6208013f2e0d2737a88be82
MD5 c56404023f99c575845bb0e39df61bb5
SHA1 344520a1b6ac13b65d4570784d76ac5f46315570
SHA512 c9e0b6b5502dfbb0a6f59df0c14e74b288f5ac5840fe6d56582cfd8f37121cd8edcffde6c49fb72c0cea2302fb6b037a8461ec8e4cf08f995dd1468bde18240d
TLSH
T13C41024193EC4B1BE173433379F7432AA779BD55DFA9835EB584112B2E12240DD835B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESE4B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE4B4.tmp
Size 1KB
SHA256 577ec066cd117895d2aaa476fbb46221d8013f451d56c41f99b37cb7ad253535
MD5 cdaf725eb037cdd9ac61d853c9506d38
SHA1 3698ce049e1272761d767d7cd71df06392ffd94d
SHA512 4a7285657245fac3e3b8798797430ca7189afb73591da7742d9922b5185cb9b664aca19f97e265b8b31e4b244b460222ea9f3767019151cbb199637ec9897076
TLSH
T1A021800593EC471FF0775732AAF6171F92A9FD54DF72A36B8540022D2C61504DEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

ZUmRzTBm.b64

Path C:\Users\Admin\AppData\Local\Temp\ZUmRzTBm.b64
Size 2KB
SHA256 603ad85764d9755bf47e54bc707b3930bc006b0621b50519e48a9139e6fa9f7e
MD5 f970b2b236c0073863baf57c3552c43d
SHA1 f4188b075a2b323b82088670ee2b7849d8c3c097
SHA512 9fbc970f66ff55a3a4ffc793f4f76392561b89ab47a3410dd296edab1c85255b4ac3d8f9c261bc54d70fde3dad700cd21f879da6fd91f96261a3b63953dd0594
TLSH
T1E551989BFE660CAD0798A15390CDACE60E9D5BEB78B215EC421A5F4844FE43810F53AD
MD5 SHA1 SHA512 TLSH

Submit Download

ZUmRzTBm.b64

Path C:\Users\Admin\AppData\Local\Temp\ZUmRzTBm.b64
Size 4KB
SHA256 d4b0fdc037bf02e979fd956a4015d359514c0ed878a5981e208a996706c0afaf
MD5 0e4ecafd5a4af42b15232c031f2682d0
SHA1 0c1a80a46a285c53cc868cad666f2721a05d82b2
SHA512 6b5d6d3ac811a173b3b8c31969827f531d564c371ef6ad813457e821bb7a3a14f14b79d3c8275e75034e2afdf6542b4098acdae12f57e619d568c32720dfd081
SSDEEP 96:wUHcNXYuAWBNRLmAN+YBEHaT+DoJuj4eyVyv4h4pqd0:RoBNxm4+YBwaTxJuj28s0
TLSH
T13991C757FE2A0C5C07D8914390CDB9E62E5E2BEB78F215ED460EAF48557D43800F12AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZUmRzTBm.b64

Path C:\Users\Admin\AppData\Local\Temp\ZUmRzTBm.b64
Size 5KB
SHA256 f14d669cde9bf84d09f76c2916b1520e8d67a78cf50fb3a688816bdd4790703f
MD5 a1f32d422325382f6931616160ef33e9
SHA1 108d360453da003dbf6fcf88ab615865fa45cb48
SHA512 a791d94933033824aea6c15c935df745a738f2cb9bd7b0030268d5445754b87b7bb1e7a8b6a48581a6ff3f646d1276d23a9c7620e83115c4acb4b56010d1002f
SSDEEP 96:wUHcNXYuAWBNRLmAN+YBEHaT+DoJuj4eyVyv4h4pqdGVe+0SSEiz/q:RoBNxm4+YBwaTxJuj28see9nS
TLSH
T188C1D916ED260C4C4BEC524390CDB9EA2F5E2BE764B126ED430E5E44557D83810F12AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_34u4u3wd.nhj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34u4u3wd.nhj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cRfGaCRn.b64

Path C:\Users\Admin\AppData\Local\Temp\cRfGaCRn.b64
Size 5KB
SHA256 ff5fc7e67ce9b53e57fa11560740ef70e15ef8ebb0fdb6a795c025f861733002
MD5 47a0ee297222de12c490babfefe88322
SHA1 5240a44bff13fdb9587f5b9f3f36ab5f47cc8ae2
SHA512 60c76866501c24d79d3bc8ef400328d4963d508d7068c4174c25bbf3d5d48d89c3dce9e455d56a6f195c91e6a2c3ca86de83087347e4e402b7ed963cc9a2ba7a
SSDEEP 96:xTHcNXYuAWcRdmKM+YBEHaT2DiSujiBVVyddAvSqdGVemCdVSnMWJl:xroczmb+YBwaTnSujiBVydATeemsC
TLSH
T1DFB1C616FE260C9C87D8A24390CDB9EA2AAF5FE764B119EC561D9F44597D83800F02AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cRfGaCRn.b64

Path C:\Users\Admin\AppData\Local\Temp\cRfGaCRn.b64
Size 5KB
SHA256 19f978f8f61e439fe7a58e9d8bb8782f30079e9dbf2d44553822c0b5f9811a93
MD5 3c4ee2a893d18396e2d060e983602cb1
SHA1 9cd2d734a1be728777a898d82e07eaf8628e3076
SHA512 60c7a2acf730a81963de6b1421baf4813fcb0a41c7bef67a432c2feebe3b5a69ec3b5fb3bacc91873bd827213babc30776417b5d490b6e15741a5584864375da
SSDEEP 96:xTHcNXYuAWcRdmKM+YBEHaT2DiSujiBVVyddAvSqdGVemCdVSnMWJknIDbDq:xroczmb+YBwaTnSujiBVydATeems3nMi
TLSH
T157C1D616FD221C8C8BA8624390CDA8EA2B6F1FE758B11AED531D5E48593E83810F01AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fOEg.vbs

Path C:\Users\Admin\AppData\Local\Temp\fOEg.vbs
Size 146B
SHA256 568668b8473fe80b5e55c8799ea1f412865e1235ed8a085c1e93cecae0f192d9
MD5 f3f904d709a230dbead92b11d801ff94
SHA1 5cfe7095209d82721539b9c21643c697ace86536
SHA512 77c4ef94d23b86663c52108fdd3a230d3a38348b04da7559d477ec8bf6199ed2768cdd262c906119194d8ec775af4eec940cf8dc9c1848ac18af9e72388389b0
TLSH
T12CC08C2AF00CA43B0107C0AB6831800C9990EC046634B6064D84840974B7C92684AC27
MD5 SHA1 SHA512 TLSH

Submit Download

iatpOpRT.ps1

Path C:\Users\Admin\AppData\Local\Temp\iatpOpRT.ps1
Size 4KB
SHA256 875bd5ff7f1c8080079f7e4b84f01e4115987a4b96107213598649e43aa9a22a
MD5 d5913a7b35a2573fe9146d10f8055c38
SHA1 0d5ca6cb376f2c171bbef3dc77b668c5c3645b75
SHA512 aed9e9773f01b30be0edc3cfdfcfbbc3321dbe0db5b55b842c52659c04cef182e92fdc8f36374c9cfa0497d893460f37e3818eb7c916e52fb6c22cdf8c976f09
SSDEEP 96:AoqsjHll9w0sJjfgUOxF7zyujm2BEqKl6TeM72Bj0DjB+3t2E0Il2yhFvaBtYO:XjHyJjfgpxF77jm2OFiqq1JHIlrhO
TLSH
T16C9174782319A658C1EA206D47FE8059EA1D243297AA6E00F9CFCAC06FBD43483B574D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

piDf.vbs

Path C:\Users\Admin\AppData\Local\Temp\piDf.vbs
Size 287B
SHA256 5d8ff9d9ae5108186bdd777aaefad7e57db78d1f8731060f26dff10c4a1f3921
MD5 b24ceb5e781ddcaf3c9c0270a2e874ad
SHA1 ebca26ef403543d12bd08fb3a6be7a233bdfaa95
SHA512 3564e235f562aef929defb301b5ec520abffd689f926d013b714df3f2aaaddd44266ff528de702641da580eb6596905b4d190f258c92d5a6d561e18ec87f2682
TLSH
T165D0EB16F11CC32F8907C87F20B2C07CC9A2280C3704B7146AA0840C788392ADDA796B
MD5 SHA1 SHA512 TLSH

Submit Download

IIjXrEHFmr.tmp

Path C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\IIjXrEHFmr.tmp
Size 1.4MB
SHA256 993229c19750d04147a1f5dfb186bd1da9769de7a78384e77b02cc884776b23b
MD5 ca176304a40adbc6e14eef354d866e48
SHA1 70a3d18c5014b7184b07d82c9d552f9d74699d81
SHA512 d64bae37e4ae494dbaacd2764ed48cde7ebbcf435fea0313f1a4f774aac6b29f945a9d19ceb5d3057aa80bdc4416ffdccc699d17671b80c07196af291d2dfc76
SSDEEP 24576:m8FTI5YcWzKnTv/gSLlEShxjgHBYrJG4rbHPZ6TJhbU6IBC749:VJVcqKnTv/DECx4OJFXsJh5sCk
TLSH
T18065337B338681E2C4F140BD74F2AC786BED7C6016C79563D0C997C9B75F286AE28660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phantom.bat

Path C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\Phantom.bat
Size 1.9MB
SHA256 c225d79ab787cc47d31be1db23dbdb7dca335dbd0d3bac7121e1d8f8d5f92082
MD5 f9a898154e4a135ad53e65b988a6e719
SHA1 0259669976b2e005b215ff692495f9c1a90b1cf8
SHA512 788fd655cdfbc9990ebacdc56593873964a96dc5fadae99105e4e3e0fc0540fbde31552586feefcddfff95736346dc175d73820640c019862158363cc337b059
SSDEEP 24576:oQuWAG8wlRQo687cq4AcL6cOSaYepdoWzmy9plXhjLs1djw0V91pp6yQOuD11oUO:o6vcR6k+d7Tid591Vtkw
TLSH
T1A99533685E6E5D3C4E589311A67F7E0F3A625ECF8005E0BF43DAA4D2091F7C152278EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\bin\settings.json
Size 195B
SHA256 035654d8bc98cac0773eb883a2bb8647839b5d2b90aef42ea5bda9c25c7dbede
MD5 22187911b73c66cccc59b77cc9cfb590
SHA1 1b65f817536fb0f3f8b31c23868cc680dba6a531
SHA512 8c93e43136c80c2ac7225c25b1b89103cdb90f267c482cd3298c8c8ca819354354f648992bfdd90fbcdbdf8d9a5f245d33fe21d31f3b39ee46dc13cb40041485
TLSH
T171D00212E1A612FD5671A41DC866C25B63098F5930B50C53F0FF945572B2432355CFE0
MD5 SHA1 SHA512 TLSH

Submit Download

uLuWwVNael.tmp

Path C:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\uLuWwVNael.tmp
Size 1.4MB
SHA256 d6aea0c113fe104c50bc8fffea11bcee1be49565884e0ce31b5caae72fd8f6ca
MD5 f9b5a58f8fc49cc9eb2644508a89dcb9
SHA1 82827db82f6197e6020279cb96142218aaefc2a7
SHA512 30c023b9a656b3513d27ee184e298e22e1ceb0b036e6c8e8c25aeab36f434545126a760cb633d63b9e8929f09218e18c51fa2d6a18c77927b0d20dd4525cb261
SSDEEP 24576:uJngTcv4atGtwvm6kEnP+l3Mdv1Z+5W2ukhdqZTpmtq9suJ48mu18GJ79f:uuTK46Kwu9aP+l8lb+5WHFt9sufR8GJx
TLSH
T16C6533BA077A071CECE6237DA0A5706AB830B6993669CC0FAEDD51B76F224C4C5DB414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Phantom.bat

Path C:\Users\Admin\Desktop\Phantom.bat
Size 1.9MB
SHA256 29e83c84ee6be726485d4fdb8d6cc29d5fb5a91f91dd33c48f68d86744621d55
MD5 0f7210fcad6fe686701fc4b4d7dbd5f1
SHA1 4322402dbc96041d30d6e7fa61189d6675b4a157
SHA512 fd223c7245f671756d2c6215370674112adfccc907fd7404cf7223369e39e74cf2b1fba6d023b0b338710dffb66e55969e2211a1119a8c145084743ce7fe2b50
SSDEEP 49152:jxVxSGX9ZFhVbrHALdWjOMLSSVDI9HwpNgw:5
TLSH
T1449533719D921CB90F1C8328217F4A0E3AF65F8B900EF5E7926749D7239BF50164B8A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a13a9b8f-5baf-4bee-be8a-97ced6b202f4.tmp

Path C:\Users\Admin\Downloads\a13a9b8f-5baf-4bee-be8a-97ced6b202f4.tmp
Size 69.7MB
SHA256 e39d0d70137d3735d4382206a131dd1ac17cc95ef4e65a2aaf37742d087fe338
MD5 1e18428a9766ff5fd4faf4a78a46e5c8
SHA1 f72fe33d44ceec849650daf4dcfa5b3bff2bf641
SHA512 62c45c768cdd1a54c60f6a6a97dce33a8bdacac6a494f4ec0b1d626967c5588bb7e220605bbb9232b9d53e6d0eda39722871928460bedb66bfeb6904d9c8b4f8
SSDEEP 1572864:EywZG0459rMZDvUhiKXn176xk5BEG6j9cj+MUvY8iRpaa:P/0JVKXn1mxk5BhIcj+68iD
TLSH
T130F7333CE74DA5A3D65B3BFA741182CC1BAA25B43564ECA57B800F84A41F1E53F33266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

latestversion

Path C:\Windows\System32\WindowsPowerShell\v1.0\bin\latestversion
Size 6B
SHA256 7f98e71c92f0055050a542c8a53e348320c6812cbfe33c12c53c1b153080a2b8
MD5 f619991470df8b3a8ad907be8bc5fbd4
SHA1 bc4e4059900aaae75b342782f25c0e9a816f4347
SHA512 233292d764583d5da869ec0e2d8af459c41a82eccef7aceb0e434bd4df65970948f2a301e57d082bfb1f0d8cf3d5952fc5625a4f18ba19a5f15ed893f0ed3044
MD5 SHA1 SHA512

Submit Download

0xi0q3cr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0xi0q3cr\0xi0q3cr.0.cs
Size 2KB
SHA256 c288ca55e03cbc9c0f400351a37073733f306ee0552d8c4b44634ad7163e879c
MD5 565884d8130dabc0b8c9a82824fd3f72
SHA1 3c655a713566ebdd75890b7578c15c52e0fd0c31
SHA512 749048745cb791704bc3803f53fddbfd1ff8f8bb0c608a9e3340ee38b395a65c94ac36b351a2eced0205c255f65e977f10f5ed59a7b7087ea82b2ce7f6495c9f
TLSH
T1BA5143A467189659C4F9201D87E5821DF24F74334BFA6B08B99F0AD02FFA424C375B1C
MD5 SHA1 SHA512 TLSH

Submit Download

0xi0q3cr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0xi0q3cr\0xi0q3cr.cmdline
Size 369B
SHA256 8d4a9310c4adab05a92fc4154796ec8fcda1b2d55ea8c3e65cb969b1d1384a36
MD5 304f136063d0c3e8bb6d24e0b6730412
SHA1 4223a304d8eb2d7b12bcd83218299971187a0558
SHA512 a43ac990291d9bfeb15ecc6d2cea2473a5458e4cb397e263f9f9ce45db6d48e057b4aafacb39fb7c4fe035d78bcc793b4057d758008e10ffc817f3920111c96a
TLSH
T187E0C02A4246C27D81ED63076269C4ACEB720F4329403FD45044440DE017148ABD27F1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8B6C0B17888842D48140FFB0632AD1F7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0xi0q3cr\CSC8B6C0B17888842D48140FFB0632AD1F7.TMP
Size 652B
SHA256 1adc4a866722986cca279770670810ce3b3efa3009fe2f445084030c3a2a9ec0
MD5 acb82952818b6cbb2d7be35fe4d1b732
SHA1 02e94fe9eedc601b51263a4ebe7585272a04e1f3
SHA512 5baa54ae78a9b53326e3d7c97b672af04c42ce581d7d728717c0856e5779f7d3fbeb068d430ab9adce9b3823c24e210cf710ece613181dc37e30d004a3a17d98
TLSH
T172F05E0A67F8420EF0F34B71BDF643A395A8BC65DE3293ED144003592864A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

3t4dzqwh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3t4dzqwh\3t4dzqwh.0.cs
Size 2KB
SHA256 122d602568e676145f1487ff8dd857b181ef1817da3b8cd1c8d1316a1b1a6f30
MD5 b4f3cab10e5fa5705891d36ba08f288d
SHA1 6ca4e66a4491368b61eeeee902ab55ffe52e62ad
SHA512 f76f642ccded0ddd7ad57eda09c6732aca395a66b47d5872c660709f7b659df9da930f893ebb13bcc508a3875c5a7eef083406cc6baff9c08e8b61d7e168bf14
TLSH
T17051E3A46768A91DD4F6101E8BD9C22DF20B707347AB6B04F95F46D0AFBA124C2B1F1D
MD5 SHA1 SHA512 TLSH

Submit Download

3t4dzqwh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3t4dzqwh\3t4dzqwh.cmdline
Size 369B
SHA256 96ce16016e8de48a72764ea22af05f4ee42f1d7284efd64529984971304eda7d
MD5 3992f2d875e197dc5d7cb0c0a7e80e8d
SHA1 537b30190e5fdc7a3f7e8e545514c58a85075c54
SHA512 b46ddece87b849a0e7baacccd8f0edfc84d39c85758f401ca275dc91d807fb44eefbf20f5c0b7cc6b84b74c97abb683d21beeeb726aced7652601da5d5ff25bd
TLSH
T17EE06F2A43CAC27D09E9300B227AC4ACC2B206DF2A823F8C9040850EE4A70002BF2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDB1D9AA9B4C04C0490CB12CDF6897622.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3t4dzqwh\CSCDB1D9AA9B4C04C0490CB12CDF6897622.TMP
Size 652B
SHA256 39d7205ee7693ae1fa7b3de62bf7d7014ec239590b3581cda4bcc10eafad175d
MD5 ee63cc51ac99fc4eab2a0aa79b3c30e0
SHA1 af1ca90721ee24995fff5c64dd90321a20e40e72
SHA512 5019e5c2953c6d0fe58d12c9835743556c4fad11da85e52d2e5efe9844da0a505a6a39f466eef6ec4cbde87c3734c446677997e235a13f1c3f8cd8aa0cc15eee
TLSH
T179F05E49A3F8420EF0F34B30BEF6536391A9BC65DE3293ED1550031D2C646148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

k02yz45t.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\k02yz45t\k02yz45t.0.cs
Size 13KB
SHA256 0d77e87e4e7b8a419f5fae043d35e52dc2d83adf57e0b9ab405ee98d9f5b71b5
MD5 c2e0b625bd5961143bb09e25069965c5
SHA1 add922dbeeacd8e2e690c18c0cca3540a21e654d
SHA512 da7c8ee024bce2a4631f472b4c5c6c66f58515d49a103c4905d50c63dc62816f11bf7828f8ccf6162404b3b916ce1cdff187dadcde585f0a998c339e4f1842cb
SSDEEP 192:3sguMHf7jCsIQqBQE5je+aMFwE6aF2QDqCcCRuGIjJEIUwS/YQCHmjkO6MFNv6BK:3s7MstQEs9ewSg+LFNxlY/s
TLSH
T18952B68D2E63C63854F3703ECFDB4219BA3651272BEEED20BDAD81109F51424C6B5B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k02yz45t.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\k02yz45t\k02yz45t.cmdline
Size 271B
SHA256 ae462c966c3226d16d6e69e52cb6ce7d4d8e5f8688fa4c1bd48ec38ab8c84907
MD5 0517d7bf2cf18324fe9f0250b977f1f6
SHA1 9b7a3d3ff9f497a4e09b420984283b55cd250cf1
SHA512 4b3a1918f1ef0a3e4e559e0a3f12e270c05ea067a88a9af4aa231c1748ad1128dda9fac711eafe40ffae8611f638ced5844ffed57c62a8b1dc24154e88186a86
TLSH
T159D05B7A53A9C27C251454471491E8DC07B3972734587AE1E190455CD86F14973F1E43
MD5 SHA1 SHA512 TLSH

Submit Download

sisxm0z5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sisxm0z5\sisxm0z5.0.cs
Size 13KB
SHA256 bd6b39ebed66ab8df71fd3433a1c32a195d5356756aab33101fa1cd564bba2a2
MD5 971700a8af57ffabe2f7d6df88f46bfa
SHA1 c58d9bf97541ad4f09660e7c7de3ec66ce9009ce
SHA512 8ff033a9b265c0c59b4d30617ba0f8267f7be705c52034c765cad90821779e404071821be868237e4b99dcc109ec81fbb550d26171949b383927c5ce2bc055a1
SSDEEP 192:3iguMHf7jCsIQqBQE5je+aMFwE6aF2QDqCcCRuGIjJEHUwS5XcmjkO6MFNv6BpY2:3i7MstQEs9ewSfAFNxlhps
TLSH
T15152B68D2AA3C53854F3703ECFDB4219BA3751272BEAEC20BDAD81109F51424C6B5B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sisxm0z5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sisxm0z5\sisxm0z5.cmdline
Size 271B
SHA256 d173e018e8577e44e5be3be36374c5c948b28898a9d0dcd548f87132dc277255
MD5 9ea3e114e2658e5eddb11010368251d3
SHA1 e92b3fd361e116e7668471c048eb91b7396a63fd
SHA512 2400f66902900c1cb4c0593ce35ed571ee581a51a4120c1c537cc191e636de45765fbade781af01bf86c77b86c928ddc74100e9525883109866c371420b62ab5
TLSH
T103D0177A47B9C37D252824574092EADC07B367632918AAE1E1A0494CE42B58673A1F82
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD3478B11BF2644CCBF2F09EFE5CCB93.TMP

Path \??\c:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\CSCD3478B11BF2644CCBF2F09EFE5CCB93.TMP
Size 1KB
SHA256 94c2f489044eb029391f7e94417230fb21e8f201cb64e57d10635ad0315f8b9a
MD5 b8fc599de41b31e95bb696559f653904
SHA1 7d464c5b83a46ee3c9598c6e1199686fa07d9704
SHA512 313bc9809ba2e3fae0afe631a44cbfa99b13b57a9053d64bde421e830d1aac0c5de2bee7f499fa25d4751d605890fab08ff61afb4ddb89719e7f3950a82d392d
TLSH
T10E218C85A2F8520EF2B3477079F59363916DBE569D7D43EC3488135F1F255008983AB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDE535E8DA4E445AA0A118E973EB48AE.TMP

Path \??\c:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\CSCDE535E8DA4E445AA0A118E973EB48AE.TMP
Size 1KB
SHA256 cca4a0086aa6a9589df34ac3a273bfd0b7ba29a35562baf7bdf02f21a97b9e89
MD5 18c8b82aaa5a037385df616376bf3dd7
SHA1 bfb2a72bfab167955911dc6784da12cbfeb54629
SHA512 bc96a4836ac92556a3cf1e64d7991eb2e90ee7feab2d97ea95b9c24555eea1d731223baab4ca8d1255c9a8db218099b7b45d8b28bb865c24fa35322274be28f4
TLSH
T13221C980B3E8521AF1B3473079F68363916CBE669D7E43EC3488535F2F2454084836B2
MD5 SHA1 SHA512 TLSH

Submit Download

payload.exe

Path \??\c:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\payload.exe
Size 1.4MB
SHA256 8fd35ec44828482245c64fd74732478d3d028eaf4edc7bc0f29b3fcb7bcb2abb
MD5 36e73f49ccb21d4d39a189f497dd25f3
SHA1 1d399523e7b94cac88b939c68d5e9832eb026d0e
SHA512 0e538f74a6fc344381f24ade75dfcb85fbad2a8a3af2c0fad9510e8bcbcf8f79c60a9e3d465c4e051e5b19037862c72aae9c5c58fd81dcc508dcba69f7ac5aeb
SSDEEP 24576:K8FTI5YcWzKnTv/gSLlEShxjgHBYrJG4rbHPZ6TJhbU6IBC749s:ZJVcqKnTv/DECx4OJFXsJh5sCku
TLSH
T19965337B338681E2C5F140BDB4F1ACB86BDD3C6016C795A3D0C597CAB74F286A938660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.exe

Path \??\c:\Users\Admin\Desktop\Phantom-main\Phantom\bin\Release\payload.exe
Size 1.4MB
SHA256 906e897967bd41434fb331264411169a017e9e0a85ec74d796d46fff8d5e1f21
MD5 8616f2749c4558cc12c7c48ec93808ed
SHA1 19c71a634f3f41deeabf611c354f0fcad008170d
SHA512 05dab82420abe5aafd273006eb18cda7697aea4ba8636ce0467b8629fb5e93fe3b724c76efa7dad3db256a712c92b8565921afa24b4a1f8013af27fa7c050bad
SSDEEP 24576:nJngTcv4atGtwvm6kEnP+l3Mdv1Z+5W2ukhdqZTpmtq9suJ48mu18GJ79fF:nuTK46Kwu9aP+l8lb+5WHFt9sufR8GJj
TLSH
T1566533B90777070C6CE6277EB098746AB870BA983679CC0EAE9E56B77E124C4C4DB414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-370-0x000001D050790000-0x000001D0507B2000-memory.dmp

Download

memory/8-397-0x000001D050F10000-0x000001D0510FA000-memory.dmp

Download

memory/8-394-0x000001D050D90000-0x000001D050F06000-memory.dmp

Download

memory/8-391-0x000001D050AF0000-0x000001D050AF8000-memory.dmp

Download

memory/212-224-0x0000000005D10000-0x00000000062B4000-memory.dmp

Download

memory/212-225-0x0000000005760000-0x00000000057F2000-memory.dmp

Download

memory/212-226-0x00007FFF6AA50000-0x00007FFF6AC45000-memory.dmp

Download

memory/212-223-0x0000000000B50000-0x0000000000D3A000-memory.dmp

Download

memory/212-227-0x00000000058F0000-0x00000000058FA000-memory.dmp

Download

memory/212-228-0x0000000008BD0000-0x0000000008C80000-memory.dmp

Download

memory/212-229-0x0000000006920000-0x0000000006942000-memory.dmp

Download

memory/212-230-0x0000000006950000-0x0000000006CA4000-memory.dmp

Download

memory/212-233-0x00007FFF6AA50000-0x00007FFF6AC45000-memory.dmp

Download

memory/568-236-0x0000000008C20000-0x0000000008F74000-memory.dmp

Download

memory/2584-549-0x000001DD49B00000-0x000001DD49B08000-memory.dmp

Download

memory/2584-552-0x000001DD621A0000-0x000001DD62316000-memory.dmp

Download