Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Phantasm employs a multi-stage infection process, leveraging malicious documents to deliver its payload.
- Command and control communication is obscured, utilizing non-standard ports to evade detection.
- Persistent mechanisms involve registry modifications and scheduled tasks to ensure the implant remains active across reboots.
Executive Summary
Our analysis of the Phantasm malware campaign has unveiled a sophisticated threat actor leveraging advanced tactics to gain initial access, execute payloads, and maintain persistence within targeted environments. The samples examined indicated that the actor employed an intricate infection chain, utilizing spear-phishing techniques to distribute malicious documents masquerading as legitimate business correspondence. Subsequent interactions with command and control (C2) servers demonstrated obfuscation tactics intended to evade conventional detection strategies.
Initial Access
During our investigation, we observed that the initial access vector for Phantasm often came through spear-phishing emails containing malicious Microsoft Word documents. These documents employed macros that, when enabled, would execute a PowerShell command leading to the download of the malicious payload from a remote server. The specific command observed in our samples included a Base64 encoded download command, illustrating the actor’s intent to obfuscate their actions and evade detection. An example of such a command is: powershell -encodedCommand .
Execution & Persistence
Once executed, the dropped payload—a variant of the Phantasm malware—installed itself in the user’s profile directory under %APPDATA%\Microsoft\Windows\User\. This directory is often overlooked during routine security checks, providing the actor a strategic advantage. The malware instrumented the registry to create persistence, modifying keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure it would execute upon user logon.
We noted that the sample employed a scheduled task for additional persistence, using schtasks to create a task that executed every five minutes. This approach ensured that even if the main payload was terminated, the actor could regain control swiftly.
Command and Control
The command and control infrastructure established by the actor was particularly interesting. The C2 communication utilized a mix of HTTP and HTTPS protocols, but uniquely, it engaged non-standard ports such as 8080 and 8443. Our telemetry indicated that the malware occasionally cycled through these ports to communicate with its C2 servers, likely as an evasion mechanism to bypass firewall rules and network filtering systems. The communication included regular beacons that sent system information and received further commands from the C2 server.
Payloads were often updated dynamically based on C2 responses, showcasing the actor’s capability to adapt their attacks in real-time and deliver additional tools such as keyloggers, data exfiltration tools, and lateral movement utilities.
Lateral Movement & Discovery
As the investigation progressed, it became evident that the Phantasm malware had capabilities for lateral movement within networks. The actors employed the T1075 – Pass the Hash technique to leverage stolen credentials, allowing them to traverse to other machines within the same network segment. Compromised accounts were recognized through their access to shared drives and administrative services.
Furthermore, the malware utilized Windows Management Instrumentation (WMI) for reconnaissance purposes to discover additional hosts. The analysis revealed queries executed against the local domain to identify network shares and open ports, indicating the actor’s attempts to map out the environment thoroughly before executing commands.
Impact & Objectives
The primary objective behind the Phantasm campaign appeared to be data exfiltration and potential system compromise. We discovered that the malware performed extensive reconnaissance to identify valuable data repositories, such as file shares containing sensitive documents. The actor seemed particularly interested in extracting files in formats such as .docx, .xlsx, and .pdf, which can include sensitive corporate information.
The impact could be catastrophic, especially for organizations in regulated industries. Beyond exfiltrating data, the presence of the implant could allow for long-term engagement within the network, posing ongoing threats even after initial infection vectors are mitigated.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: Phantasm utilized HTTP/HTTPS communication on non-standard ports for C2.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Used for initial payload download via macro execution.
- T1075 – Pass the Hash: Leveraged stolen credentials for lateral movement.
Detection Opportunities
- Monitor for suspicious PowerShell activity and commands involving encoded strings.
- Set up alerts for changes to registry keys associated with startup processes.
- Employ network traffic analysis to identify unusual outbound communications on non-standard ports.
Analyst Notes
The Phantasm campaign showcases advanced tactics and techniques that demand a nuanced approach to detection and response. Organizations should prioritize user education regarding phishing attempts, enforce strict security policies around PowerShell usage, and establish robust monitoring for abnormal system activity. Given the complexity of the threats posed by this actor, ongoing research and awareness are crucial to countering these evolving tactics effectively.
Source: Original Report