A phishing email asking someone to check a revised quote turns out to carry an attachment that loads a kernel driver, uses it to shut down the machine's antivirus, and only then starts stealing. AhnLab's Security intelligence Center (ASEC) published its analysis of the campaign, in which the sender impersonated a salesperson at an overseas company and claimed an earlier quote needed revising and product versions confirming.
The attachment was a compressed file named 7200_Quantum_Enterprise_LLC_SSO-0661.GZ holding an executable of the same name. ASEC classifies it as an injector: its whole job is to clear the way for PhantomStealer, an information stealing payload it plants inside a legitimate Windows process.
Getting to SYSTEM without a prompt
The injector checks first whether it already holds an administrator token. If it does not, it works through three escalation routes in order. The first authenticates to the local machine over SSPI, connects to the named pipe \\127[.]0[.]0[.]1\Pipe\ntsvcs while impersonating the resulting token, and uses that pipe to ask the Service Control Manager to create and start a service running the sample, which lands it at LocalSystem. If that fails it activates the CMSTPLUA COM object, a component Windows elevates automatically. Only as a last resort does it call ShellExecuteExW with runas, which puts a consent prompt in front of the user.
The driver is the whole trick
With SYSTEM in hand, the injector writes a kernel driver to C:\Windows\Temp\DCRCVDrv.Sys and registers it as a service named NvStreamKmd_dcrcv. Loading it opens a channel between ordinary user mode code and the Windows kernel, reached through the device object \\.\DCRCVDRV_U. This is a BYOVD attack, short for bring your own vulnerable driver: instead of fighting a security product's self protection in user mode, where it is designed to hold, the attacker borrows kernel privileges from a driver and terminates the process from above.
The command is a single DeviceIoControl call carrying the driver specific IOCTL code 0x2205C0 and the target's process ID, after which the driver calls ZwTerminateProcess itself. ASEC watched it take out SecurityHealthService.exe, part of Windows Security, at PID 5296.
A kill list roughly 150 names long
The hard coded target list reads like a vendor directory: CrowdStrike Falcon, Microsoft Defender, SentinelOne, Sophos, Trend Micro, Kaspersky, ESET, Bitdefender, Palo Alto's Cortex agent, Carbon Black, Cylance, Cybereason, FortiEDR, Elastic Endpoint and a long tail of regional products. Notepad.exe is on it too.
Only after that does PhantomStealer run. The injector hollows out C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, a signed Microsoft .NET binary, writes the payload into the space it clears, and resumes the thread, so the theft happens under a process name nobody looks at twice.
What PhantomStealer takes
Keystrokes, screen captures of the primary monitor, and saved account details from Chromium and Gecko based browsers as well as FileZilla, FoxMail, WinSCP and Outlook. It also collects login session cookies, stored card details, system and network information, files matching set paths or extensions, browser extension and desktop cryptocurrency wallets, and clipboard history. A clipper rounds it off, swapping any wallet address the user copies for the attacker's own. Stolen data leaves over SMTP to mail[.]mnt[.]com on port 587, using the account phan[at]trimnt[.]com.
Hunt for the driver, then the service
ASEC's guidance is to treat both the .GZ attachment and the executable inside it as malicious and to consider any machine that ran it compromised. Look for C:\Windows\Temp\DCRCVDrv.Sys on disk, a registered service named NvStreamKmd_dcrcv, handles to \\.\DCRCVDRV_U, DeviceIoControl calls carrying 0x2205C0, and process hollowing in AddInProcess32.exe. Security tooling exiting without explanation is itself the signal. The reported file hashes (MD5) are 0c14e6b5a3a8c1cf695b38a71adf8647, 567c158ee0858f8e941d4ab7a6c18dbc and c155a21bec649260089a4a55c0afca43.
No single move in this chain is new. What is worth noticing is how routine the sequence has become: a quote request, a privilege escalation with two fallbacks, a borrowed kernel driver, and a commodity stealer running inside a Microsoft binary. The same PhantomStealer family showed up in Italy's weekly phishing tally this month, and switching off the defences before doing the real work is exactly what North Korea's Lazarus group spent a Windows zero-day on. Here it cost an email.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.