Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 08:03
General
- Target mal.vbs
- Size 2.2MB
- Sample260727-jx16ysythy
- SHA256 4fdb44886fa7f248dfd5483fc419ac24ef12dbe806fa4c669e2f5bd2489ee791
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
ftp
-
Host
ftp.wdtuftar.com
-
Username
-
Password
Q0#I0@d*@oRV5nr7
-
XOFRFHIYYCCF4TD1EQ15
-
cookies
true
-
credit_cards
true
-
ftp_enabled
true
-
passwords
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mal.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\439AA7F.ps1"2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qgalit5y\qgalit5y.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES747A.tmp" "c:\Users\Admin\AppData\Local\Temp\qgalit5y\CSC3750E438546A4F16B4C132E52782AC65.TMP"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\6E26E1FF.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
439AA7F.ps1
6E26E1FF.xml
RES747A.tmp
qgalit5y.dll
CSC3750E438546A4F16B4C132E52782AC65.TMP
qgalit5y.0.cs
qgalit5y.cmdline
memory/928-38-0x0000000006A80000-0x0000000006C42000-memory.dmp
memory/928-36-0x0000000000400000-0x0000000000466000-memory.dmp
memory/928-35-0x0000000001180000-0x0000000001181000-memory.dmp
memory/928-37-0x0000000005CE0000-0x000000000629A000-memory.dmp
memory/928-41-0x0000000006950000-0x00000000069C6000-memory.dmp
memory/928-51-0x00000000078A0000-0x0000000007DCC000-memory.dmp
memory/928-56-0x0000000007660000-0x00000000076F2000-memory.dmp
memory/928-57-0x00000000072F0000-0x00000000072FA000-memory.dmp
memory/4236-12-0x0000000006910000-0x000000000692E000-memory.dmp
memory/4236-7-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/4236-16-0x0000000006E80000-0x0000000006E9A000-memory.dmp
memory/4236-15-0x0000000008260000-0x00000000088DC000-memory.dmp
memory/4236-13-0x0000000006950000-0x000000000699C000-memory.dmp
memory/4236-32-0x0000000005740000-0x0000000005748000-memory.dmp
memory/4236-33-0x0000000075100000-0x00000000758BC000-memory.dmp
memory/4236-34-0x0000000005750000-0x0000000005758000-memory.dmp
memory/4236-1-0x0000000075112000-0x0000000075113000-memory.dmp
memory/4236-11-0x0000000006400000-0x000000000675B000-memory.dmp
memory/4236-8-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/4236-19-0x0000000007930000-0x0000000007944000-memory.dmp
memory/4236-39-0x0000000075112000-0x0000000075113000-memory.dmp
memory/4236-40-0x0000000075100000-0x00000000758BC000-memory.dmp
memory/4236-6-0x0000000005B40000-0x0000000005B62000-memory.dmp
memory/4236-42-0x0000000007CC0000-0x0000000007D56000-memory.dmp
memory/4236-43-0x0000000007C20000-0x0000000007C42000-memory.dmp
memory/4236-46-0x0000000075100000-0x00000000758BC000-memory.dmp
memory/4236-5-0x0000000075100000-0x00000000758BC000-memory.dmp
memory/4236-3-0x0000000005C80000-0x00000000062CA000-memory.dmp
memory/4236-4-0x0000000075100000-0x00000000758BC000-memory.dmp
memory/4236-2-0x0000000005470000-0x00000000054A6000-memory.dmp