Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 13:41
General
- Target ORDER H306116.scr
- Size 2.8MB
- Sample260910-qy4f2athpe
- SHA256 ed51a8723dfafd4df5c7c967ad6e597a7e9d0bbc8c58e0419c5be98688b59924
Malware Config
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
bGgK8jreadWcLI08Quog14Urr+d5BFrB63wxlXK0p2dQAAAA1WkGdzC2IHk4zJyONqNVJY2rc2A99a7Ib/vXI8N5NI3elUFXkGaZ2lNkfI041FF5pal2Ng9NBOewbQHFn6N7/EayfoTH9aPeSrtzRgp+DGEImx9xoyPc7xBDYwAJRKF41PGMBdJW1IZQAx5m0Fq33w==
-
Username
7f0o89tXWgH98MddSOo8A+dCNYM4ZV7GrYmk3HF4eYhQAAAAGbXXYslQT0fyQetcY3Bt+QRl6aXafv27c1zSv6iGBXgcOw6kd5E+N3KJce8lKllab7GT6sx3ldPjL61m9t7Jo4E2aC3APWkXVVm2v37FiEFH10BJwXXE2+hyU/30XCnyKfqeDliSQFpvxQnwB2QIpw==
-
Password
71G+2bVRthjk8311XToFi0WpsTjguyVINQrdDbbIvFBQAAAAjNK8qBh6l1IpUdd3v8JM+m0SWJexdgtCbSBd+J9JNXjjnVNwXzYxqK8xVDczaPWdrmDh9O8Qd6vFeUpKXE4SHaHsHbqtcSQdeK+WUdxZF4xDgth6ZFD1GnrEN2dnQsXI
-
Email to
AEpEjQ7Ge2EjeUTSwn5nEgArkyJ/JAHLPq+OSdxESXhQAAAAPpY9N2S9ibBnp1i5RS3ZJl1KJIWSClY9yv3uBKRM78qSBcu1Dlbd/c9/Sfv8kz+LqEqb4uAHTVt8O/AmanzSK3Rc1BqNhc6FtZc3Omb3kWHlV6618cZXsAzBBDMwnkiex3YVjx+8EJexGNeSY1kW9w==
-
Protocol
ftp
-
Host
0
-
Username
0
-
Password
0
-
R2FD4IJ8JY4LQQ596BED
-
0
-
passwords
true
-
smtp_enabled
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER H306116.scr"C:\Users\Admin\AppData\Local\Temp\ORDER H306116.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER H306116.scr"C:\Users\Admin\AppData\Local\Temp\ORDER H306116.scr"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4576-6-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-0-0x00007FFC9299F000-0x00007FFC929A0000-memory.dmp
memory/4576-2-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-3-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-4-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-5-0x000001F3B0DE0000-0x000001F3B0DFE000-memory.dmp
memory/4576-1-0x000001F3AEB20000-0x000001F3AEDEA000-memory.dmp
memory/4576-7-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-8-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-9-0x000001F3CD290000-0x000001F3CD51C000-memory.dmp
memory/4576-12-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/4576-11-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp
memory/5968-10-0x0000000140000000-0x00000001401EE000-memory.dmp