Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 15:16
General
- Target Phantom-main/Phantom/Resources/UAC.dll
- Size 259KB
- Sample261024-snvr9act8k
- SHA256 2907480701d5cd8b3f1577165d59c6321dd172ad6e18e96ecc7b95c67e4e450d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Phantom-main\Phantom\Resources\UAC.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Phantom-main\Phantom\Resources\UAC.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" start -windowstyle hidden -filepath 'C:\Users\Admin\AppData\Local\Temp\Phantom-main\Phantom\Resources\UAC.dll,#1'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_dng2svro.qfx.ps1
memory/4948-6-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/4948-14-0x0000000006260000-0x00000000065B4000-memory.dmp
memory/4948-3-0x0000000005A20000-0x0000000006048000-memory.dmp
memory/4948-4-0x0000000005870000-0x0000000005892000-memory.dmp
memory/4948-5-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/4948-0-0x00000000053E0000-0x00000000053F0000-memory.dmp
memory/4948-1-0x0000000002F30000-0x0000000002F66000-memory.dmp
memory/4948-2-0x00000000053E0000-0x00000000053F0000-memory.dmp
memory/4948-15-0x0000000006830000-0x000000000684E000-memory.dmp
memory/4948-16-0x0000000006860000-0x00000000068AC000-memory.dmp
memory/4948-17-0x00000000077B0000-0x0000000007846000-memory.dmp
memory/4948-18-0x0000000006D20000-0x0000000006D3A000-memory.dmp
memory/4948-19-0x0000000006D70000-0x0000000006D92000-memory.dmp
memory/4948-20-0x0000000007E00000-0x00000000083A4000-memory.dmp