Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 06:01
General
- Target RFQ_784990SN6.js
- Size 3.8MB
- Sample260803-graqpsda42
- SHA256 28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
her6+eMmNJbim&[F
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
GvnHcUROw6Pcih6HwY0rEpWUXo3/axSz/ToyZIkLTq9QAAAAX6rN5ZnJgYKiA8C06yEztrUjFM4W0MRjboNfRpwYHBsJ1UYzLQPRLki9k5dX5QoN/eKJPeGs7kJ2gdIjL+7emmVkqxgdRPAZdUUvjwpLBbcjFxIRzk0rmkO5z4VK06nc
-
Username
HyZbuZW4URd0sMq2cKzT7GMpxkawTghgZSRFWbIJyQBQAAAAQ1cXF6G7v69qJBtlpbZ73z1h+B7/Ju60MjuORLb6y7Dfn+uWQwgafscjV49jxYKCNPJbA8sya3pprBknYzu0jjp/WF2N75KjxzRNUbvQjzyQuv3U7IZ7Upje/A2iUo5a
-
Password
gzy/TnRvsw56mFR251My7v9hqLbpOPLzyVNw3pUlvYxQAAAA4CJmFHNVV/0LhyjQWwIZ0DqZP21OKqOBcyIoNJn4d3U+Vn/RkdF/BLhMhckWQoptUDKEFXjiqXD1apy/CTi51c/YTZHUz4WA6RIWzbjbn0WGZejeu6aqQ+HbJPCHUQZzF6WZo7K8qS0Y7Pvn9TzZ6A==
-
Email to
D4YkHm0Og6XlAGOa/SPxQCoTsE0utCkmoLaH1bo2kJJQAAAAN3nLnaLBnypHJljKydOKAbslf/HziY0fyy8HK57KYkKvwA2jJST/u9GFxKe4bkBmw2sth8vVJCWZlIy0OdGnexStY08AAQTxVxbq0AxFuVdC1HTYo9ypXgzmUIaH+HNuw97kIQNfGKamhbUtflYirg==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
S7FHVGSFZV79T8D372PY
-
3J6rebMcc9JpV67Z/dW8Besklg2H2cpQzKIMeYSuER1QAAAAUx7EY5VCjmSWLUA1gGPRKBKh6tbl2mwnmewGr2hdpVNYadWeyGeC1c2jGHQkl5dfoRpRfPrCPe7KHXYj4Quvlrdz5NckBVbZSXvfykBV3Q6ngyXN+208oM5YEGX5yah7e2tPvktXkxzFwb1uU6v7tOqTemcuAD/AHsfshQP6VqQ=
-
2yC5mKgVrOv0B0HwwRvdA+wNwxWMNxM/LO9CxMw1dfZQAAAAH9Mgs8ds8GavB6Sgtz77qhB99UDTBJcYV7Y3y1ZDiQ4R6HfqIQcbv+txNlhPyFTxjZRwH+jdXzWIF/VY9MN7OCFLijJDeaAqlOnt6WZT+FTM6+3F5zhKz88cC0rPREbsiN8CtK+hk2tp+OqHkp/1ALX1+BWIMYfK7zUe2jwmfoo=
-
sJQ/ndefDuHTj8vyO/RrIpZ6EbwG1sT7Br8d0+LSpYFQAAAAhPdzAeazmc82GT17szKz3IbnHNO8Fn157jkel0ICDWuh0R+6oIvPYHOUimXwniG4tcmiuDZLUyrxp2cC9A4NgRyo5o4nNFSUqTXG3Aecu6zEgiovr9nCXBqTyhvuzFEqNA56fr9PTsBYlOQ7agNUwYiV3M5cVrge8H0OLOBaqLg=
-
r5iuHWuRqBVLClF6p06ays7LkgDORUSUyqPDlV2CA8BQAAAA93EVKdUZppOoXsA1axC1YwrRJRT4vmcDQC7P6W08IYEYcbLmsJorOKUyhlVUORe0qeiIlxQubDsSSOI/0riVsaYiyxVCctnhb5+Ass9OAkwiMlyzvSQ2v/loWONveYkDKlTlg+eQZB0fE+TIt6Xfq3RIZmHEKCIbm+eIh4w86ys=
-
o37qblIaKvhOl4WxO2tbGMSJL3epj+S+EH8U3Z4txlZQAAAA0ZPSCFhkTkK8SuD61dcEUAmWAdWQUk/HNl+V3yvrxTNP2Iv963vaUJY5LlppoQBTAOy6R5Y3QlRjdrB78G1p6cRSJifagA796wn2+X5LUxwXFSqSVVaaoJz4jNqTLYPzb3EVBfCmQ+yl/2Ay+q9a8Zaa+LYGAq/8G1gQYYxF3cH8H4n29UtD4v6dSkBb+nht5uxEE5TOUZCCjxPNmRZ3cp+5D5999pNOqmwEE4BfOPI=
-
227UOeN0jf8v3pyIJEGeepqQbeISXpBoaX1t24a0leNQAAAAxw4ieqfKjhSAsL0tUSUuWZbARpaTvuaSCO8QFV/aak2k+LPEbOtbRLP5lEZrfj8Y7asYdr/rWYgB3eCratU2Cj98em3Amesb+tTOZPIH9tHRUSeGIFjFDpeZ8L+nXmo2RSaArUkT44OfBq3584tnNCQrz4tvZIFvahc7yhQb8Ec=
-
/eVieA5C86PG89MFwwhTLnz/UiWB0fWjc0p2FqD4HdFQAAAAfMyvFYCWy5HrhxRbQE1lBUcSpqc+y3ucqNx9VHZRC5yd4ndQpxUITRz287ceZa988T3LCa4yWOganmbhLl/YdxFN31u3N7d2EqW9ARW7jSBEFF7o68iyTRAVA3OIVTzvUIlVgDFWgk/gcN/enZRawTSdEe0HXqS21xRpyZ7pc5A=
-
clipboard
true
-
clipper
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ_784990SN6.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ABTUVQFLAWSVYYHQ.PIF"C:\Users\Admin\Documents\ABTUVQFLAWSVYYHQ.PIF" C:\Users\Admin\Documents\ABTUVQFLAWSVYYHQ.ttf2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c whoami3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "ABTUVQFLAWSVYYHQ" 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "ABTUVQFLAWSVYYHQ"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "ABTUVQFLAWSVYYHQ" /tr "cmd /c \"C:\Users\Admin\Documents\QHYYVSWALFQVUTBA.url\"" /ru "frptrmxs\admin" /f /it3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn "ABTUVQFLAWSVYYHQ" /tr "cmd /c \"C:\Users\Admin\Documents\QHYYVSWALFQVUTBA.url\"" /ru "frptrmxs\admin" /f /it4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\b41f32812082513ede969dc5c00f40e8"3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\b41f32812082513ede969dc5c00f40e8"3⤵
-
-
-
C:\Windows\system32\cmd.execmd1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ABTUVQFLAWSVYYHQ.PIF
ABTUVQFLAWSVYYHQ.ttf
ABTUVQFLAWSVYYHQ.ubf
memory/2828-69-0x0000000040000000-0x0000000040167000-memory.dmp
memory/2828-70-0x0000000040000000-0x0000000040167000-memory.dmp
memory/4332-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-65-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-64-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-60-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-66-0x00000000167D0000-0x00000000177D0000-memory.dmp
memory/4332-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-59-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-58-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-57-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-56-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-55-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-54-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-62-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-63-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-61-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/4332-67-0x0000000003640000-0x00000000036AC000-memory.dmp
memory/4332-74-0x0000000042AE0000-0x0000000042CA2000-memory.dmp
memory/4332-75-0x0000000029790000-0x0000000029806000-memory.dmp
memory/4332-76-0x000000002A440000-0x000000002A490000-memory.dmp
memory/4332-77-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4332-78-0x00000000026C0000-0x0000000003064000-memory.dmp
memory/4332-85-0x00000000026C0000-0x0000000003064000-memory.dmp
memory/4332-87-0x00000000026C0000-0x0000000003064000-memory.dmp
memory/4332-89-0x00000000026C0000-0x0000000003064000-memory.dmp
memory/4332-91-0x00000000026C0000-0x0000000003064000-memory.dmp
memory/4332-94-0x00000000026C0000-0x0000000003064000-memory.dmp
memory/4332-97-0x00000000026C0000-0x0000000003064000-memory.dmp