PhantomStealer Campaign Uses BYOVD to Disable Security Tools and Steal Data
Summary
AhnLab details a phishing campaign that delivers PhantomStealer through a malicious quote-review attachment. An injector uses UAC elevation and a vulnerable driver to disable security tools before stealing credentials, cookies, wallet data, and other information.
Key points
- Phishing emails impersonate a sales employee and present a malicious attachment as a request to review a revised quote.
- The attachment contains an injector that attempts privilege elevation through SSPI, CMSTPLUA COM, or a runas prompt.
- The injector loads DCRCVDrv.Sys as a kernel driver and uses IOCTL 0x2205C0 to terminate security-product processes.
- It injects PhantomStealer into the legitimate AddInProcess32.Exe process using process hollowing.
- PhantomStealer targets keystrokes, screenshots, browser and application credentials, session cookies, payment and wallet data, files, and clipboard contents.
- Its clipper function replaces copied cryptocurrency wallet addresses with an address controlled by the threat actor.
- AhnLab advises treating the attachment and contained executable as malicious, checking for driver and process-hollowing traces, and assessing possible data theft.
Article Details
- Attack Vectors
- A phishing email impersonates a sales team member and prompts recipients to open a malicious compressed attachment.
- The attachment contains an injector that attempts UAC elevation, loads a vulnerable kernel driver, and uses it to terminate security-product processes.
- The injector uses process hollowing to execute PhantomStealer inside AddInProcess32.Exe.
- PhantomStealer collects information from the infected system and replaces cryptocurrency wallet addresses in the clipboard.
- Defensive Notes
- Treat the attachment and executable described in the report as malicious; check whether the attachment was executed and treat an executed device as a suspected infection.
- Check for C:\Windows\Temp\DCRCVDrv.Sys, the NvStreamKmd_dcrcv service, access to the \\.\DCRCVDRV_U device, and DeviceIoControl traces involving IOCTL 0x2205C0.
- Look for termination of security-product processes and process-hollowing activity involving AddInProcess32.Exe.
- Assess potential exposure of keystrokes, screen captures, browser and application account information, session cookies, system and network information, wallet data, and clipboard contents.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
phan@trimnt[.]com | Username listed with PhantomStealer's C2 mail server. | |
| HOSTNAME | mail[.]mnt[.]com | C2 mail server listed in PhantomStealer's configuration. |
| MD5 | 0c14e6b5a3a8c1cf695b38a71adf8647 | MD5 indicator listed for the malicious files. |
| MD5 | 567c158ee0858f8e941d4ab7a6c18dbc | MD5 indicator listed for the malicious files. |
| MD5 | c155a21bec649260089a4a55c0afca43 | MD5 indicator listed for the malicious files. |
MITRE ATT&CK
T1055.012 · Process HollowingThe injector hollows AddInProcess32.Exe and writes and resumes the PhantomStealer payload in that process.T1056.001 · KeyloggingPhantomStealer collects keystrokes.T1113 · Screen CapturePhantomStealer captures screen images from the primary monitor.T1115 · Clipboard DataPhantomStealer collects clipboard contents and replaces clipboard cryptocurrency wallet addresses.T1539 · Steal Web Session CookiePhantomStealer collects browser login session cookies.T1548.002 · Bypass User Account ControlThe injector attempts SSPI-based and CMSTPLUA-based UAC bypasses, with ShellExecuteExW runas as an alternative elevation method.T1555.003 · Credentials from Web BrowsersPhantomStealer collects account information stored in Chromium- and Gecko-based browsers.T1562.001 · Disable or Modify ToolsThe injector uses a vulnerable driver to terminate security-product processes.