742ac35201d479dd8cb1ba9b481bdd759b7711a36418e38b5b4841f33cb74f5c

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORBIT + Phantom mw19.exe
Size 17.0MB
Sample260823-3ztpfabe82
SHA256 742ac35201d479dd8cb1ba9b481bdd759b7711a36418e38b5b4841f33cb74f5c
MD5 fb13c5e237a0e7571dcdfb77338696b4
SHA1 5487962165557ba5b202bd53893e2da209c2a1f1
SHA512 b7c26ba9fc7b25a917ed25405e01e4f866a415080fd1b48fd3da20e2d853f7c05a388ce1c1804a2018036e70145b0573f7c6b9f96b649f99897259afea2387a5
SSDEEP 393216:0dOtKFTJ9SXINHz6wtJeedeSaPqQ7Wfl0O7G9e/jAXVd:0ogF19SXSWwtJeTbPHCfl00Gc0Xb
TLSH
T102073306B5C300FAC0DAC3B99232B03FB23D37A1952E7CA567E945111C53969DDFAE46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2372	ORBIT + Phantom mw19.exe
2372	ORBIT + Phantom mw19.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2492	sc.exe
4112	sc.exe
2436	sc.exe
5944	sc.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe
2184	cmd.exe
5652	cmd.exe
5708	cmd.exe
3352	cmd.exe
4812	cmd.exe
2776	cmd.exe
2620	cmd.exe
5920	cmd.exe
2040	cmd.exe
2276	cmd.exe
3112	cmd.exe
4880	cmd.exe
4796	cmd.exe
1172	cmd.exe
3000	cmd.exe
3236	cmd.exe
2232	cmd.exe
5740	cmd.exe
964	cmd.exe
1240	cmd.exe
2172	cmd.exe
1984	cmd.exe
4976	cmd.exe
2652	cmd.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
3096	taskkill.exe
3152	taskkill.exe
2648	taskkill.exe
5588	taskkill.exe
4148	taskkill.exe
988	taskkill.exe
720	taskkill.exe
5376	taskkill.exe
1512	taskkill.exe
4352	taskkill.exe
5228	taskkill.exe
2288	taskkill.exe
4676	taskkill.exe
1820	taskkill.exe
4624	taskkill.exe
3724	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2372	ORBIT + Phantom mw19.exe
2372	ORBIT + Phantom mw19.exe
2372	ORBIT + Phantom mw19.exe
2372	ORBIT + Phantom mw19.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	ORBIT + Phantom mw19.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	720	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	1820	taskkill.exe
Token: SeDebugPrivilege	4624	taskkill.exe
Token: SeDebugPrivilege	4148	taskkill.exe
Token: SeDebugPrivilege	3724	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	5228	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2776	2372	ORBIT + Phantom mw19.exe	89
PID 2372 wrote to memory of 2232	2372	ORBIT + Phantom mw19.exe	90
PID 2372 wrote to memory of 3236	2372	ORBIT + Phantom mw19.exe	91
PID 2372 wrote to memory of 1240	2372	ORBIT + Phantom mw19.exe	92
PID 2372 wrote to memory of 4812	2372	ORBIT + Phantom mw19.exe	93
PID 2372 wrote to memory of 3352	2372	ORBIT + Phantom mw19.exe	94
PID 2372 wrote to memory of 5708	2372	ORBIT + Phantom mw19.exe	95
PID 1240 wrote to memory of 2436	1240	cmd.exe	103
PID 5708 wrote to memory of 1148	5708	cmd.exe	104
PID 2232 wrote to memory of 3096	2232	cmd.exe	105
PID 4812 wrote to memory of 4676	4812	cmd.exe	106
PID 2372 wrote to memory of 2184	2372	ORBIT + Phantom mw19.exe	107
PID 2372 wrote to memory of 3692	2372	ORBIT + Phantom mw19.exe	108
PID 2372 wrote to memory of 5920	2372	ORBIT + Phantom mw19.exe	109
PID 2372 wrote to memory of 2172	2372	ORBIT + Phantom mw19.exe	110
PID 2372 wrote to memory of 2040	2372	ORBIT + Phantom mw19.exe	111
PID 2372 wrote to memory of 2620	2372	ORBIT + Phantom mw19.exe	112
PID 2776 wrote to memory of 720	2776	cmd.exe	119
PID 3236 wrote to memory of 3152	3236	cmd.exe	120
PID 2172 wrote to memory of 5944	2172	cmd.exe	122
PID 2184 wrote to memory of 5376	2184	cmd.exe	123
PID 5920 wrote to memory of 2648	5920	cmd.exe	124
PID 2040 wrote to memory of 5588	2040	cmd.exe	125
PID 3692 wrote to memory of 1512	3692	cmd.exe	126
PID 2372 wrote to memory of 5652	2372	ORBIT + Phantom mw19.exe	127
PID 2372 wrote to memory of 1984	2372	ORBIT + Phantom mw19.exe	128
PID 2372 wrote to memory of 2276	2372	ORBIT + Phantom mw19.exe	129
PID 2372 wrote to memory of 3112	2372	ORBIT + Phantom mw19.exe	130
PID 2372 wrote to memory of 3000	2372	ORBIT + Phantom mw19.exe	131
PID 2372 wrote to memory of 2652	2372	ORBIT + Phantom mw19.exe	132
PID 2372 wrote to memory of 1172	2372	ORBIT + Phantom mw19.exe	133
PID 2372 wrote to memory of 964	2372	ORBIT + Phantom mw19.exe	134
PID 2372 wrote to memory of 5740	2372	ORBIT + Phantom mw19.exe	135
PID 2372 wrote to memory of 4796	2372	ORBIT + Phantom mw19.exe	136
PID 2372 wrote to memory of 4976	2372	ORBIT + Phantom mw19.exe	137
PID 2372 wrote to memory of 4880	2372	ORBIT + Phantom mw19.exe	138
PID 3112 wrote to memory of 2492	3112	cmd.exe	151
PID 2276 wrote to memory of 4352	2276	cmd.exe	152
PID 964 wrote to memory of 4148	964	cmd.exe	153
PID 1172 wrote to memory of 4624	1172	cmd.exe	154
PID 5740 wrote to memory of 1820	5740	cmd.exe	155
PID 5652 wrote to memory of 3724	5652	cmd.exe	156
PID 3000 wrote to memory of 988	3000	cmd.exe	157
PID 1984 wrote to memory of 5228	1984	cmd.exe	158
PID 4976 wrote to memory of 2288	4976	cmd.exe	159
PID 4796 wrote to memory of 4112	4796	cmd.exe	160

C:\Users\Admin\AppData\Local\Temp\ORBIT + Phantom mw19.exe
"C:\Users\Admin\AppData\Local\Temp\ORBIT + Phantom mw19.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ORBIT + Phantom mw19.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\ORBIT + Phantom mw19.exe" MD5
    3⤵
    PID:1148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:5944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000140181000-0x0000000140452000-memory.dmp

Download

memory/2372-3-0x00007FFB52870000-0x00007FFB52872000-memory.dmp

Download

memory/2372-2-0x00007FFB52860000-0x00007FFB52862000-memory.dmp

Download

memory/2372-1-0x00007FFB52850000-0x00007FFB52852000-memory.dmp

Download

memory/2372-16-0x00007FFB52930000-0x00007FFB52932000-memory.dmp

Download

memory/2372-15-0x00007FFB52920000-0x00007FFB52922000-memory.dmp

Download

memory/2372-14-0x00007FFB52910000-0x00007FFB52912000-memory.dmp

Download

memory/2372-13-0x00007FFB52900000-0x00007FFB52902000-memory.dmp

Download

memory/2372-7-0x00007FFB528A0000-0x00007FFB528A2000-memory.dmp

Download

memory/2372-6-0x0000000140000000-0x0000000140916000-memory.dmp

Download

memory/2372-12-0x00007FFB528F0000-0x00007FFB528F2000-memory.dmp

Download

memory/2372-11-0x00007FFB528E0000-0x00007FFB528E2000-memory.dmp

Download

memory/2372-10-0x00007FFB528D0000-0x00007FFB528D2000-memory.dmp

Download

memory/2372-9-0x00007FFB528C0000-0x00007FFB528C2000-memory.dmp

Download

memory/2372-5-0x00007FFB52890000-0x00007FFB52892000-memory.dmp

Download

memory/2372-4-0x00007FFB52880000-0x00007FFB52882000-memory.dmp

Download

memory/2372-17-0x00007FFB52940000-0x00007FFB52942000-memory.dmp

Download

memory/2372-19-0x00007FFB52960000-0x00007FFB52962000-memory.dmp

Download

memory/2372-21-0x00007FFB52980000-0x00007FFB52982000-memory.dmp

Download

memory/2372-20-0x00007FFB52970000-0x00007FFB52972000-memory.dmp

Download

memory/2372-22-0x00007FFB52990000-0x00007FFB52992000-memory.dmp

Download

memory/2372-18-0x00007FFB52950000-0x00007FFB52952000-memory.dmp

Download

memory/2372-8-0x00007FFB528B0000-0x00007FFB528B2000-memory.dmp

Download

memory/2372-27-0x0000000140181000-0x0000000140452000-memory.dmp

Download

memory/2372-28-0x0000000140000000-0x0000000140916000-memory.dmp

Download