Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 13:47
General
- Target MGA-D20261027T_PDF.JS.js
- Size 5.2MB
- Sample261027-q3rm2adv8v
- SHA256 f5c2e408d1d383894fdb7427af09e96ac1a348f9175c8d40bdafa8bd803e18e8
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.hostinger.com
-
Port
587
-
Username
-
Password
Jas&Jay@123@
Extracted
-
phantom_stealer
-
v4.0.0
-
Protocol
smtp
-
Host
smtp.hostinger.com
-
Port
587
-
Username
-
Password
Jas&Jay@123@
-
Email to
-
4ERAKI9MND3W5M4OJB8W
-
bc1qv4asnr423zlqvjf6lgkpulwuzsl9adw5qjjes0
-
0x942EB1aBb6BE05262fB188Db6c5B7E5020a503CA
-
LaH9V74LDUXCFxtzMcbDtp3sAjnfpgHL3B
-
TTquJ2uvZiHR4e5B6iD1HeqJVXQGmroSoZ
-
clipper
true
-
enable_ssl
true
-
passwords
true
-
smtp_enabled
true
Signatures
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\MGA-D20261027T_PDF.JS.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\MGA-D20261027T_PDF.JS.js:Zone.Identifier"2⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\ZWMFAYSDGPIBIMFC.exe"C:\Users\Admin\Documents\ZWMFAYSDGPIBIMFC.exe" C:\Users\Admin\Documents\CFMIBIPGDSYAFMWZ2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\CFMIBIPGDSYAFMWZ.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ZWMFAYSDGPIBIMFC.exe"C:\Users\Admin\Documents\ZWMFAYSDGPIBIMFC.exe" "C:\Users\Admin\Documents\CFMIBIPGDSYAFMWZ"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
CFMIBIPGDSYAFMWZ
CFMIBIPGDSYAFMWZ.vbs
ZWMFAYSDGPIBIMFC.exe
ZWMFAYSDGPIBIMFC.mui
memory/6136-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-19-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/6136-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-25-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/6136-24-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/6136-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-76-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-75-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-74-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-73-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/6136-440-0x00000000749E2000-0x00000000749E3000-memory.dmp
memory/6136-441-0x0000000004530000-0x00000000045CA000-memory.dmp
memory/6136-442-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/6136-443-0x000000002AB80000-0x000000002B13A000-memory.dmp
memory/6136-444-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/6136-446-0x000000002AA10000-0x000000002AA76000-memory.dmp
memory/6136-445-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/6136-447-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/6136-884-0x000000002B840000-0x000000002BA02000-memory.dmp
memory/6136-885-0x000000002BA10000-0x000000002BA60000-memory.dmp
memory/6136-886-0x000000002BAE0000-0x000000002BB56000-memory.dmp
memory/6136-887-0x000000002BB60000-0x000000002C08C000-memory.dmp
memory/6136-888-0x000000002C180000-0x000000002C19E000-memory.dmp
memory/6136-890-0x00000000749E2000-0x00000000749E3000-memory.dmp
memory/6136-891-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/6136-892-0x000000002D950000-0x000000002D9E2000-memory.dmp
memory/6136-893-0x000000002DA80000-0x000000002DA8A000-memory.dmp