Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 08:33
General
- Target RFQ _OPGW20180126.JS.js
- Size 3.4MB
- Sample260806-kf591sgl2t
- SHA256 93c12bc920498b2d2c7aa60c66a71f794348546f8e41ff3b010aa3bf9be643bb
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.gpi.com.eg
-
Port
587
-
Username
-
Password
GizaPower@321
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
PlRSZn+NC6yheiMZeVVf98agDqiPVtXFI8GmSS2m3K9QAAAAGeuLI9NMc7O9IHESBjLvO6Y7qdxpROcGm8Zx+cWNBQXRZYhzFOidjxSp3Wn5Tbd/yf4ZlE/YwL8qAkWOaUb32idu8q/n8cw6gwHTwsXQvUhojGX2OSioIxFmCencVil/
-
Username
SWHSeYk9wOMRzxoLSFCyo0vEtCpR1L+0GZT9bdlymBFQAAAAnvFKHuJqWgeev8XkH4wsIJT2z7svx+OFc2GtSp2qCfmdAXxjkHliz0VpDSe70Fb1MyT7cVdEKdOuCutFiLT/d20GfpNnDPT2XutMmsmxKbzOnRMqv/0x1bcD9C5pR3gE
-
Password
NmfmMpbJy7c5baTjtD3yt1AsV+ESTeNVO68oSIytftVQAAAA6Dpxnt9xEvcBtIamUQN8ux7olujR2PJ9pvZE/Y5LOm03IjPTWic43QpU/1v+KtkRORNZsWk8JeSX/Du7gZyh9+CMWTfW1D6eqxnEtc1mAoXkZ20CdEJyNciW0wj9Urj0
-
Email to
mjoMjIUlCPar2Nw0a6IUIFV7omw2ZovRRR0PfJzlFvxQAAAAmgJMGtdI77VAOwX4GXxku5gzJiJaOVOFthCx5g5H04NsGTfiQxLphgXXnx9A0aq7niwxTBjPvLQdtfMQRspI6Nfffzq2duAiK2NdiIRM24EhwmMVm5wjx1Q5Vxpyc1waTx0sW/qK6nlRXG30EG2gig==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
6KOU7Z56D0O8MCHV7FX6
-
0
-
cookies
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ _OPGW20180126.JS.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ZZYFIOZHWPFNJPLE.PIF"C:\Users\Admin\Documents\ZZYFIOZHWPFNJPLE.PIF" C:\Users\Admin\Documents\ZZYFIOZHWPFNJPLE.ttf2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c whoami3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "ZZYFIOZHWPFNJPLE" 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "ZZYFIOZHWPFNJPLE"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "ZZYFIOZHWPFNJPLE" /tr "cmd /c \"C:\Users\Admin\Documents\ELPJNFPWHZOIFYZZ.url\"" /ru "oaggwfqt\admin" /f /it3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn "ZZYFIOZHWPFNJPLE" /tr "cmd /c \"C:\Users\Admin\Documents\ELPJNFPWHZOIFYZZ.url\"" /ru "oaggwfqt\admin" /f /it4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\86363f4d4cb7dc20db49f3868777063f"3⤵
-
-
-
C:\Windows\system32\cmd.execmd1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
ZZYFIOZHWPFNJPLE.PIF
ZZYFIOZHWPFNJPLE.ttf
ZZYFIOZHWPFNJPLE.ubf
memory/2080-61-0x0000000040000000-0x0000000040167000-memory.dmp
memory/2080-62-0x0000000040000000-0x0000000040167000-memory.dmp
memory/2780-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/2780-54-0x0000000015E00000-0x0000000016E00000-memory.dmp
memory/2780-55-0x0000000003860000-0x00000000038CA000-memory.dmp
memory/2780-56-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2780-58-0x0000000029350000-0x0000000029512000-memory.dmp
memory/2780-59-0x0000000029520000-0x0000000029596000-memory.dmp
memory/2780-60-0x0000000028340000-0x0000000028390000-memory.dmp
memory/2780-70-0x0000000042500000-0x0000000042A28000-memory.dmp