Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 12:50
General
- Target Docx6656534587367856..JS.js
- Size 3.8MB
- Sample260804-p3b2xabb89
- SHA256 acaceea94128ac2a18cf660c156cb2645ca6fa614bde0cfb893c4173661909dd
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
ftp
-
Host
ftp.episcenergy.com
-
Username
-
Password
dBARkW_FHC6@e)66
-
X5ZYV5AAZU6QJ34K9CNG
-
bc1qq7fap9953rzk69tqpcuzq0u5k4jpwgnjxu85nv
-
ltc1qsuetauhaz8wstk20t5cghpqcg04esvgqj68cg2
-
clipper
true
-
ftp_enabled
true
-
passwords
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Docx6656534587367856..JS.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\OHDLJYEQAPRKZJTK.PIF"C:\Users\Admin\Documents\OHDLJYEQAPRKZJTK.PIF" C:\Users\Admin\Documents\OHDLJYEQAPRKZJTK.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
OHDLJYEQAPRKZJTK.PIF
OHDLJYEQAPRKZJTK.ttf
memory/4200-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-12-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/4200-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-17-0x0000000002800000-0x0000000002801000-memory.dmp
memory/4200-18-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/4200-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/4200-325-0x0000000074682000-0x0000000074683000-memory.dmp
memory/4200-326-0x000000002A2E0000-0x000000002A346000-memory.dmp
memory/4200-327-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/4200-328-0x000000002A400000-0x000000002A9BA000-memory.dmp
memory/4200-329-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/4200-330-0x000000002A9C0000-0x000000002AA26000-memory.dmp
memory/4200-331-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/4200-332-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/4200-334-0x000000002BA40000-0x000000002BC02000-memory.dmp
memory/4200-335-0x000000002BCB0000-0x000000002BD26000-memory.dmp
memory/4200-339-0x0000000074682000-0x0000000074683000-memory.dmp
memory/4200-340-0x0000000074670000-0x0000000074E2C000-memory.dmp
memory/4200-341-0x000000002CEA0000-0x000000002CEB2000-memory.dmp
memory/4200-343-0x0000000074670000-0x0000000074E2C000-memory.dmp