Analysis
- max time kernel
298s - max time network
295s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 13:33
General
- Target RFQ-09790098-CS01879-HYU-05979-MQ0978.js
- Size 4.3MB
- Sample260727-qtpgbatwds
- SHA256 311906ba9abe5dd27b295bb2b627e6f03d935e94a1ce4a9eb4ee6907644c1964
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
;mU[U{4hFq+cKLx@
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
bXDltb2FIulZN+QIR1L26CN1VR09l6TgOUhHWjHLrzpQAAAAaDeZSGfVWJp5kqc89oKYG1oBCZClO9tLzr8XwWnpBD+WNbaoMHoXMNTIKm3LbpOdoFGait9UkGlV1XT5lJau9Cx15sZykqL+o2I7gZbARj2pbUBUgh351VCsF5D+5wEo+rn0RYwc9hIsjgA7z0vsFg==
-
Username
5U9TxG88N3z8S76geN09sMs9F0fZIou38qK668q1cLlQAAAArfpszPR0cjPIhXLbC4zq/vfFz5h4MRIcXIw94cU839j/J2aOjJE6mf4+lv67JmlIrGHhnH5adF96HkltyUVI8SMUSYLG+Qolb6YgHSFXijSPNLbxXObuRedlNyIwtM09j6Gq4I/qaINwx1DJQD2e0Q==
-
Password
rFFtstdbN1q8Yll7IWXLTx5WhxT+9DsQ02HXVX+Z56BQAAAAduBO7T5cHspKXVpZfbFnqKoGAAuy0IVMCNKbh1s7dfQnzVyB1DHYG5BkiE43ZxB/NULI9ojG1Tvy4AOJPoEQlvy9aR3VrB2Jo+JU4BicNGL2nE9YEp0PZyUJsl5E+FYeRkOaR0KSZJlR33kW5JkVqw==
-
Email to
39OJqVKrBvQcoW3qAAy5BEDLvEx0P8ASpsbf6+yL/0JQAAAApC2cC+1BbizuOjAZb3IfgeCcYi2dabO7LpKbBi2mPvz5AhpFpYwIttIws80CruXNSD8kGxjCcMtaA/45WSBDcrSzD3QTMtfTRMATJXD7XMsck9MgzspXrOCl1LC5Wcc03TbW4gSTmGLajm0nIJZoZQ==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
ULWW0ZFGANPFOFD5H3AE
-
8/fhz8MaCGNxnLvHqY4u83J23Fx8BmzXOrqSx3kxfN9QAAAArjYekQVTftNqjM84/0aQ8KXz3LqVB96PPyawrH0zOAN963bmis6lF5QsJGJgrb44A7fuq/a7KMKl4xCN2v/772U23aAhBjT1iTtsYikaq3ElCjuFWkzRJ+78YT+1bzZqaIBFr6pLkv12lGmgynw3+cwpzITKZBw6Uw/wuGYaGOI=
-
1MMcCM3hcTWHrsrJvB9P1TZvJyxXP6oYEvY/pU7lG7NQAAAAwz5ysTNMwNdkbL0zpnrC5fTGp4XGUDYKS4AE5vHcbGzOUV4EfIYIp+EdAlkXmNfyITGQA8h34GHdAi8qxcH8X1uCJLP/bdV+wCl0K7ycNeEBPzDRlZj/AtLDS2P4wdn+a3pArQBfDlORLc2GlZjqLX38f+pwBLnydko5OqJXOH0=
-
kDNbWn9QmiU5RtF9A+vBTjuTcbbRRrQzr3/cg+ZYkS9QAAAAdoMpVkJHxFdM9lOo0WrD5tUr6oNJxlby9Eu3IzQ6U8xpmEicXvm5TzskacRfc9e5pruMUqm+l6Bm0na3rIRhzB6J9l5inMlgnFsCS3v//8zu6ZwwDRnyepPcoBcMGlmTZta0WCI+btlburioZCKzKAPerywjIVSV8azdvxuUUhc=
-
ycVrn8A840OE2sHNdEGwnq7xdOirEiGH7a0PeU8KOgdQAAAAdtL3Mu9o/gnF5rBp6tyXIVyBej+EraD8o66zKgyzBPqPlgwwjSVTH0HntvE4+YBlcJJ2N4Qs63tSbrGl2MKAsuz3PbexWo3TRyKwxa0/XZVlH4HzFHjhRdfgcmrGYMAhURG56ru359zD58vOa5bHQVkNrY/RcylD/sYdL74A/E4=
-
Ep0YCJzezUFLOlOmGzzC0DaB8bPrprFUcwa/W7Drq85QAAAAWlqkjK88BQ+xI0dzrG+M51w1k8YhYab4NcAfeaMrJ34W4caeORh6LcUHeWD+0nrZQt0ui020CHQtD/GxdO8x6VFHdzloJcT9IB0+aZSdJLUjofmCP9e5loWSlOiXm7UV0iCEa3VURrTeaJ3B3Qp1yJiy68flboDN0/5nbWb796iobhB7REMrwvyCV3aaLyyQFslqSsjgViv1KcRg2EXShLcxEj8lkNyVoapvBD6quns=
-
CHC4eDei2N5asZNhKRq43SS0ckPoKhfPE2kvKEgtLl9QAAAAOaoVBmyEMNgUU/sPjPhNrnuy3ObwMjJz8RSMxEb5tYPkJ9Gg1eCpQuUoWSbJUpd1jPG47bYLsxbZoOSFgQhWc9ZdxyI3KNTCCvSVqWCCg9sRRl8L8XmIBRovPnHGwuUUtR6HFnZ0edIhstmX830JVCDvHoptSRwXN8QYcXnPljk=
-
222O8REnG3QAE8h5l8fk/Y6lE6zBBfC5WMUokvk9vKJQAAAAsLcL8UMqRCmGaHK5mzVGIPX6Hu/qo+H5ayow/8mI9KAAjIwdsQ5sVT+C/p8FG6A3+gIg3XOI9Le/YlJ/nDcv8wzmLyUbkiAjPK7HI/vqfgSjaOcT9NwX2XjskcdZ13OyfJWy7zDzTqims/Xbg7/VDclFqnRwWCPMf05LdB9egwQ=
-
clipper
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 2 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ-09790098-CS01879-HYU-05979-MQ0978.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\FGWSPBTQTMOLJKCT.PIF"C:\Users\Admin\Documents\FGWSPBTQTMOLJKCT.PIF" C:\Users\Admin\Documents\FGWSPBTQTMOLJKCT.ttf2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" all --output-path "C:\Users\Admin\AppData\Local\Temp\c8c38ec1f11818f2e364748a331e73f3"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
FGWSPBTQTMOLJKCT.PIF
FGWSPBTQTMOLJKCT.ttf
memory/600-9-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-16-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-15-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-14-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-51-0x0000000015E10000-0x0000000015E7B000-memory.dmp
memory/600-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/600-50-0x0000000015E10000-0x0000000016E10000-memory.dmp
memory/600-52-0x00007FFC7966F000-0x00007FFC79670000-memory.dmp
memory/600-53-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-54-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-56-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-55-0x0000000002B40000-0x0000000002BA8000-memory.dmp
memory/600-57-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-58-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-59-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-60-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-61-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-63-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-64-0x0000000000400000-0x000000000047B000-memory.dmp
memory/600-65-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-66-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-67-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-68-0x00007FFC794E0000-0x00007FFC79E84000-memory.dmp
memory/600-71-0x0000000029F60000-0x000000002A122000-memory.dmp
memory/600-72-0x0000000028920000-0x0000000028996000-memory.dmp
memory/3404-74-0x0000000040000000-0x0000000040167000-memory.dmp
memory/3404-75-0x0000000040000000-0x0000000040167000-memory.dmp