Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
29/07/2026, 05:15
General
- Target RFQ ARL3220726TN.js
- Size 4.3MB
- Sample260729-fx1zeavepb
- SHA256 b0196d8a25ab7bbb1c9185161e978f21ec473d482cbc9c60cfca0c0c587c9e24
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
her6+eMmNJbim&[F
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
BKzXvOZR/InHS5GMyWH7jQVjpfD8BQhKe4TEuw6Y35dQAAAAdcZDp6utAJQq6Hg9OCjxnsz2POvBve7qKoaHAA2W9fUdKosVIhMhbt/7B85EFq2zEU59rnhpe4KqvmNc3YTR78ltIaIhqQxjNbjKvROlMHmRf56jZqXwcNkuAbGIOR8z
-
Username
KIAbJslK5pV9JCmRqCgELu4bUOmvlejbYAIVaT9Ap25QAAAAuhaayKbociITNToSt9WKGk/2lq6Bh7F1N8DJGV0tdPnI2olW/xm+8Y1f0erqqvJbWDGIFLAZZQoFBWyjRnRkysCokwKvq3UEquRC5E7hjnZvHJMejGYgAzF+xVMxuuLb
-
Password
ipb+hYt6c2DzsvV+8lr22vAnRJllGnmg/CexbNLvbslQAAAAZn1I5xdXChmoAOc4Kkmo82eP0F/f20kKPxoBpCACpv0UWiPsEVixZt6zNtMhn4mG1HlYDJiO9i+YPvGiuuR3BHUY9OUOMnJYQ0LW1J1XAGmP2Z1u0VN8bXHmAb6DqcGbw1VmKlBQFCQxUAIv0mTeOw==
-
Email to
HxeO9xrYhey5oU4isZrW0Xg+CskhckUJfR3YgeeuiFhQAAAAnRGOMvP2qIuFwyL/RpReNhlob9ykv6KAHLejisas4jwx7ezmiQ93LqY+0p4O4wlvYX+AIgIYBaWCHGI/r0sRJCaAnv7m27dGIINjjMA/cmCI11JJKljHfPwZFHYbx6BERywQvc4wa54J/mYkZXO1gg==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
IG7AZ2SLY78ZUAKFFX82
-
ts+WOr5VL54MeSc8tg5yH+THhORbjh+jaJHXGWdsUj1QAAAAvLUhIjqp196asdznZshP+FEe5osBHu/EE2woKZDOEEE0De4b20AzCjyKuvyBPgs1qkfDwuf1UJDgFfNK8qJjnVCSrXjxRf8tMeDH1BEumfxz4lwzm4jF50Ej8PD5WpIhhQa6jwcvRXAwlM/6/PUAoLpR2oMUyy6R/RIR3/oQ4/8=
-
vBCohBrz6Nud337R4el5+0Rppf0ULivi85qA7scS0ZJQAAAAGIKTaOz2kxn2S5vmk5/2fvdHvntHb6Kf57Je5yQhiB1FCh9X9QwRrSFsYsMvCYgcmcSRfEdV/yivnYiIXMh4Mm/ejKM2ihfrMTSgaqK9MCRiZFOxpk6Vyq+PW6u4cL+GrXAGpziXE/32aXwHBuwOZqMDEpA+mb3CVzq/Rcdb45U=
-
0GyGuVj6nbuc4+xejdrkKvTi1GGUfbkJKO1RvKdgiB5QAAAA+nb4IwPTS1FhikEGF0C4TZDa4c8ZsFlXgveXKQJX2eY88fkBksHuJATpKVuKqOkG40O8Wiio+I26pEBFxFCpkz+lYc2jx3nIOJc+QGsAUKIT0PbE/yxU6RIA6+RfqAQWO/nuET9VB1+CZhfQTvQ7muwqHQc4fhPa0jF1QKpdJTw=
-
PD2JoHIDiM/uFbj91kSev+jEIFZjGn+8/iMsLr8gjXZQAAAAtWPkWEG8AB9A4q+bCa9kq7Kqe+eB7yybwQLUkOpzAwSoDqSQE54MvBnQt6vwPiHmbzowOSKC2EapxbCkj0o3ajnMWIo7lMFPY3tf+YNWKLW3VXgb5Gzye4IXB0aJU5cn8BiVo5pMOoY9fEx8F5HQ77QLEgcyW+ydqsNqc7IQ3P4=
-
V7kZyWvOL6BAYVjnGCwu/+h/31pXia1KKBZb8wO1+OZQAAAAQn4mF8pO4WEPisKuPDyNK1e9JS5yhjZrDxo9gELDNYWJWl6A5mec1UL112RQSqEg3BM8qXeZacEaseEHjDIVpUR/KKc3ursZWBVYZ5LTrrZnk6w7STVBgiB7P+NAxLrCVTgZ3BJ9lYZsXO2vlvFEvE8ylDcTa0dC8mat8VQElSHHcZOSee02dcFLm8eaWt0WmRcrHN475HYf3fIQJHxSeD+vDZgI6LtMe6Fv4N9zEG0=
-
Hvgc1a9k7/z2cbyAzehAJpotJE1Se4bCU0La/PSegUhQAAAAd9ueFmOxmY2CWSn0GGlNDqs/M+gXO+yHUYa+SPv3aaHyWz8L627td/ZMHQds8bYJPYGfSU/QSUBD+kfodINUMeHyVJPp+FYtsagvmN/MO8Q9DE0cqwqfSW3JVRSfWxN+bnPux1XAFmoOqv7H5oIfAb6JRlM7wXeXry9uIXde8AY=
-
vBRxO+N4XhX0QX+EkKvRYpqEhnMl/jscuLDM3T9mB2tQAAAAGZOkKptLp1guT0p2NkI+V2P2gc5Jej7v1VaIkXKpAfus/vgGewwn35UFDrHOfpp86IYv81emPzAOyBiuxhHA7O4mx315wPk/L4VkzuKwDMQpF0+MVlA3vrkBYgagy3/q9CuRTz8VPVzamoryJeN1G2Xey964UMWe2bPTmPt1nPE=
-
clipper
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ ARL3220726TN.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\NDOZHUCLGOFMJZYP.PIF"C:\Users\Admin\Documents\NDOZHUCLGOFMJZYP.PIF" C:\Users\Admin\Documents\NDOZHUCLGOFMJZYP.ttf2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c whoami3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "NDOZHUCLGOFMJZYP" 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "NDOZHUCLGOFMJZYP"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "NDOZHUCLGOFMJZYP" /tr "cmd /c \"C:\Users\Admin\Documents\PYZJMFOGLCUHZODN.url\"" /ru "wbomrqrb\admin" /f /it3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn "NDOZHUCLGOFMJZYP" /tr "cmd /c \"C:\Users\Admin\Documents\PYZJMFOGLCUHZODN.url\"" /ru "wbomrqrb\admin" /f /it4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" all --output-path "C:\Users\Admin\AppData\Local\Temp\6ac8869f1a7d7144c18f3d609c2fcbe0"3⤵
-
-
-
C:\Windows\system32\cmd.execmd1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
NDOZHUCLGOFMJZYP.PIF
NDOZHUCLGOFMJZYP.ttf
NDOZHUCLGOFMJZYP.ubf
memory/4720-69-0x0000000040000000-0x0000000040167000-memory.dmp
memory/4720-70-0x0000000040000000-0x0000000040167000-memory.dmp
memory/4736-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4736-54-0x0000000015DF0000-0x0000000016DF0000-memory.dmp
memory/4736-55-0x0000000002CE0000-0x0000000002D48000-memory.dmp
memory/4736-57-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4736-66-0x00000000008D0000-0x0000000000A92000-memory.dmp
memory/4736-67-0x0000000000E20000-0x0000000000E96000-memory.dmp