DingBoysPElockPhantasmv10v11

Hunt Hypothesis

This detection identifies the presence of the Phantasm malware variant (versions 10 and 11) by matching file artifacts against specific YARA signatures designed to catch its unique PE lock characteristics. Proactive hunting for this behavior in Azure Sentinel is essential to uncover early-stage infections that may evade standard signature-based defenses, allowing analysts to isolate compromised endpoints before the adversary establishes persistence or initiates lateral movement.

YARA Rule

rule DingBoysPElockPhantasmv10v11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DingBoysPElockPhantasmv10v11 detection rule, tailored for a legitimate enterprise environment:

• Scenario: Microsoft Defender Antivirus (or similar EDR) performing scheduled signature updates or real-time scanning on locked PE files in the C:\Program Files directory.

  • Filter/Exclusion: Exclude process paths matching Microsoft Defender Antivirus Service.exe and MsMpEng.exe, specifically when the parent process is svchost.exe running under the “Windows Update” or “Antimalware” service context during standard business hours (08:00–18:00).

• Scenario: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager executing application deployment tasks that involve locking and verifying PE executables before installation.

  • Filter/Exclusion: Create an exclusion for the process ccmexec.exe when it is spawning child processes to handle .msi or .exe payloads, specifically filtering out events where the file extension is .dll or .sys located within the C:\Windows\CCM\ directory.

• Scenario: Enterprise backup solutions (e.g., Veeam Backup & Replication or Commvault) performing incremental backups of critical system files, which temporarily lock PE headers during data acquisition.

  • Filter/Exclusion: Exclude processes named vrb.exe (Veeam) or ctfd.exe (Commvault) when the target file path resides in known backup staging directories such as D:\BackupStaging\ or E:\TempBackup\, regardless of the specific PE lock signature detected.

• Scenario: Automated patch management tools like Ivanti Neurons or ManageEngine Patch Manager running scheduled “post-patch verification” jobs that re-lock and scan updated system