Beware of phishing emails disguised as requests to review quotes (PhantomStealer)

MITRE Techniques

• [T1566.001 ] Spearphishing Attachment – The attack delivered the payload through a malicious email attachment masquerading as a quote review request (‘The email contained a malicious file named “7200_Quantum_Enterprise_LLC_SSO-0661.GZ”’).
• [T1068 ] Exploitation for Privilege Escalation – The malware attempts to gain higher privileges through UAC bypass and elevation methods (‘it sequentially attempts SSPI-based privilege escalation and automatic CMSTPLUA COM elevation’).
• [T1548.002 ] Bypass User Account Control – It uses SSPI-based UAC bypass, CMSTPLUA COM elevation, and runas to bypass or request elevation (‘prompts the loopback authentication process to use the elevated token’; ‘activating the CMSTPLUA COM object’; ‘specifying the runas behavior’).
• [T1027 ] Obfuscated Files or Information – The payload was hidden inside a compressed attachment to evade attention (‘which contained a malicious compressed file’).
• [T1014 ] Rootkit – The malware abuses a vulnerable driver in kernel mode to terminate protected security processes (‘Through this method, the injector terminates security products … using kernel-mode privileges’).
• [T1562.001 ] Disable or Modify Tools – It targets and terminates security software processes to hinder defenses (‘injector terminates security products’).
• [T1211 ] Exploitation for Defense Evasion – The attacker leverages a vulnerable driver to bypass user-mode restrictions and kill security tools (‘Bring Your Own Vulnerable Driver’; ‘terminate security products—whose termination is restricted to user-mode privileges’).
• [T1543.003 ] Create or Modify System Process: Windows Service – The malware creates and starts a service for the driver (‘CreateServiceW function to register the created DCRCVDrv.Sys file as a kernel driver service’).
• [T1055.012 ] Process Hollowing – It injects PhantomStealer into AddInProcess32.Exe by hollowing the legitimate process (‘performs process hollowing on the legitimate process C:WindowsMicrosoft.NETFrameworkv4.0.30319AddInProcess32.Exe’).
• [T1106 ] Native API – It uses Windows APIs such as CreateFileW, DeviceIoControl, VirtualAllocEx, WriteProcessMemory, and ResumeThread to carry out the attack (‘calls the CreateFileW function’; ‘The DeviceIoControl API is called’).
• [T1057 ] Process Discovery – It checks whether it already has administrator privileges before proceeding (‘The malware first checks whether the current process is running with administrator privileges’).
• [T1112 ] Modify Registry – Not mentioned directly in the article; no confirmed registry modification was described.
• [T1055 ] Process Injection – PhantomStealer is injected into a legitimate process (‘injects and executes the PhantomStealer malware into legitimate processes’).
• [T1056.001 ] Keylogging – PhantomStealer collects keystrokes and input content (‘collects data such as keystrokes’).
• [T1113 ] Screen Capture – PhantomStealer captures screenshots from the primary monitor (‘Screen Captures’).
• [T1005 ] Data from Local System – It collects stored account information, cookies, wallet data, clipboard contents, and system/network information from the victim host (‘stored account information’; ‘Cookies’; ‘clipboard contents’).
• [T1041 ] Exfiltration Over C2 Channel – The stolen data is intended to be sent via the configured mail server/C2 infrastructure (‘C2 Mail Server: mail.Mnt[.]Com:587’).
• [T1115 ] Clipboard Data – It steals clipboard contents and replaces wallet addresses in the clipboard (‘Clipboard history’; ‘Clipper’).