PhantomStealer

PhantomCore develops its own malware: PhantomRAT, PhantomRShell, PhantomTaskShell, PhantomProxyLite, PhantomStealer, and the Phantom Control Panel

PhantomCore uploads PhantomTaskShell to directories on compromised legitimate sites, and PhantomStealer to VPS servers

MITRE ATT&CK TTPs ID Technique Implementation T1078 Valid Accounts Abuses compromised mail credentials

ASEC recently identified a phishing email campaign that disguised itself as a request to review a quote. The threat actor impersonated a sales team member... tricked recipients into opening the attachment.

The email contained a malicious file named “7200_Quantum_Enterprise_LLC_SSO-0661.GZ”... Inside the attachment is a file named “7200_Quantum_Enterprise_LLC_SSO-0661.Exe.”

It ships as the final stage of a four-stage Windows dropper chain that smica83 uploaded as update.ps1 on April 21: an AES-256-CBC-wrapped PowerShell decrypts to an XOR-obfuscated PowerShell

Below we see the subjects used in the various campaigns divided by day and type of malware.

The top-ranking samples this week are Script files accounting for 65,22%. MSIL files follow in second place with 20,65%. As for third place, we find Office documents (Word, Excel, PowerPoint) with 14,13%.

MITRE ATT&CK TTPs ID Technique Implementation T1078 Valid Accounts Abuses compromised mail credentials

It then calls SCM RPC through the acquired pipe to create and start a Service that runs the current sample... It then calls the CreateServiceW function to register the created DCRCVDrv.Sys file as a kernel driver service with the Service Control Manager (SCM).

The injector performs process hollowing on the legitimate process C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.Exe. It then allocates a memory region in the target process through `VirtualAllocEx`, inserts the PhantomStealer payload through `WriteProcessMemory`, and calls `ResumeThread`.

The injector performs process hollowing on the legitimate process C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.Exe.

This file is an “injector”-type malware that exploits vulnerable drivers to disable security software... used in a BYOVD (Bring Your Own Vulnerable Driver) attack.

MITRE ATT&CK TTPs ID Technique Implementation T1078 Valid Accounts Abuses compromised mail credentials

It then calls SCM RPC through the acquired pipe to create and start a Service that runs the current sample... It then calls the CreateServiceW function to register the created DCRCVDrv.Sys file as a kernel driver service with the Service Control Manager (SCM).

If it is running with standard user privileges, it sequentially attempts SSPI-based privilege escalation and automatic CMSTPLUA COM elevation; if automatic elevation fails, it uses the `runas` behavior of `ShellExecuteExW` as a last resort.

The injector performs process hollowing on the legitimate process C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.Exe. It then allocates a memory region in the target process through `VirtualAllocEx`, inserts the PhantomStealer payload through `WriteProcessMemory`, and calls `ResumeThread`.

The injector performs process hollowing on the legitimate process C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.Exe.

MITRE ATT&CK TTPs ID Technique Implementation T1078 Valid Accounts Abuses compromised mail credentials

an XOR-obfuscated PowerShell, which decodes a .NET reflective launcher DLL we call ALTERNATE.EXECUTE

The injected PhantomStealer runs within the context of the AddInProcess32.Exe process and collects data such as keystrokes...

It also steals... login session cookies... Cookies Login session cookies stored in the browser

It collects... account information stored in browsers and applications... Account names, passwords, and host names stored in Chromium- and Gecko-based browsers, as well as in FileZilla, FoxMail, WinSCP, and Outlook

PhantomCore uses its in-house infostealer, PhantomStealer, to export, decrypt, and save as an archive the authentication data stored on the infected host in Chrome and Yandex browsers

It also steals... system and network information... Operating system, username, computer name, locale, antivirus software, default gateway, internal IP, and external IP

the final PhantomStealer payload running inside Aspnet_compiler.exe targets: ... Cryptocurrency wallet extensions ... Wireless network passwords ... System reconnaissance

The injected PhantomStealer runs within the context of the AddInProcess32.Exe process and collects data such as keystrokes...

The injected PhantomStealer runs within the context of the AddInProcess32.Exe process and collects data such as keystrokes and screen captures...

It also steals cryptocurrency wallet data and clipboard contents... Clipboard history Text copied by the user to the clipboard | It performs a “clipper” function that replaces cryptocurrency wallet addresses stored in the clipboard with the threat actor’s address.

PhantomCore automates collection of files and authentication data stored in local repositories and databases of infected hosts using PhantomStealer, XenArmor All‑In‑One Password Recovery, and Rclone

File Collection Files and documents with specified file extensions or located in specified paths

PhantomCore archives the authentication data and files found in local repositories and databases of infected hosts using PhantomStealer and Rclone

MITRE ATT&CK TTPs ID Technique Implementation T1071.003 Application Layer Protocol: Mail SMTP exfiltration via port 587

ftp.omamontaggi[.]it collects AgentTesla exfiltration; ftp.corella[.]ro collects PhantomStealer exfiltration.

This file is an “injector”-type malware that exploits vulnerable drivers to disable security software... Through this method, the injector terminates security products... using kernel-mode privileges.

The DeviceIoControl API is called on the acquired device handle to send a request to terminate the target process... Through this method, the injector terminates security products... using kernel-mode privileges.