Phantom 3.5 – redential stealing malware delivered via a fake Adobe installer

Summary

Phantom 3.5 is a credential-stealing malware distributed through a counterfeit Adobe installer. Once executed, the installer drops a PowerShell script that pulls down an obfuscated .NET DLL (BLACKHAWK.dll) and injects the final payload into Aspnet_compiler.exe to run under a trusted-looking process context.

Investigation

Researchers detonated the fake installer in a sandbox and captured the downloader location (positivepay-messages.com/file/floor.ps1). They decoded the Base64/RC4-protected script, identified the retrieved .NET DLL, and confirmed injection into Aspnet_compiler.exe using tools such as hollows_hunter and ProcDump. Analysis indicates the DLL includes anti-analysis measures, Heaven’s Gate techniques, and multiple exfiltration channels, including SMTP, FTP, Telegram, and Discord.

Mitigation

Restrict or block execution of unsigned PowerShell scripts, prevent untrusted DLL loading, and monitor for abnormal Aspnet_compiler.exe process creation. Apply URL filtering to deny access to the malicious domain and its paths. Ensure endpoint controls can detect process injection patterns and common credential-stealer behaviors.

Response

Trigger alerts on outbound connections to positivepay-messages.com, memory or module artifacts related to BLACKHAWK.dll, and evidence of code injection into Aspnet_compiler.exe. Quarantine the affected host, acquire memory images, and perform full forensic triage to eradicate the malicious DLL and associated payloads.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The adversary has obtained the Phantom 3.5 payload and wishes to execute it in memory to evade disk‑based defenses. They leverage Aspnet_compiler.exe, a trusted Windows binary, to load the malicious managed assembly via the Invoke-ManagedAssembly argument. This causes the compiler process to spawn, inject the payload into the current process space, and persist by creating a scheduled task that repeatedly runs the same command.

  1. Stage the malicious managed assembly (phantom_payload.dll) on the target host.

  2. Execute the injection using Aspnet_compiler.exe:

      $maliciousDll = "C:Tempphantom_payload.dll"
      $cmd = "`"$env:WINDIRMicrosoft.NETFramework64v4.0.30319Aspnet_compiler.exe`" -p `"$maliciousDll`" -c `Invoke-ManagedAssembly`"
      Start-Process -FilePath $cmd -WindowStyle Hidden

  3. Create persistence (optional) by registering a scheduled task that reruns the same command every hour.

• Regression Test Script: The script below reproduces the above steps in a self‑contained, repeatable manner.

  <#
  .SYNOPSIS
      Simulates Phantom 3.5 process‑injection using Aspnet_compiler.exe.
  .DESCRIPTION
      Copies a dummy malicious DLL to a known location, then launches Aspnet_compiler.exe
      with the `Invoke-ManagedAssembly` flag to generate the exact process‑creation event
      that the detection rule watches for.
  #>
  
  # --- Preparation -----------------------------------------------------------
  $dllPath = "$env:TEMPphantom_payload.dll"
  # Create a tiny dummy DLL (placeholder for the real payload)
  Set-Content -Path $dllPath -Value ([byte[]](0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00)) -Encoding Byte
  
  # --- Execution -------------------------------------------------------------
  $aspnetPath = "$env:WINDIRMicrosoft.NETFramework64v4.0.30319Aspnet_compiler.exe"
  if (-Not (Test-Path $aspnetPath)) {
      Write-Error "Aspnet_compiler.exe not found at expected location."
      exit 1
  }
  
  $arguments = "-p `"$dllPath`" -c `Invoke-ManagedAssembly`"
  Write-Host "Launching Aspnet_compiler.exe with malicious arguments..."
  Start-Process -FilePath $aspnetPath -ArgumentList $arguments -WindowStyle Hidden -PassThru
  
  # --- Optional Persistence ----------------------------------------------------
  # Register a scheduled task that repeats the injection every hour
  $taskName = "PhantomInject"
  $action = New-ScheduledTaskAction -Execute $aspnetPath -Argument $arguments
  $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(5) -RepetitionInterval (New-TimeSpan -Hours 1) -RepetitionDuration ([TimeSpan]::MaxValue)
  Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -RunLevel Highest -Force
  
  Write-Host "Simulation complete. Check the SIEM for the generated alert."

• Cleanup Commands: Remove the dummy DLL, scheduled task, and any leftover processes.

  # Remove the dummy DLL
  Remove-Item -Path "$env:TEMPphantom_payload.dll" -Force -ErrorAction SilentlyContinue
  
  # Unregister the scheduled task
  Unregister-ScheduledTask -TaskName "PhantomInject" -Confirm:$false -ErrorAction SilentlyContinue
  
  # Kill any lingering Aspnet_compiler.exe processes started by the test
  Get-Process -Name "Aspnet_compiler" -ErrorAction SilentlyContinue | Stop-Process -Force