phantom_stealer | 0b4cc8d0fdd4c4569285a0b89d5101ca717d9f8c6ee01d230ea59683682c13be

Analysis

max time kernel
298s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER RFQ 1180.vbs
Size 2.7MB
Sample260825-rd8exstbrg
SHA256 0b4cc8d0fdd4c4569285a0b89d5101ca717d9f8c6ee01d230ea59683682c13be
MD5 32b34b54d5b6935f1ea87120d3f75d6d
SHA1 b5af3d973420c3927ea511e8e882fb36d0d529ab
SHA512 67f5c28d8826c8b11aff2be6c4928d8eadc3d0e025dd18f3e4fc70766da7db8712c6195428fe13d5c9f60b16685a99027d85ac01a8ff93dd20d163b418ae8abc
SSDEEP 49152:HAFrv2JDT3SXjxaeUNTBXjKPDN3Use6pg3J+d1L:s
TLSH
T17BD533706D4A2F454D358124C8954C168EFD6FD981CEFEEEBB4032CA076C42AE87B9B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion execution phantom_stealer stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.insticod.es
Port
587
Username
[email protected]
Password
Ho6!m3e2*

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
9euGEDc2B+LnAXD2yCz/8HSkO2m1wfd9XRLi5/zO0hNQAAAAd7dtZWkSbk8eAuCGLwGCg7l9Zhx2A5c05ZuVP/FCS97hmp84cDRSFY67fg5vEVAxH/R9uRQWiVoiKMPB7/T2j5KNx2idLuMiEDM1ak4JQhHepyyq5zL2QH1tnpiVTs1MM3uxA+28E5E9pqHHTbb2kg==
Username
cXUoC9zu7a87NJwale6pbu2qL4gp8JtkjWihcvo3EuVQAAAA7Cr7ak4EErI2uquEjmRiz/21N7IennsA81mdCDlCAMY4lreaDSNd0fCALsT7kdsj/xexZLQHB4xG2VY9PTuX10lhGfVgYn2ZZxx5DDFmxvz6jCaYWiW68tB6lNKrxem9SvVhHoax/d7+x3bbOKENNQ==
Password
HrjBIiI9nmZtMgFwkgVvI+paGeNGupaagBe3MWKCP05QAAAAnZU86UTshei+5aIO9dYQIB7cCLhWlUk7axAEf21JKpbQMneXKntikKZKUFWY+H6/t3AA2TtsfWU/vqswbDMWkn4gyUwk7BbBq1Q/OwGgUsY7eAvlVO4NeMFCd46otxU5
Email to
rvwHt7PitbclVQckiFpziKo+e12wAmzAUeSCuo4wy7ZQAAAAcaWXOUz7ZPfMXxBewPZjFlA4Uurumn87mute6jy1inpI4qsaW1zYq8D+jQO6u0RRVCVx8GgxjTgD2aDp+yLhZ9Vuh7cpejuHPT2nXHeDrDCAeLlfbIYv7ho/Blhh0MrQ5ck5F/l7MLztjul08raByw==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

0COHBQEGNLL02WSM5W1P

Wallets

IbmOLIk+wqxCEPaJPUiPbBhzJrFiULmh5QZj/91iQ95QAAAA7IoU3QZDCNNXfuPd6kaVJ5VrnhCkI/EFccrUDm7X2f/9t8iMwXUvvAkGHSTJRbrmpcJ5f/mN7YTn2qDSRTljWmwl9CwLKArfNYdzOaxpUzwRMBTYeXJ0ldfo5IuEit+URVEBfeIPRoJv9bNbNDGfkuz7OdH6m/yc4SfQB83lMPk=
GfCIx+o8E+8xU1/sU+b3PUHVwYHEp5f+lf25Q4kchzlQAAAAXh8RWXtJ2M1MMwAMuPHuHHLQ6xImiJYnURPzUkKV503x+c6hfJhNHCQR8ANzka/K2foHxAeGer3F7h2cpCedLPw8k2ELqeiXHFkF0YM2JVh5T/oWSdEkDJD5dFxhPy2FwkPl2t1HS5/NgmELMOf6+6ZiE06xinwYCLN4Tkyynn4=
9/ZW1jfPVzkZj1+GCWLO4hOXXq85CajjR1dyGlJEyP1QAAAADH0Wx2LiHkOeOaCNeIKYj0yFa8Sj+NkAkuM649TekDYK1cXZo00RpDtJzI2pE0WwvBhsZ4bF9ka1XjHQerbQ0N7UROcNuwKrmMEKZpBXhqpGDnRklud6D6d7xreh9eaVTVD4FMsDBEYPCDyoDi5T2XqolgLcxf/DY2kk1sAxoxI=
6V8886pFWVDhOMWV89KzA5JloB09viyjL6UM7FJo3CZQAAAAn583l0UNVKMP9K+pfTgTLKJgwQ+TZoU9O32mUPx43OVtISBs6eDTkWIujw198F+kVq8yudoOP7KaT0BfvFJVFJmdaGksOpJeGEW5sg3Kq+1AYkYLBFJ4G2l5bay5ngMTauFSAnc9I6eWUIfrgXZQDvMkq3fnxUDSbQn7mkA6sFE=
93hf58f50oSnY98pkjoLQmFoZJShvoAMS9wn/dbpZ6JQAAAAVGvkuTEOVyy8tXbCcP9y+ZngHLAArmYZp/2pW9V/bwQddyE+p5J0nIn0/u0v/I2mv32iQdV7o8ZgDUgupIGPKHde+S+qInmLVXatl64ZKMcdSbEdVH9SpiCjNc06wjAkoTshoxJrU85p5j7qAbf3zjy9tIBF0elIjfuq7vAZ3C0=

Attributes

clipper
true
enable_ssl
true
passwords
true
smtp_enabled
true

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4256	powershell.exe
4580	powershell.exe
5844	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4660	WScript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1204	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 3132	3000	prevhost.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
5844	powershell.exe
5844	powershell.exe
4256	powershell.exe
4256	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
4580	powershell.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe
3000	prevhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4580	powershell.exe
4580	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeIncreaseQuotaPrivilege	4580	powershell.exe
Token: SeSecurityPrivilege	4580	powershell.exe
Token: SeTakeOwnershipPrivilege	4580	powershell.exe
Token: SeLoadDriverPrivilege	4580	powershell.exe
Token: SeSystemProfilePrivilege	4580	powershell.exe
Token: SeSystemtimePrivilege	4580	powershell.exe
Token: SeProfSingleProcessPrivilege	4580	powershell.exe
Token: SeIncBasePriorityPrivilege	4580	powershell.exe
Token: SeCreatePagefilePrivilege	4580	powershell.exe
Token: SeBackupPrivilege	4580	powershell.exe
Token: SeRestorePrivilege	4580	powershell.exe
Token: SeShutdownPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeSystemEnvironmentPrivilege	4580	powershell.exe
Token: SeRemoteShutdownPrivilege	4580	powershell.exe
Token: SeUndockPrivilege	4580	powershell.exe
Token: SeManageVolumePrivilege	4580	powershell.exe
Token: 33	4580	powershell.exe
Token: 34	4580	powershell.exe
Token: 35	4580	powershell.exe
Token: 36	4580	powershell.exe
Token: SeDebugPrivilege	3000	prevhost.exe
Token: SeIncreaseQuotaPrivilege	4580	powershell.exe
Token: SeSecurityPrivilege	4580	powershell.exe
Token: SeTakeOwnershipPrivilege	4580	powershell.exe
Token: SeLoadDriverPrivilege	4580	powershell.exe
Token: SeSystemProfilePrivilege	4580	powershell.exe
Token: SeSystemtimePrivilege	4580	powershell.exe
Token: SeProfSingleProcessPrivilege	4580	powershell.exe
Token: SeIncBasePriorityPrivilege	4580	powershell.exe
Token: SeCreatePagefilePrivilege	4580	powershell.exe
Token: SeBackupPrivilege	4580	powershell.exe
Token: SeRestorePrivilege	4580	powershell.exe
Token: SeShutdownPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeSystemEnvironmentPrivilege	4580	powershell.exe
Token: SeRemoteShutdownPrivilege	4580	powershell.exe
Token: SeUndockPrivilege	4580	powershell.exe
Token: SeManageVolumePrivilege	4580	powershell.exe
Token: 33	4580	powershell.exe
Token: 34	4580	powershell.exe
Token: 35	4580	powershell.exe
Token: 36	4580	powershell.exe
Token: SeIncreaseQuotaPrivilege	4580	powershell.exe
Token: SeSecurityPrivilege	4580	powershell.exe
Token: SeTakeOwnershipPrivilege	4580	powershell.exe
Token: SeLoadDriverPrivilege	4580	powershell.exe
Token: SeSystemProfilePrivilege	4580	powershell.exe
Token: SeSystemtimePrivilege	4580	powershell.exe
Token: SeProfSingleProcessPrivilege	4580	powershell.exe
Token: SeIncBasePriorityPrivilege	4580	powershell.exe
Token: SeCreatePagefilePrivilege	4580	powershell.exe
Token: SeBackupPrivilege	4580	powershell.exe
Token: SeRestorePrivilege	4580	powershell.exe
Token: SeShutdownPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeSystemEnvironmentPrivilege	4580	powershell.exe
Token: SeRemoteShutdownPrivilege	4580	powershell.exe
Token: SeUndockPrivilege	4580	powershell.exe
Token: SeManageVolumePrivilege	4580	powershell.exe
Token: 33	4580	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	msiexec.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 5844	4660	WScript.exe	89
PID 4660 wrote to memory of 1204	4660	WScript.exe	91
PID 1204 wrote to memory of 4256	1204	cmd.exe	93
PID 1204 wrote to memory of 5692	1204	cmd.exe	94
PID 1204 wrote to memory of 4260	1204	cmd.exe	95
PID 1204 wrote to memory of 5476	1204	cmd.exe	96
PID 1204 wrote to memory of 4892	1204	cmd.exe	97
PID 1204 wrote to memory of 1812	1204	cmd.exe	98
PID 1204 wrote to memory of 2896	1204	cmd.exe	99
PID 1204 wrote to memory of 4316	1204	cmd.exe	100
PID 1204 wrote to memory of 3464	1204	cmd.exe	101
PID 1204 wrote to memory of 4580	1204	cmd.exe	102
PID 1204 wrote to memory of 3360	1204	cmd.exe	104
PID 4580 wrote to memory of 2484	4580	powershell.exe	106
PID 2484 wrote to memory of 4300	2484	csc.exe	107
PID 4580 wrote to memory of 6052	4580	powershell.exe	108
PID 6052 wrote to memory of 4880	6052	csc.exe	109
PID 4580 wrote to memory of 3444	4580	powershell.exe	110
PID 4580 wrote to memory of 2016	4580	powershell.exe	111
PID 3444 wrote to memory of 3000	3444	msiexec.exe	112
PID 3444 wrote to memory of 3000	3444	msiexec.exe	112
PID 3444 wrote to memory of 3000	3444	msiexec.exe	112
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113
PID 3000 wrote to memory of 3132	3000	prevhost.exe	113

Views/modifies file attributes 1 TTPs 9 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3464	attrib.exe
3360	attrib.exe
5476	attrib.exe
4892	attrib.exe
1812	attrib.exe
4316	attrib.exe
5692	attrib.exe
4260	attrib.exe
2896	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER RFQ 1180.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $RJWMPK=$env:ZLAW;$YHPKP=$env:IBQMYAXX;$MGPUP=$env:NZJK+$env:UNKCB+$env:PSGANN+'.'+$env:IQMFQEO;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($MGPUP));$LXJYTOVR=foreach($TPXFO in [IO.File]::ReadAllLines($YHPKP)){if($TPXFO.IndexOf($RJWMPK)-eq 0){$TPXFO.Substring($RJWMPK.Length) -split 'UGGRMOPHZL'}};[IO.File]::WriteAllLines($MGPUP,[string[]]@($LXJYTOVR),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20268255434966.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20268255434966.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:QOAGZRVDGISF))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.cmd"
    3⤵
    - Views/modifies file attributes
    PID:5692
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.bat"
    3⤵
    - Views/modifies file attributes
    PID:4260
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\tile_db\tile_db.cfg"
    3⤵
    - Views/modifies file attributes
    PID:5476
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\tile_db\tile_db_GIVDWHSU.cmd"
    3⤵
    - Views/modifies file attributes
    PID:4892
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\tile_db\tile_db.cfg"
    3⤵
    - Views/modifies file attributes
    PID:1812
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\tile_db\tile_db_GIVDWHSU.cmd"
    3⤵
    - Views/modifies file attributes
    PID:2896
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\tile_db"
    3⤵
    - Views/modifies file attributes
    PID:4316
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20268255434966.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:QOAGZRVDGISF))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\unhfeyma\unhfeyma.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FA6.tmp" "c:\Users\Admin\AppData\Local\Temp\unhfeyma\CSCDF20F836D77945C5B632B5ECDAF4CD1.TMP"
        5⤵
        
        PID:4300
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\huwxybxz\huwxybxz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6052
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80A0.tmp" "c:\Users\Admin\AppData\Local\Temp\huwxybxz\CSCF3CE2370AFDA420AB4F215E9CC4A2D.TMP"
        5⤵
        
        PID:4880
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        
        PID:3000
      - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\386c9dd6076a9bb8db02c245a6b42a37"
        6⤵
        
        PID:3132
  - - C:\Windows\system32\choice.exe
      "C:\Windows\system32\choice.exe"
      4⤵
      PID:2016
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20268255434966.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20268255434966.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20268255434966.cmd
Size 2.7MB
SHA256 a7a71be82a8ec57c6eafca6ae129e66c052524498089db131d133c30aee208db
MD5 22b63da8317cb4239b2736bbb4d79a7f
SHA1 3314291d7ed3ad84f99c45606d4cb268e32f5d8a
SHA512 bfebef617f14befa061650b366ee5bafdf1979855444a1396e043020bbeaca4d5618f79bc07d5f066c56f0c62fd7ad6335b55437a164da51648101d87807e771
SSDEEP 49152:3KNnj0NLffSz/FaKkbbdTRgpDr/iU2W5gHvm4pD:1
TLSH
T160D533709E9E2F865DF88138A1699C151B36EFE0C34DDCEDF74232C609ADA42E46B435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 b59acd7d644137925462f1bff27e02318053d1c60417ae43847a25bda32a120a
MD5 bb87e7dd7b6bb19d3c2af13d01eaa3c3
SHA1 cc52017417803ad1761d1c646eb4b3151debc39d
SHA512 d511727a2e39ba4d4159bf183d14c13c3b7b96e73838899c82d90f8f38e875eb40c8efa74d44e829fb6378ae277054c56af0301fc12b78ad29790fac6d6c7519
TLSH
T125116633F3CC8624DC5A403650DEAD1136B687CB409ECE6B7B84D154B42F699DE612A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f2f2e7c84c183c5924ca665738ab6baf34b20138fc651eb13a3ad5f3446b523c
MD5 6f3906131e31c68e9b07cfce8da96918
SHA1 f392d1592b3655ca891d1e219f41dd333963f48b
SHA512 269260d5c7d8b8b03314ac4f2417812b3f7752852b3e745cce2e9fe5759721d61f776dcc8afbb318819fbe864758fa61a3542f821cb819d1acab7935bf1e222d
TLSH
T1A3218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES7FA6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7FA6.tmp
Size 1KB
SHA256 285def766ab6812a78e19603e074f63b2edf29ae7c090db3ad8d6e0249caec2e
MD5 c0972c975d4cbdf8ee820e4b1b885236
SHA1 5b6c09214d7fedb27215d394893f95c8321451e4
SHA512 461ccc0c159ba7b9974e1293d813290fd19fbeaa87db7acce39887d457abbc14d129d22afc4d0d75e2a584cf4123ee35d0c4ac829775d06e962ce1129061dbf9
TLSH
T18721CC0593EC471FF0731B3169F6032BA234FD95AFB1A35E854402282C41248FEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES80A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES80A0.tmp
Size 1KB
SHA256 a355303daec5b89d9becfa88b9884a84587c032470370055e18c6f71fe311a2a
MD5 f1e4082b2dc5e2ba8e1d78f8fd8a21e0
SHA1 fa9056cb648756a57ebf5833a7f47de471d0a4d4
SHA512 53fd212a8819905204ee80a39057cd9bc3c42c7e1d9498533f3b8495ec32889e9f86872f5f3d3375ed4a3b5eaf5a429b4f932295f11a3e2aa09e146979d8145d
TLSH
T14D21CC0183E9470FF077573169FA132FE274FDA5EFB1A35A454041292C42604EEE1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tgh1kk0u.dbs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgh1kk0u.dbs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_4580_e598207.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4580_e598207.txt
Size 70B
SHA256 7dc63b7789b85c42eb71046f587f1cc5a1eeed3bf975fcebd7880d5adf0b3ba1
MD5 a253abc68553d29298b5a1fc91a89ecf
SHA1 4b30ff0a4e0431d807ccb14d99ecdd60ebef99cd
SHA512 a9ac87ee1a587b93c920b8a4801704175c4d90acab5ce3db8344aac0b09ed73e0618e0faaa5a2f867d2f3a4cd7bf959c4e3002e5497b300243ef1000129a50f3
TLSH
T15FA0026F0CB74C5AC75A1F25254D61E106A0B1815BCBA8409AD0D3F0B16DE75C304758
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_4580_e598207.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_4580_e598207.txt
Size 86B
SHA256 4a096dff2c17b4481b0c4a83f86ae0bcf3466f9240d1808d3ae4e59de5db2d2c
MD5 180002df08f14408d5d29e61a354471a
SHA1 209b8cfe350e47626d000d967b9f68d17987ad1c
SHA512 99d09e2d302ebe9c3f79a9bd3ecc0b7af5e218acc6dcbed6c85582f1c0be30a9a2861e95639d6a34eb48a8c271a216b667ff7063b491fcf2d52c115b3f8fb8ac
TLSH
T19BA0122A08630C05C3150F50200D30910150B44107C65480499083F0711CE22C700304
MD5 SHA1 SHA512 TLSH

Submit Download

huwxybxz.dll

Path C:\Users\Admin\AppData\Local\Temp\huwxybxz\huwxybxz.dll
Size 66KB
SHA256 2e71ba88b252c2c6c10977376bc3227e497876cba6d84a09a35c4187744960cb
MD5 edc071d2ddfccd54bebcaa0457639831
SHA1 2ca4b068ccc6fddc578750ba61862e3b3cf1737a
SHA512 39d6b62394b81d717e6e7352ec9d0eb8a4d37901e946025ec1624d94512d80c400f167a2e780790a18977804bdaada0b178d9528e36ee0976ca345b54d695edc
SSDEEP 1536:UpApJfk8mK288KbTC31L0Ea4WVIqJtPnItNGcMUYficfCO+y3WwKHHo5g97EaU/T:UpApJfTmKD8KbTClL0Ea4WfQQ5Uu3WwD
TLSH
T1EC63089577F84968F27E6B769AB102809734B0973B73D78E02E541E96F337C08606BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unhfeyma.dll

Path C:\Users\Admin\AppData\Local\Temp\unhfeyma\unhfeyma.dll
Size 3KB
SHA256 c053ca6a714cd5ea95f1f3ab0a5cfd5891a8830521942e55f57e7ee10d084862
MD5 c62641b65fbb65b23df99be49bde9890
SHA1 210c286386678385998ee66ec36d4df5810b78c2
SHA512 7234e7c473f50d114790e0671dde19951890b94f5e24804c220108eb6378b7f97a656641a59d020565721456f230c2cf0247aaaba22aa9c064d2628080d61cb8
TLSH
T199515A2697E84677F1774B306EF3072632B4FC609B7297AE1981432C6C546A46E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF3CE2370AFDA420AB4F215E9CC4A2D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\huwxybxz\CSCF3CE2370AFDA420AB4F215E9CC4A2D.TMP
Size 652B
SHA256 e67e97a696a03d5c0f26ac0ff8cd550c44a92773ad1a92438fc58cd91c6a8100
MD5 28b753c10a5977aa661c1d48505ef32f
SHA1 a3c3e57f459a0ca8d140c34f1315d9228ed9d7b1
SHA512 d01ae0d3c3e9377f655b128bb37b6d8acb144269d16007db4c476c2583f91cdfbd658026f29a5f337ffd0ff3109b00ebadb02b684b773f5055373aa555bb5ac7
TLSH
T194F0824967F8020EF1F74B70BDF643A3D1A9BC65DE7293ED1480431D6C656108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

huwxybxz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\huwxybxz\huwxybxz.0.cs
Size 94KB
SHA256 63cfe0844945d0a633d7ad5af85fe26a5c4c65e99c22c1784cc6b3ed165c5e7f
MD5 fd6bae838bf4ede92e2c69a6948629ef
SHA1 7feab34b9535808fda3280dfcbe316ce14c6dd89
SHA512 8c1f529feab0bfbf84b05d768e3d370fe40e404dde6c37c7c35fa145e4b5f44d481d6e5ff8c6fb0e44268496f1835e0a10a47bae2a87a27b270d686159f6fe5d
SSDEEP 1536:6zrlD7vZAJLdOmXJ5UftfVpqu9qMipdjbbdAMwndoDNkm/MqB21Ss:K74dOg5UlfVpqu9qMipdjfdAMwdoDNkb
TLSH
T15093C591A709912E6DD02529ACCC604EFB53C53123F914B4D9ADC1A03E4E67DD2BFFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

huwxybxz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\huwxybxz\huwxybxz.cmdline
Size 247B
SHA256 29530e256b2da2d8554a51f44b05f1740cf5be85757032fb796f8ac5fa8b9d16
MD5 debc66a1aedf65aa0e02c18d897f7eb5
SHA1 2914e1458bc9eaea51580957537e9899f5a50214
SHA512 3c4621b8077becc5dad8596664804179db0ac066fd9e3e277d2512ef4318cd750f2a6adbd0a6ebd6d8233e504497a1eb7c654697584a2cdc0d5c750575a1347f
TLSH
T175D05E2982C6C26932D8204B3D93C4FC4BB6196919253F50A6B2814C351748876D2386
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDF20F836D77945C5B632B5ECDAF4CD1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\unhfeyma\CSCDF20F836D77945C5B632B5ECDAF4CD1.TMP
Size 652B
SHA256 067acf91109b8c07a6da95e300b96cb6b4223e38b633d5eb1f6c375096d50629
MD5 97c91db0303aa926b2aca0df8913f6af
SHA1 bb52ed323ccc70841980cfe9cf9809c8e196b4f2
SHA512 1cbbb9a60a311654cce5b45c71814d532e1f95e468bfd492b76a74baa9d3e59aff78c162419d906655e626a249730670fd2df32c57501e8b5e0db088b4176909
TLSH
T16AF05E09A3F8020EF0F34B30BEF6436391A9BCA5DE7293ED1540032928646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

unhfeyma.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\unhfeyma\unhfeyma.0.cs
Size 60B
SHA256 987fefb55f5ec95ae927ada3bfbfb64e8f022193cfb3296ec65b561053578c72
MD5 5008e65bbf396b7984284b437a87f2f2
SHA1 05c32416a4a9ffc8f61bbc7c754803b56dbc06d6
SHA512 004d9177e0fab5c1e109d5243259b07c4de2c67ae4f9137b611f866395bf987f534c1f58011dbfd3c5b54de2819469fd21fd83e79678d68b28578f01f28b73f8
TLSH
T1E0A002413651E5350987D803C511CC33EB0694F05BBC7E12C1550F113E0040BB23816B
MD5 SHA1 SHA512 TLSH

Submit Download

unhfeyma.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\unhfeyma\unhfeyma.cmdline
Size 369B
SHA256 3a66f12489db65ea6dc679402cae98c8e410330927e8c47eb02f57fbce66bd88
MD5 a92fbccc3703d4aebff285feffed998c
SHA1 3a8f8e921894fe9814d71f1520e61fe28839b44e
SHA512 139a63a50419f76100f31eb26fc58b874503374b8c4ed0e387d5b7e36d4c2eae67f96ca0171ab0fb8a43234f3c3b0f0544b80cf08edbf0aeb3991b364cb5f76e
TLSH
T180E0202A5296C67E15DD101B2169C9ACE27217C72BB17FC4D5DC449DF01F004B7E1765
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3000-80-0x0000018422A60000-0x0000018422A61000-memory.dmp

Download

memory/3000-102-0x000001843D240000-0x000001843D290000-memory.dmp

Download

memory/3000-79-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/3000-101-0x000001843D1C0000-0x000001843D236000-memory.dmp

Download

memory/3000-87-0x000001843D3A0000-0x000001843D570000-memory.dmp

Download

memory/3000-88-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/3000-100-0x000001843D570000-0x000001843D732000-memory.dmp

Download

memory/3132-94-0x0000000040000000-0x0000000040167000-memory.dmp

Download

memory/3132-96-0x0000000040000000-0x0000000040167000-memory.dmp

Download

memory/3444-76-0x000001D0E8540000-0x000001D0E870E000-memory.dmp

Download

memory/3444-59-0x000001D0E84F0000-0x000001D0E8540000-memory.dmp

Download

memory/3444-63-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/3444-73-0x000001D0E84F0000-0x000001D0E8540000-memory.dmp

Download

memory/3444-77-0x000001D0E8540000-0x000001D0E870E000-memory.dmp

Download

memory/4580-30-0x000001BDFDF10000-0x000001BDFDF1A000-memory.dmp

Download

memory/4580-29-0x000001BDFDE00000-0x000001BDFDEB2000-memory.dmp

Download

memory/4580-58-0x000001BDFDAE0000-0x000001BDFDAF8000-memory.dmp

Download

memory/4580-32-0x000001BDFE120000-0x000001BDFE144000-memory.dmp

Download

memory/4580-31-0x000001BDFE120000-0x000001BDFE14A000-memory.dmp

Download

memory/4580-45-0x000001BDFD7F0000-0x000001BDFD7F8000-memory.dmp

Download

memory/4580-28-0x000001BDFDDE0000-0x000001BDFDDFE000-memory.dmp

Download

memory/4660-15-0x00000259CCCB0000-0x00000259CCD2C000-memory.dmp

Download

memory/5844-1-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-6-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-4-0x00000218A95E0000-0x00000218A9602000-memory.dmp

Download

memory/5844-5-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-0-0x00007FF8EAB8F000-0x00007FF8EAB90000-memory.dmp

Download

memory/5844-14-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-12-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-10-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-9-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-8-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download

memory/5844-7-0x00007FF8EAA00000-0x00007FF8EB3A4000-memory.dmp

Download