Analysis
- max time kernel
299s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 16:25
General
- Target Enquiry-SSJ25048.js
- Size 1.9MB
- Sample260924-txchpsxt4l
- SHA256 36bcadfb4ec48f22b12f034a5d3567f976860c4dc7f970514a958f0030992e56
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
her6+eMmNJbim&[F
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
her6+eMmNJbim&[F
-
Email to
-
OJD0UOAK66GVSH0TIQMR
-
bc1qq8zs0ngk6t0ergwdknpc9m4e46pgnnns47h9er
-
0x7e3205A62FCf14a1d50aA7A58B6aE7daC471Ae9e
-
LaGNPik4pQrsipv6tXm8YCaMn3T6ZmcHyt
-
qq0zxsskge17vurzqyzdkmepwjunp5vwgvvd1vudkv
-
47NagK8jt1U6UoTzU7mFXPghQbodptiyBZB7MVkxZFyYXpUfJqHAFUR71TH6pTZub13zZS8hz4M6YTuytGwpefVTT8sS1Bc
-
TDLVU9c84owCjrKCiHXK27zdLefnM5g941
-
B7VfhomCgQXkWeLXKUB7MVrDA7iRHQ5rRMwZ2swad8pL
-
clipboard
true
-
clipper
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
screenshot
true
-
smtp_enabled
true
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detects DonutLoader 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 10 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 39 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Enquiry-SSJ25048.js1⤵
- Badlisted process makes network request
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn Enquiry-SSJ25048.js /tr C:\Users\Admin\Documents\EnquirySSJ25048.js2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 15 /tn Enquiry-SSJ25048.js /tr C:\Users\Admin\Documents\EnquirySSJ25048.js3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\Documents\bin\Onedrive.exe"C:\Users\Admin\Documents\bin\Onedrive.exe" --disable-gems msvcrt.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\EnquirySSJ25048.js"1⤵
- Badlisted process makes network request
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
TRUE.zip
Onedrive.exe
Yak.Css
msvcrt-ruby330.dll
msvcrt.dll
libffi-8.dll
libgcc_s_dw2-1.dll
libgmp-10.dll
libwinpthread-1.dll
zlib1.dll
abbrev.rb
fiddle.rb
closure.rb
cparser.rb
function.rb
import.rb
pack.rb
struct.rb
value.rb
version.rb
encdb.so
transdb.so
fiddle.so
zlib.so
optionparser.rb
memory/3596-11075-0x000000000F930000-0x000000000F93A000-memory.dmp
memory/3596-11091-0x0000000074E20000-0x0000000074E3D000-memory.dmp
memory/3596-11072-0x000000000E6B0000-0x000000000EC6A000-memory.dmp
memory/3596-11073-0x000000000E0F0000-0x000000000E156000-memory.dmp
memory/3596-11074-0x000000000F310000-0x000000000F3A2000-memory.dmp
memory/3596-11069-0x0000000003E50000-0x0000000003EE5000-memory.dmp
memory/3596-11076-0x00000000112D0000-0x0000000011492000-memory.dmp
memory/3596-11077-0x0000000011150000-0x00000000111A0000-memory.dmp
memory/3596-11078-0x0000000011220000-0x0000000011296000-memory.dmp
memory/3596-11079-0x0000000012AB0000-0x0000000012FDC000-memory.dmp
memory/3596-11080-0x0000000012580000-0x000000001259E000-memory.dmp
memory/3596-11071-0x000000000E060000-0x000000000E0EE000-memory.dmp
memory/3596-11083-0x0000000075010000-0x0000000075510000-memory.dmp
memory/3596-11090-0x0000000074E40000-0x0000000074E59000-memory.dmp
memory/3596-11089-0x0000000074E60000-0x0000000074E9A000-memory.dmp
memory/3596-11088-0x0000000074EA0000-0x0000000074EC6000-memory.dmp
memory/3596-11087-0x0000000074ED0000-0x0000000074EE9000-memory.dmp
memory/3596-11086-0x0000000074EF0000-0x0000000074EFD000-memory.dmp
memory/3596-11085-0x0000000074F00000-0x0000000074F0D000-memory.dmp
memory/3596-11084-0x0000000074F20000-0x0000000074FBF000-memory.dmp
memory/3596-11082-0x0000000000B90000-0x0000000000BA0000-memory.dmp
memory/3596-11092-0x0000000074E00000-0x0000000074E11000-memory.dmp