phantom_stealer | 4f3e236f61411c9e65dcabf84ad38b22b71f4b64abf09ccab9fbcf70d038309b

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ #2776-6543.js
Size 965KB
Sample260804-kkdessbl6w
SHA256 4f3e236f61411c9e65dcabf84ad38b22b71f4b64abf09ccab9fbcf70d038309b
MD5 2c669839663b58fedffcc6b3888f326a
SHA1 85ffa12046040eb3a5d1ffb34423e3f0abf54f62
SHA512 d999cc28c848384fe972a43ab2a6d5808115d87e30825e1b58cc154be16bbb72940ad10c53138560914b4b9789e8b965f0184e7afc78b4d37afdb1845a751150
SSDEEP 768:cRbgBRMgBRvRRUOlrR4gBRDRgRRJRRqgBRvRR1RRR4gBRvRRLR4gBRDRgRRqgBRk:U
TLSH
T1A32576CD4F466235ED548778DE2953DD56FD21CFD0A8DEAC3EA09EC8016E0A42426CBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access discovery execution phantom_stealer spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v4.0.0

https://api.telegram.org/bot7743138858:AAEwjN0tp0BRmZfwurkxLexEFhKbjPAhT9Y/sendMessage?chat_id=8127768013

Mutex

9S20CGW17G5ZQLHARBK2

Attributes

passwords
true
telegram_enabled
true

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	2708	powershell.exe	84

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4976	powershell.exe
12	4976	powershell.exe

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2216	chrome.exe
2204	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	DumpBrowserSecrets.exe

Loads dropped DLL 2 IoCs

pid	Process
2216	chrome.exe
2204	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 3124	4976	powershell.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4976	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Caspol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Caspol.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4976	powershell.exe
4976	powershell.exe
4860	DumpBrowserSecrets.exe
4860	DumpBrowserSecrets.exe
2216	chrome.exe
2216	chrome.exe
4860	DumpBrowserSecrets.exe
4860	DumpBrowserSecrets.exe
2204	msedge.exe
2204	msedge.exe
4860	DumpBrowserSecrets.exe
4860	DumpBrowserSecrets.exe
3124	Caspol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	3124	Caspol.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3124	4976	powershell.exe	87
PID 4976 wrote to memory of 3124	4976	powershell.exe	87
PID 4976 wrote to memory of 3124	4976	powershell.exe	87
PID 4976 wrote to memory of 3124	4976	powershell.exe	87
PID 3124 wrote to memory of 4860	3124	Caspol.exe	88
PID 4860 wrote to memory of 2216	4860	DumpBrowserSecrets.exe	90
PID 2216 wrote to memory of 764	2216	chrome.exe	91
PID 4860 wrote to memory of 2204	4860	DumpBrowserSecrets.exe	94
PID 2204 wrote to memory of 712	2204	msedge.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ #2776-6543.js"
1⤵
PID:2880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Invoke-Expression $env:Dorado"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
    "C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe" /b:chrome /b:edge /b:brave /e:all
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
      4⤵
      Uses browser remote debugging
      Loads dropped DLL
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome2216240664046 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome2216240664046\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome2216240664046 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1d8,0x1dc,0x1e0,0x1b0,0x1e4,0x7ffa1242c728,0x7ffa1242c734,0x7ffa1242c740
        5⤵
        
        PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-gpu --remote-debugging-port=9222 --disable-background-timer-throttling
      4⤵
      Uses browser remote debugging
      Loads dropped DLL
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2204240664421 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2204240664421\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2b0,0x2b8,0x2bc,0x2ac,0x2d8,0x7ffa050ec188,0x7ffa050ec194,0x7ffa050ec1a0
        5⤵
        
        PID:712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeData.json

Path C:\Users\Admin\AppData\Local\Temp\ChromeData.json
Size 687B
SHA256 a92d19c7a3304cca940d60f784d50e770873c19751bd795feccba43154447d0f
MD5 633c85ee2a3454eb45905ac569ac37f6
SHA1 92793c078077f77e04bfc528164c0e45d0a28fe6
SHA512 c3c2de031cdedf69c438c0a23b65475b8bd89c893f35e4080c7932aeb9cc1f368c3ff8ecd7d91f12e5ad79f9ea077b9e43903d6b5298c871751969783c92ed56
TLSH
T1F501926BE671C85724C8BE75982C11C39B0049A3C09A3E84728E95ECBF9D02F5B391E8
MD5 SHA1 SHA512 TLSH

Submit Download

DllExtractChromiumSecrets.dll

Path C:\Users\Admin\AppData\Local\Temp\DllExtractChromiumSecrets.dll
Size 45KB
SHA256 b0935270bc8ed6d31c5352c49a8f5d7cbe62457133fe1cf7effeeeb1440e9ce0
MD5 f8c81aac564cf5834e602553a19c17a0
SHA1 bee29ea3fe90c45bab11b2bf941fbbcbc6acbbf9
SHA512 47b75ea9e8bf78c94d667b89baf395963d0ae14d7d5bb38bf10e4242c7d2dcca803488359a6855bcee8a34b076340858cd1640303dd58fcb5047d3c33b864d58
SSDEEP 768:wvwHEYygsZskufDOF9H2+NR5hj5fltKm3PYI43MGnnJp1H3JKaObM0+MI7ZZQ0:wYkYygsZvufDO77PJltlfl4VJTH3Jx0C
TLSH
T15B23494E734905EEC996C6B8D064B81BF2F13449B620865F5370D92B6F27213FA3E74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DumpBrowserSecrets.exe

Path C:\Users\Admin\AppData\Local\Temp\DumpBrowserSecrets.exe
Size 381KB
SHA256 c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753b
MD5 0e51138ef195ac755f052babb761a1e7
SHA1 3c7bbeabc56110d3463e6002cd0ff5c9a168d64b
SHA512 fb0dac538776a0e0655fbdc2ca72c2965f42ac7f0f70bb8f1b405a2aff01f24d467d51e5526c7cb6aeda3e9440e6cfc89269b784a8dc3e9ecd68546499c17455
SSDEEP 6144:axlobBTrFQ4DwLin1zF2UMus9nAauNXlqciCucn6BqGjbCEg7rLbuZhn3l+CoWZk:8QdyBxjbCFroh3l+C6E0+
TLSH
T19F849F59E3E504F9E5A3D238C462D527E6717C465730CF9F22B48B2A2F232A29E3C751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeData.json

Path C:\Users\Admin\AppData\Local\Temp\EdgeData.json
Size 258B
SHA256 5ba69c3be7de522da9c2f0820b892f46e6a964674f43fb4c234c1fe68f221b51
MD5 073dddd0ea0db099a64afefbb7a7da3c
SHA1 9d08701a1122c3bbb4d3f7ac4e75dbf51810a42b
SHA512 fc82cd99627bdee91ee7b08653c4db621f8ec4fb51f198487af6c63043e64124080ec8b17d580f88eaf348e93aac024d641f87a9c920c9893e7da0dba02375f8
TLSH
T136D0A7558579901A14DDBF324C0A25C3CB090EE5D1F53F1470AF47D88F3E426177C695
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2204240664421\Crashpad\settings.dat
Size 280B
SHA256 ccd8305f110e57481f3e724243607ce0ab26e9f5d4cb553b902d256a8f22d997
MD5 aa8452420d7a2ac415dcfec830316511
SHA1 98487bf3b6940702bb31da15f02da9730f60765b
SHA512 ec1f3abb3cf1fc11623b8872eea8a723ea13c76978b16b51c985f0e10e72fca542bff56e12ae3eda6cc393fc2ab17d5d5bf6f4efb1c4b87da9f7007c233d616a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2204240664421\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_tquyefh0.ito.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tquyefh0.ito.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3124-75-0x00000000014B0000-0x00000000014BA000-memory.dmp

Download

memory/3124-74-0x00000000014C0000-0x0000000001552000-memory.dmp

Download

memory/3124-13-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/3124-71-0x0000000006530000-0x00000000065A6000-memory.dmp

Download

memory/3124-16-0x0000000005A60000-0x0000000006004000-memory.dmp

Download

memory/3124-17-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/3124-69-0x00000000069E0000-0x0000000006F0C000-memory.dmp

Download

memory/3124-67-0x00000000062E0000-0x00000000064A2000-memory.dmp

Download

memory/4976-12-0x0000020958950000-0x0000020958960000-memory.dmp

Download

memory/4976-9-0x00000209588E0000-0x0000020958902000-memory.dmp

Download

memory/4976-1-0x0000020958950000-0x0000020958960000-memory.dmp

Download

memory/4976-0-0x0000020958950000-0x0000020958960000-memory.dmp

Download

memory/4976-11-0x0000020940640000-0x000002094064A000-memory.dmp

Download

memory/4976-10-0x000002095B580000-0x000002095B612000-memory.dmp

Download