Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
13/08/2026, 16:03
General
- Target ORDER SPEC.js
- Size 3.7MB
- Sample260813-thhq6stdkg
- SHA256 dbc39a1f5d424b42ca83a0a12414a2929f3addb50e2647b376c2b9b6d5ffd96d
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
{4^v2)ET|Nr74:jv
-
Email to
-
6Y5R41EZJYIEVTQA2HLA
-
1FN3a3b66XakLPbFykvawsCTtKPHtBHNFp
-
0x7875027ea7D2c04535A6A78A83F18222Bc2Ce012
-
ltc1q4vhejh3avldylpkq9rj6dj4uv0wkj497wlhq0j
-
bitcoincash:qz2fhszqsdse8frnykllv5zwk9sjr05vyu6kkdd3af
-
TQUkvKgoq5tZGXwAhkgLwNzurj8dnonx5J
-
clipboard
true
-
clipper
true
-
cookies
true
-
credit_cards
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\ORDER SPEC.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\HUHYCKEFMZMTURVB.PIF"C:\Users\Admin\Documents\HUHYCKEFMZMTURVB.PIF" C:\Users\Admin\Documents\HUHYCKEFMZMTURVB.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c whoami3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "HUHYCKEFMZMTURVB" 2>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "HUHYCKEFMZMTURVB"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 15 /tn "HUHYCKEFMZMTURVB" /tr "cmd /c \"C:\Users\Admin\Documents\BVRUTMZMFEKCYHUH.url\"" /ru "pexwevza\admin" /f /it3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn "HUHYCKEFMZMTURVB" /tr "cmd /c \"C:\Users\Admin\Documents\BVRUTMZMFEKCYHUH.url\"" /ru "pexwevza\admin" /f /it4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\cmd.execmd1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
HUHYCKEFMZMTURVB.PIF
HUHYCKEFMZMTURVB.ttf
HUHYCKEFMZMTURVB.ubf
memory/1588-10-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-11-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-12-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-13-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-17-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-19-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-21-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-20-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-23-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-18-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-25-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-22-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-24-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-27-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-30-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-29-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-28-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-26-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-31-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-32-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-33-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-34-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-53-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-51-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-50-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-49-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-48-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-47-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-46-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-45-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-44-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-43-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-42-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-41-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-40-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-39-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-38-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-36-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-35-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-52-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-37-0x000000002A4F0000-0x000000002A500000-memory.dmp
memory/1588-54-0x0000000015E10000-0x0000000016E10000-memory.dmp
memory/1588-55-0x0000000002BC0000-0x0000000002C26000-memory.dmp
memory/1588-57-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1588-59-0x0000000029B90000-0x0000000029D52000-memory.dmp
memory/1588-60-0x0000000028AA0000-0x0000000028B16000-memory.dmp
memory/1588-64-0x0000000043AE0000-0x0000000044008000-memory.dmp