phantom_stealer | 0a71bbd1903835fcbcb323179b460238184a4b406a3f3eab7341b0b003a26b6a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Booking_Confirmation.js
Size 1.0MB
Sample260804-eq8v1avyaw
SHA256 0a71bbd1903835fcbcb323179b460238184a4b406a3f3eab7341b0b003a26b6a
MD5 f7400cecbf4b7104499a7f9841827a72
SHA1 c885c038a1ecd7f59ff164b202ea5d58ded49f6a
SHA512 a683c4325a84d5e747b59be4058071fc902ba8873716ae0a76536943e8d39d08bb3cdd00b8e4bab74a2355b9954dc9fd593e1d775b94cdf849ffe202dd2272bb
SSDEEP 192:mRPQX2L9X4PED1srHL+WVCUfWTUTWIeUt4UfWKUeWD5crJZkL4g+6JvWogdT2JDd:qSpOTUfIUTSU2UfTUeyBe2J8lmEq
TLSH
T14B354EBEEF508E0999411591CC974898EBB8A137FC155C6F35A293D8BBA20F811DCBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access discovery execution phantom_stealer spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.lebelair-resort.com
Port
587
Username
[email protected]
Password
folebelair2026

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
mail.lebelair-resort.com
Port
587
Username
[email protected]
Password
folebelair2026
Email to
[email protected]

Mutex

GFNOC7OXTLSL8Q8IV7XK

Attributes

passwords
true
smtp_enabled
true

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	2708	powershell.exe	84

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4736	powershell.exe
9	4736	powershell.exe

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3776	chrome.exe
2432	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
984	DumpBrowserSecrets.exe

Loads dropped DLL 2 IoCs

pid	Process
3776	chrome.exe
2432	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 1748	4736	powershell.exe	91

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe
984	DumpBrowserSecrets.exe
984	DumpBrowserSecrets.exe
3776	chrome.exe
3776	chrome.exe
984	DumpBrowserSecrets.exe
984	DumpBrowserSecrets.exe
2432	msedge.exe
2432	msedge.exe
984	DumpBrowserSecrets.exe
984	DumpBrowserSecrets.exe
1748	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	1748	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1748	4736	powershell.exe	91
PID 4736 wrote to memory of 1748	4736	powershell.exe	91
PID 4736 wrote to memory of 1748	4736	powershell.exe	91
PID 4736 wrote to memory of 1748	4736	powershell.exe	91
PID 1748 wrote to memory of 984	1748	MSBuild.exe	93
PID 984 wrote to memory of 3776	984	DumpBrowserSecrets.exe	95
PID 3776 wrote to memory of 4312	3776	chrome.exe	96
PID 984 wrote to memory of 2432	984	DumpBrowserSecrets.exe	99
PID 2432 wrote to memory of 2180	2432	msedge.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Booking_Confirmation.js
1⤵
PID:2464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:precedentedly"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
    "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
      4⤵
      Uses browser remote debugging
      Loads dropped DLL
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3776240689406 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3776240689406\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3776240689406 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1d8,0x1dc,0x1e0,0x1b4,0x1e4,0x7ffd3938c728,0x7ffd3938c734,0x7ffd3938c740
        5⤵
        
        PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
      4⤵
      Uses browser remote debugging
      Loads dropped DLL
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2432240689671 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2432240689671\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x320,0x324,0x328,0x31c,0x34c,0x7ffd38c3c188,0x7ffd38c3c194,0x7ffd38c3c1a0
        5⤵
        
        PID:2180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeData.json

Path C:\Users\Admin\AppData\Local\Temp\ChromeData.json
Size 676B
SHA256 80adcc988250c0fb0328d47e53ef585fc717c9935d67d0e9696ae5df7ebec4cb
MD5 fd916a80c93c30ffe1c3b2cde2d07893
SHA1 7acf4f17a469a6c1211272660d0c60a3e02428d3
SHA512 215d14bab6735ce19cff3a3e7cbb51b8b3d2ed110ea0ab5930d53bd2c1f77a0bd602966e51981fca1ac2d4f869901b62653762f77ef717c320c6fe330d207216
TLSH
T19401FE48CAB0984358CA2FB0450C55C3D316198398E1BE00335ED58C6F2C42B0BBC0E4
MD5 SHA1 SHA512 TLSH

Submit Download

DllExtractChromiumSecrets.dll

Path C:\Users\Admin\AppData\Local\Temp\DllExtractChromiumSecrets.dll
Size 45KB
SHA256 b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
MD5 f8c81aac564cf5834e602553a19c17a0
SHA1 bee29ea3fe90c45bab11b2bf941fbbcbc6acbbf9
SHA512 47b75ea9e8bf78c94d667b89baf395963d0ae14d7d5bb38bf10e4242c7d2dcca803488359a6855bcee8a34b076340858cd1640303dd58fcb5047d3c33b864d58
SSDEEP 768:wvwHEYygsZskufDOF9H2+NR5hj5fltKm3PYI43MGnnJp1H3JKaObM0+MI7ZZQ0:wYkYygsZvufDO77PJltlfl4VJTH3Jx0C
TLSH
T15B23494E734905EEC996C6B8D064B81BF2F13449B620865F5370D92B6F27213FA3E74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DumpBrowserSecrets.exe

Path C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
Size 381KB
SHA256 c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
MD5 0e51138ef195ac755f052babb761a1e7
SHA1 3c7bbeabc56110d3463e6002cd0ff5c9a168d64b
SHA512 fb0dac538776a0e0655fbdc2ca72c2965f42ac7f0f70bb8f1b405a2aff01f24d467d51e5526c7cb6aeda3e9440e6cfc89269b784a8dc3e9ecd68546499c17455
SSDEEP 6144:axlobBTrFQ4DwLin1zF2UMus9nAauNXlqciCucn6BqGjbCEg7rLbuZhn3l+CoWZk:8QdyBxjbCFroh3l+C6E0+
TLSH
T19F849F59E3E504F9E5A3D238C462D527E6717C465730CF9F22B48B2A2F232A29E3C751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeData.json

Path C:\Users\Admin\AppData\Local\Temp\EdgeData.json
Size 258B
SHA256 af1befbb312c84a551a9923b9b386d931b36bbc11c90afc9d2b7274b5ce65782
MD5 2dbc84e37e0a58f506d7666db969ff1f
SHA1 2f51214d7ff104a16fcc0e857be11a07390a3903
SHA512 0cb9197b2b652b9aa46029f33e214e68b4b5e5e9c130dd7ada8846f03d44036f88d247da9cdc8020f63c69dc07673d58b3119b4a8c6589c8c668865ab23f5ba4
TLSH
T13DD05E1686B4805298CD2F758E0A22C3AE050E91D2B07F0571AF62C84F7A97A177C9D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2432240689671\Crashpad\settings.dat
Size 280B
SHA256 cdca183060bb6b5027aecb485501f1d93fb03a30d2b59357b755cc868d35802c
MD5 ac88235875cad340b694beb661c7df79
SHA1 05ad5b3d612ba1b5c21c2481b9806e773ba1aa07
SHA512 afdaed4eb9a61f1de3adab0c268421729c2194eccb0e0345dd7efe39c0137d3c905523bf35fcf16d5bb4ab4cf056acd8e40af4c7e512f4c25be07c30b1ba9a90
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2432240689671\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1ysola3r.i20.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ysola3r.i20.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1748-69-0x0000000006AA0000-0x0000000006FCC000-memory.dmp

Download

memory/1748-73-0x00000000078A0000-0x00000000078AA000-memory.dmp

Download

memory/1748-72-0x00000000078C0000-0x0000000007952000-memory.dmp

Download

memory/1748-71-0x00000000066F0000-0x0000000006766000-memory.dmp

Download

memory/1748-13-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1748-16-0x0000000005C20000-0x00000000061C4000-memory.dmp

Download

memory/1748-17-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/1748-66-0x00000000063A0000-0x0000000006562000-memory.dmp

Download

memory/4736-2-0x00000280D98B0000-0x00000280D98D2000-memory.dmp

Download

memory/4736-0-0x00000280D8F80000-0x00000280D8F90000-memory.dmp

Download

memory/4736-1-0x00000280D8F80000-0x00000280D8F90000-memory.dmp

Download

memory/4736-12-0x00000280D8F80000-0x00000280D8F90000-memory.dmp

Download

memory/4736-11-0x00000280C0DF0000-0x00000280C0DFA000-memory.dmp

Download

memory/4736-10-0x00000280D9DA0000-0x00000280D9E32000-memory.dmp

Download