Overview

overview

10

Static

static

10

2026-07-30...at.exe

windows10-2004-x64

10

2026-07-30...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
  • Size 746KB
  • Sample260730-gp47javsgw
  • SHA256 68df7b6f9d19fa367adc824210afb8a8272deda7fe4e79657cb12723d20298ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdiscoveryphantom_stealerspywarestealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    162.254.34.31
  • Port

    587
  • Username

    [email protected]
  • Password

    fu8I18SheSvP

Extracted

Family

  • phantom_stealer

Version

  • v4.0.0

Credentials
Mutex

  • 4D51VYR0C2DGCH0GMTBC

Wallets

  • 16iZiy7E6DiWq6C1v1yYU72nV9uy5RdKWv

  • 0xCbCf3C0517d956BE6C10Aa019256545B63b0554E

  • TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J

Attributes
  • clipboard

    true

  • clipper

    true

  • cookies

    true

  • credit_cards

    true

  • keylogger

    true

  • passwords

    true

  • screenshot

    true

  • smtp_enabled

    true

Signatures

  • Family: PhantomStealer

    Phantom Stealer is a stealer written in C#, forked from the Stealerium family.

    stealerphantom_stealer
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
  • Uses browser remote debugging 2 TTPs 2 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_0d8c2d896f3a6bc8c9de054d0d9fe998_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
      "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
        3⤵
        • Uses browser remote debugging
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome2488240739375 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome2488240739375\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome2488240739375 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x22c,0x230,0x234,0x228,0x238,0x7ff85d4ec728,0x7ff85d4ec734,0x7ff85d4ec740
          4⤵
            PID:4988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
          3⤵
          • Uses browser remote debugging
          • Loads dropped DLL
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1752240739937 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1752240739937\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x338,0x7ff85d0cc188,0x7ff85d0cc194,0x7ff85d0cc1a0
            4⤵
              PID:3912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=352,i,10948379572602771305,468871512803604866,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=544 /prefetch:2
              4⤵
                PID:4572
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=352,i,10948379572602771305,468871512803604866,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
                4⤵
                • System Time Discovery
                PID:2316
          • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
            "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4352
          • C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
            "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4100
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:4500
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:4088
            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
              1⤵
                PID:3772

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    ChromeData.json
                    • Path C:\Users\Admin\AppData\Local\Temp\ChromeData.json
                    • Size 322B
                    • SHA256 02bb1e076f1d7f0ca5b0006580ef2ebd90c7189b7be4960f87c3046848771596
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DllExtractChromiumSecrets.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\DllExtractChromiumSecrets.dll
                    • Size 45KB
                    • SHA256 b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DumpBrowserSecrets.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
                    • Size 381KB
                    • SHA256 c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    EdgeData.json
                    • Path C:\Users\Admin\AppData\Local\Temp\EdgeData.json
                    • Size 429B
                    • SHA256 648882b173288ba6ea7ddf8cbc80ee42a36621f153c6e30aaa899c9bb7e53d64
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1752240739937\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 019e62a5b9780b4163e935acfcf7b7851759ee5b41c23dadbaad450704de59c7
                    • MD5 SHA1 SHA512
                    Submit Download

                    throttle_store.dat
                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1752240739937\Crashpad\throttle_store.dat
                    • Size 20B
                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                    • MD5 SHA1 SHA512
                    Submit Download

                    memory/2300-18-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-43-0x000000001DCD0000-0x000000001DE92000-memory.dmp
                    Download

                    memory/2300-6-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-5-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-0-0x00007FF86229F000-0x00007FF8622A0000-memory.dmp
                    Download

                    memory/2300-19-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-4-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-3-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-2-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-7-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-45-0x000000001E3D0000-0x000000001E8F8000-memory.dmp
                    Download

                    memory/2300-1-0x0000000000020000-0x00000000000E0000-memory.dmp
                    Download

                    memory/2300-48-0x000000001C260000-0x000000001C2D6000-memory.dmp
                    Download

                    memory/2300-49-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-54-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-55-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download

                    memory/2300-56-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
                    Download