Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 10:16
General
- Target Document 1144322785.js
- Size 4.2MB
- Sample260730-ma7a8sy1cx
- SHA256 db6f1bed81ff7c556132fed2aab07571d8b71358bb3d1be6d2c90db25c4a80f4
Malware Config
Extracted
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
_|57(U?U1Ik%fx_g
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
_|57(U?U1Ik%fx_g
-
Email to
-
5SIO55YX92B6I5SDCHOD
-
1FN3a3b66XakLPbFykvawsCTtKPHtBHNFp
-
0x7875027ea7D2c04535A6A78A83F18222Bc2Ce012
-
ltc1q4vhejh3avldylpkq9rj6dj4uv0wkj497wlhq0j
-
bitcoincash:qz2fhszqsdse8frnykllv5zwk9sjr05vyu6kkdd3af
-
TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J
-
clipper
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 2 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Document 1144322785.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\HUKGSUITEVVWRPVO.PIF"C:\Users\Admin\Documents\HUKGSUITEVVWRPVO.PIF" C:\Users\Admin\Documents\HUKGSUITEVVWRPVO.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
HUKGSUITEVVWRPVO.PIF
HUKGSUITEVVWRPVO.ttf
memory/5940-9-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-16-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-15-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-14-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-50-0x0000000015DB0000-0x0000000016DB0000-memory.dmp
memory/5940-51-0x0000000015DB0000-0x0000000015E1A000-memory.dmp
memory/5940-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/5940-52-0x00007FFCD4BFF000-0x00007FFCD4C00000-memory.dmp
memory/5940-53-0x00000000038B0000-0x0000000003916000-memory.dmp
memory/5940-54-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-55-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-56-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-57-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-58-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-59-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-60-0x0000000042B00000-0x0000000042CC2000-memory.dmp
memory/5940-61-0x0000000028640000-0x00000000286B6000-memory.dmp
memory/5940-63-0x0000000000400000-0x000000000047B000-memory.dmp
memory/5940-65-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-66-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/5940-67-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp