Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 15:16
General
- Target Phantom-main/Phantom/Resources/UAC.dll
- Size 259KB
- Sample261024-snvr9act8k
- SHA256 2907480701d5cd8b3f1577165d59c6321dd172ad6e18e96ecc7b95c67e4e450d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Phantom-main\Phantom\Resources\UAC.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Phantom-main\Phantom\Resources\UAC.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" start -windowstyle hidden -filepath 'C:\Users\Admin\AppData\Local\Temp\Phantom-main\Phantom\Resources\UAC.dll,#1'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3340-0-0x0000000074922000-0x0000000074923000-memory.dmp
memory/3340-1-0x0000000002710000-0x0000000002746000-memory.dmp
memory/3340-2-0x0000000074910000-0x00000000750CC000-memory.dmp
memory/3340-3-0x0000000005300000-0x000000000594A000-memory.dmp
memory/3340-6-0x0000000005270000-0x00000000052D6000-memory.dmp
memory/3340-5-0x0000000005200000-0x0000000005266000-memory.dmp
memory/3340-4-0x0000000005160000-0x0000000005182000-memory.dmp
memory/3340-7-0x0000000074910000-0x00000000750CC000-memory.dmp
memory/3340-8-0x0000000005A10000-0x0000000005D6B000-memory.dmp
memory/3340-11-0x0000000005F50000-0x0000000005F6E000-memory.dmp
memory/3340-12-0x0000000005F70000-0x0000000005FBC000-memory.dmp
memory/3340-13-0x0000000006F20000-0x0000000006FB6000-memory.dmp
memory/3340-16-0x0000000007780000-0x0000000007D3A000-memory.dmp
memory/3340-15-0x00000000064D0000-0x00000000064F2000-memory.dmp
memory/3340-14-0x0000000006480000-0x000000000649A000-memory.dmp
memory/3340-18-0x0000000074910000-0x00000000750CC000-memory.dmp