phantom_stealer | 5a377768e8920ec7a99a69905ebfd114b7e3c37f0722ba7a7ea99dde17bdeec3

Analysis

user interaction
yes
max time kernel
94s
max time network
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MATCHA3.exe
Size 7.0MB
Sample260810-xyg2csfp7w
SHA256 5a377768e8920ec7a99a69905ebfd114b7e3c37f0722ba7a7ea99dde17bdeec3
MD5 f11bb909c7a4dd2967f504198710e0af
SHA1 ad7ba7b33155fc94afe48c49f08e7e9aec3f1722
SHA512 593a874f6ae9c2b434340a0f45d6f133cbf5aeee2ce3a97375170cb47d8f62a9d6c74dc1fd684388362a3c45de7470a0d54e9fbade8b3f3ddfc391b37150eb51
SSDEEP 196608:JMPuV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:iA403qakSoR7tfI7ZtXADu8X9Y95GQLJ
TLSH
T1ED76334463EC0659F1BFAB78F87162119E32B513E43AE74D198C119C0A72B82EDA1F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution phantom_stealer stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v2.0

https://api.telegram.org/bot8661929523:AAHlD1YuZCosbQnCZJV8xnOWBFblPuT62tE/sendMessage?chat_id=8759568265

Mutex

ERJ2248DAZ1KKGV7O3T1

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
rb_discord
0
rb_smtp
0
rb_telegram
1
start_delay
0
startup
1
webcam_screenshot
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/1048-1-0x0000026AC51F0000-0x0000026AC58FC000-memory.dmp	family_phantomstealer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2584	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5232	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4332	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	MATCHA3.exe
Token: SeDebugPrivilege	4332	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2584	1048	MATCHA3.exe	89
PID 2584 wrote to memory of 3528	2584	cmd.exe	91
PID 2584 wrote to memory of 4332	2584	cmd.exe	92
PID 2584 wrote to memory of 5232	2584	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\MATCHA3.exe
"C:\Users\Admin\AppData\Local\Temp\MATCHA3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\d2413cac-a0f8-4ca7-ac92-df45cc105013.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /PID 1048
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\system32\timeout.exe
    timeout /T 2 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d2413cac-a0f8-4ca7-ac92-df45cc105013.bat

Path C:\Users\Admin\AppData\Local\Temp\d2413cac-a0f8-4ca7-ac92-df45cc105013.bat
Size 152B
SHA256 d50be3e3a8787a3be29f0b4204b4ebf2490e213819e2312184a6dbab5a571a4e
MD5 b3733224db659c9064ba73460ce9730e
SHA1 fa03654af5213fefddcb3a7e03ef8d338bbf7403
SHA512 28cc7606415cd8db1d02562ac619063f79aeb2324fce839792e96fb480bb678b8b0c6fca4bf109209051a28521058b74e9b2eb3931c2781dbab645d2500d97cb
TLSH
T15CC02B01268662FD644094C694A923FDD8A5E4591F4633C02100C0C893A05CC7D072C7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1048-0-0x00007FFB0B42F000-0x00007FFB0B430000-memory.dmp

Download

memory/1048-1-0x0000026AC51F0000-0x0000026AC58FC000-memory.dmp

Download

memory/1048-2-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/1048-3-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/1048-4-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/1048-5-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/1048-6-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/1048-7-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

memory/1048-10-0x00007FFB0B2A0000-0x00007FFB0BC44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads