Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/10/2026, 11:05
General
- Target 2026-10-15_8913fac1296bb8622d39922a68f0e0b9_glassworm_icedid_luca-stealer_mass-logger_njrat.exe
- Size 1.8MB
- Sample261016-m7azashb85
- SHA256 9dac4c7b111ece4b78ac716d98f44526e6e2ed1ec4a418030e043c762f3218e6
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.gpi.com.eg
-
Port
587
-
Username
-
Password
GizaPower@321
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
mail.gpi.com.eg
-
Port
587
-
Username
-
Password
GizaPower@321
-
Email to
-
Q0BZWG7TWCOR74Y2OG6X
-
cookies
true
-
credit_cards
true
-
enable_ssl
true
-
keylogger
true
-
passwords
true
-
smtp_enabled
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing possible sandbox analysis VM names 1 IoCs
- Detects executables containing possible sandbox analysis VM usernames 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_8913fac1296bb8622d39922a68f0e0b9_glassworm_icedid_luca-stealer_mass-logger_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_8913fac1296bb8622d39922a68f0e0b9_glassworm_icedid_luca-stealer_mass-logger_njrat.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\6a7e90e4957329da41deb7ca2d37879c"2⤵
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\6a7e90e4957329da41deb7ca2d37879c"2⤵
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" all -k --output-path "C:\Users\Admin\AppData\Local\Temp\6a7e90e4957329da41deb7ca2d37879c"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/1700-15-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-16-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-2-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-3-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-4-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-5-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-1-0x00007FF832A5F000-0x00007FF832A60000-memory.dmp
memory/1700-31-0x000000001FBD0000-0x00000000200F8000-memory.dmp
memory/1700-0-0x0000000000010000-0x00000000001E0000-memory.dmp
memory/1700-21-0x000000001CE70000-0x000000001CEC0000-memory.dmp
memory/1700-17-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-18-0x00007FF8328D0000-0x00007FF833274000-memory.dmp
memory/1700-19-0x000000001D040000-0x000000001D202000-memory.dmp
memory/1700-20-0x000000001CEF0000-0x000000001CF66000-memory.dmp
memory/4656-13-0x0000000040000000-0x0000000040167000-memory.dmp
memory/4656-6-0x0000000040000000-0x0000000040167000-memory.dmp