1d789df8df27ab5b42ab78169e3daa25f75f7adf0d8f58f2cbe0f33716efd93e

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHANTOM-Metin2-AI-Bot-main/PHANTOM.bat
Size 3KB
Sample261013-w2sftscf64
SHA256 1d789df8df27ab5b42ab78169e3daa25f75f7adf0d8f58f2cbe0f33716efd93e
MD5 1cddc525078e3dc03b7849c39a169b72
SHA1 ceb5c72a3b5a8ebe3420856c9dfc1f1c2286b477
SHA512 7510e8e67c8a33831d7b49f85ab78eba4ba6cf94e852bf8cf13cd7b2d3e79e0532c10807a8f4ebe4fd4f61814b098916a1f8fe97362a2fd8b60994f6d097fd62
TLSH
T18A719500650D9EF3806B95C99F9E10A223AFE6F31238ADCD7028C65CAF0C96586FF740
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4252	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2256	powershell.exe
4252	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	4252	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4112	phantom_python_3.11.9.exe
5220	phantom_python_3.11.9.exe
2128	python-3.11.9-amd64.exe

Loads dropped DLL 1 IoCs

pid	Process
5220	phantom_python_3.11.9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4548	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1192	cmd.exe
1672	cmd.exe
2456	cmd.exe
4516	cmd.exe
3848	cmd.exe
5932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phantom_python_3.11.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phantom_python_3.11.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.9-amd64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4548	powershell.exe
4548	powershell.exe
2256	powershell.exe
2256	powershell.exe
4252	powershell.exe
4252	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeBackupPrivilege	4460	vssvc.exe
Token: SeRestorePrivilege	4460	vssvc.exe
Token: SeAuditPrivilege	4460	vssvc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4852	4516	cmd.exe	90
PID 4852 wrote to memory of 3476	4852	net.exe	91
PID 4516 wrote to memory of 3848	4516	cmd.exe	92
PID 4516 wrote to memory of 5932	4516	cmd.exe	93
PID 4516 wrote to memory of 1192	4516	cmd.exe	94
PID 1192 wrote to memory of 4548	1192	cmd.exe	95
PID 4516 wrote to memory of 1672	4516	cmd.exe	96
PID 1672 wrote to memory of 2256	1672	cmd.exe	97
PID 4516 wrote to memory of 2456	4516	cmd.exe	98
PID 4516 wrote to memory of 4252	4516	cmd.exe	99
PID 4516 wrote to memory of 4112	4516	cmd.exe	101
PID 4112 wrote to memory of 5220	4112	phantom_python_3.11.9.exe	102
PID 5220 wrote to memory of 2128	5220	phantom_python_3.11.9.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PHANTOM-Metin2-AI-Bot-main\PHANTOM.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3.11 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c python -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$roots=@('C:\Users\Admin\AppData\Local\Temp\PHANTOM-Metin2-AI-Bot-main\..',(Join-Path $env:USERPROFILE 'Downloads')); foreach($root in $roots){ if(-not (Test-Path $root)){ continue }; foreach($f in (Get-ChildItem -Path $root -Filter python.exe -Recurse -ErrorAction SilentlyContinue)){ $p=$f.FullName; if($p -like '*\.venv\Scripts\python.exe' -and $p -like '*PHANTOM*'){ Write-Output $p } } }" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$roots=@('C:\Users\Admin\AppData\Local\Temp\PHANTOM-Metin2-AI-Bot-main\..',(Join-Path $env:USERPROFILE 'Downloads')); foreach($root in $roots){ if(-not (Test-Path $root)){ continue }; foreach($f in (Get-ChildItem -Path $root -Filter python.exe -Recurse -ErrorAction SilentlyContinue)){ $p=$f.FullName; if($p -like '*\.venv\Scripts\python.exe' -and $p -like '*PHANTOM*'){ Write-Output $p } } }"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "Get-Date -Format yyyyMMdd_HHmmss" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Date -Format yyyyMMdd_HHmmss"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c py -3.11 -c "import sys; print(sys.executable)" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; [Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\phantom_python_3.11.9.exe' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\phantom_python_3.11.9.exe
  "C:\Users\Admin\AppData\Local\Temp\phantom_python_3.11.9.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_tcltk=1 Include_test=0 SimpleInstall=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\Temp\{17959C79-04C0-4E7C-97E4-7134FC1B0D9C}\.cr\phantom_python_3.11.9.exe
    "C:\Windows\Temp\{17959C79-04C0-4E7C-97E4-7134FC1B0D9C}\.cr\phantom_python_3.11.9.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\phantom_python_3.11.9.exe" -burn.filehandle.attached=608 -burn.filehandle.self=748 /quiet InstallAllUsers=0 PrependPath=1 Include_pip=1 Include_launcher=1 Include_tcltk=1 Include_test=0 SimpleInstall=1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\Temp\{AF14A014-1C81-4660-9BFC-2A130ABE98B1}\.be\python-3.11.9-amd64.exe
      "C:\Windows\Temp\{AF14A014-1C81-4660-9BFC-2A130ABE98B1}\.be\python-3.11.9-amd64.exe" -q -burn.elevated BurnPipe.{788D27A8-04B9-413E-BD90-912D7245C613} {2EA04FCE-BF28-4ECA-B8A4-CF5B5338F030} 5220
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5566dfb134a39a555707f2b038ea493a1fd2b32fafa19ad48befcaf5f74c1895
MD5 9b3448f31ccdd1ea52e0882ab95db7ee
SHA1 6c306c9617769481fc49373e5970d1b218ba2b15
SHA512 064d8789908b4a5704c5304a37b3209b898b616f0bfd2536cc7b61a7fb7830b3f54c16428b5431e8c5c96721daf3d383ddfa3af288c707c2b777c599b47c3332
TLSH
T146115733B3CC8724C89A403650CEAC1136B597DB90DEDF6B7B84D149A83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d047a661ea77df53ce5c7d771aeeff1ac2b44d1c25c2bc206dadb4937f5c7a25
MD5 40182939b5c86d092e365757305b500f
SHA1 bff6f0d296e83e1fc7302e7ed58dbb70c00ff864
SHA512 562342af4d68b07bcf7c28d7904b8a03b7da2566cf002db5fa3d72c7f66f3b39924e69c528b781ae511f035cbea86a916a9f4704b7ec06282391e03190309ea2
TLSH
T158115733F3CC8664DC9A413650DEAC1036B68BDB449ECE9BAB84D548B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

kurulum_20261013_192659.log

Path C:\Users\Admin\AppData\Local\Temp\PHANTOM-Metin2-AI-Bot-main\runtime\logs\kurulum_20261013_192659.log
Size 26B
SHA256 ff08c9abf2b8675a453db455010ce353dfff7dab150328e5d004f9dc5794e5ce
MD5 4ec656f0e58416c59495b08a8ec1b272
SHA1 f99ecc5ac631f583cae56d6ff7943363ed8a60fd
SHA512 51a739205253584e36e608c38492d3322622da4c819225f2c738200a3f7c55ff15800facfa8f7501d09175adf9285d96a9e2108fcc727bf6f001180c587d0d91
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xhmn03kl.dfn.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xhmn03kl.dfn.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

phantom_python_3.11.9.exe

Path C:\Users\Admin\AppData\Local\Temp\phantom_python_3.11.9.exe
Size 25.0MB
SHA256 5ee42c4eee1e6b4464bb23722f90b45303f79442df63083f05322f1785f5fdde
MD5 e8dcd502e34932eebcaf1be056d5cbcd
SHA1 33fc26d62919fd473ae837991ddd6613b82d6d20
SHA512 897a14d5ee5cbc6781a0f48beffc27807a4f789d58c4329d899233f615d168a5dcceddf7f8f2d5bb52212ddcf3eba4664590d9f1fdb25bb5201f44899e03b2f7
SSDEEP 393216:fRLH7fooK4d06EQWFC6i3aRGazVuWB319hnImPbhzSfol84dDbyNx9wblIFRjQA:fRO4KhQ65i3OhtbDPbhGapA
TLSH
T19D47333350004177F9F451B6BA188534BD2C7A1427A088ADE3E8BD6D3BB6C935BFB652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phantom_python_3.11.9.exe

Path C:\Windows\Temp\{17959C79-04C0-4E7C-97E4-7134FC1B0D9C}\.cr\phantom_python_3.11.9.exe
Size 859KB
SHA256 43b0d06acf32140019c16aef9c09b4aeb8b79f72d4a50396d79e852549f33f38
MD5 dea93d35c259cb14f02b4e122f6091f0
SHA1 0bcf184d76a61873dd0f2cfccd8e0e7e06c0f826
SHA512 613e363eeeb597b0627fa955701dc32ab55b8df28d502466e5db443b82f4138fcdb218e6029b96140a2b381f9de9f63ae9905795b4b8f34cc31a8fbdc3abceb2
SSDEEP 12288:l5mWukhI2jFMSjysAS9X/GsfTDYrGiUGEHNBr9/4DATvYIU94EeAwG:l5mWpI2jFM5sFzfTpiUGyNcsLlPAwG
TLSH
T12F15AF3365A14072E7F10573BA28D530BE6CAF28175088AEE3D4BE1D7E7449267B7293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{AF14A014-1C81-4660-9BFC-2A130ABE98B1}\.ba\PythonBA.dll
Size 675KB
SHA256 cb451d5ae16a17c591cac0ed07fb0e2b92ea5dc3f66df63946608bfa65a86156
MD5 93db33c9d79fa34fe665b61d5cc845eb
SHA1 b91c6c3f68fb5153232187bd2935cae7cea198b4
SHA512 c58ba9844942fbc16e0ccda607d4a5ea43e34840dabe9a00f70325f051af25d103f6cb8329bfe38dba82327aef150d68448d9692b7bebfeb448a83ccb32e88fa
SSDEEP 6144:qL9kuRe45GoKJ6CJr0xY62azL9wTLkKuO9g4v/V8EM4Jug5M/UstkTo/E:IkX4+1azLankMhJug5H0/E
TLSH
T1B3E49E1174C08275EDF620FB46BC763996ADE1B0033499CB1BC85AEBEA205C29F37657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{AF14A014-1C81-4660-9BFC-2A130ABE98B1}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4548-5-0x00007FFE49960000-0x00007FFE4A304000-memory.dmp

Download

memory/4548-8-0x00007FFE49960000-0x00007FFE4A304000-memory.dmp

Download

memory/4548-9-0x00007FFE49960000-0x00007FFE4A304000-memory.dmp

Download

memory/4548-6-0x00007FFE49960000-0x00007FFE4A304000-memory.dmp

Download

memory/4548-0-0x00007FFE49AEF000-0x00007FFE49AF0000-memory.dmp

Download

memory/4548-3-0x000001FE578E0000-0x000001FE57902000-memory.dmp

Download

memory/4548-4-0x00007FFE49960000-0x00007FFE4A304000-memory.dmp

Download