Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- The ANOMALY malware campaign leverages phishing emails as its initial attack vector.
- Utilizes a multi-stage payload with Dropper and Payload components for execution.
- Exploits lateral movement via SMB and leverages credential dumping techniques.
Executive Summary
During our investigation into the ANOMALY malware campaign, we observed a sophisticated attack vector emanating from targeted phishing emails. These emails were designed to trick users into downloading an attached Word document that contained embedded macros. When executed, these macros initiated a chain reaction, leading to the deployment of a multi-stage malware payload. Our analysis revealed that the threat actor employed various evasion techniques to maintain persistence and communicate with their command and control (C2) infrastructure, ultimately aiming for data exfiltration and lateral movement within the victim’s environment.
Initial Access
The initial access vector for the ANOMALY campaign was predominantly through spear-phishing emails. These emails, tailored to appear legitimate, contained a malicious attachment named Invoice_March2023.doc. Upon opening the document, the user was prompted to enable macros, a common tactic used by attackers to execute their malicious code. Our analysis indicated the macros contained obfuscated PowerShell commands designed to download additional payloads from a remote server. The observed domains used for this purpose included malicious.example.com, showcasing a typical use of domain generation algorithms (DGA) to evade detection.
Execution & Persistence
After initial access was established, the first stage of the malware, referred to as the Dropper, executed PowerShell commands that downloaded a second stage payload. This payload was a more sophisticated variant of the malware, which we classified as a Remote Access Trojan (RAT). The Dropper utilized a method to inject the payload into a legitimate process, thereby avoiding detection by security products. To achieve persistence, the malware created a scheduled task using schtasks.exe, allowing it to re-execute at system startup, further complicating its discovery by defenders. The task was registered under the name UpdateTask with the following path: C:\Windows\System32\Tasks\UpdateTask.
Command and Control
The C2 communication was orchestrated through encrypted HTTP traffic. During our investigation, we identified several unique IP addresses that were contacted, as well as the use of a custom, encrypted protocol for data exfiltration. The malware would periodically check in with the C2 server to retrieve additional commands or receive updates. This beaconing behavior was noted, with the malware reaching out on an average interval of five minutes. The URLs involved in the C2 communication showed signs of being frequently changed, likely to avoid detection by network security teams.
Lateral Movement & Discovery
Following successful installation, the malware attempted lateral movement across the network using the **T1075 – Pass the Hash** technique. Credentials were gleaned from memory using **Mimikatz**, a well-known credential dumping tool. The actor then used these credentials to authenticate with other machines and deploy their payload further. Additionally, it employed **T1087 – Account Discovery** to identify other user accounts within the network. This reconnaissance stage enabled the threat actor to strategize their next steps in the attack chain.
Impact & Objectives
Ultimately, the primary objectives of the ANOMALY malware campaign appeared to be data exfiltration and the establishment of long-term access to the compromised systems. Upon successful lateral movement, the malware sought to harvest sensitive data including financial records and personal information. The threat actor showed no hesitance in utilizing various measures to ensure that their access remained undetected and that they could maintain a presence within the victim’s infrastructure, allowing them to exfiltrate data over time.
MITRE ATT&CK Mapping
- T1566 – Phishing: The actor used phishing to deliver the initial payload.
- T1059 – Command and Scripting Interpreter: Execution of PowerShell scripts for payload delivery and command execution.
- T1203 – Exploitation for Client Execution: Exploited macros within a Word document to execute malicious code.
- T1075 – Pass the Hash: Used stolen credentials to access additional systems.
- T1003 – Credential Dumping: Employed techniques to harvest credentials for lateral movement.
Detection Opportunities
- Monitor user activities for execution of macros from suspicious attachments.
- Identify unusual scheduled tasks created in unexpected locations or under unusual names.
- Analyze outbound traffic for anomalous HTTP requests to suspicious domains known for C2 activity.
Analyst Notes
This case emphasizes the significance of user training on phishing detection and the implementation of robust security protocols regarding macro settings in Microsoft Office documents. It also highlights a need for continuous monitoring and auditing of C2 communications and lateral movement behaviors to mitigate the risks posed by threats similar to ANOMALY. Strengthening defenses with honeypots and anomaly detection systems could further bolster defenses against such covert persistence mechanisms.
Source: Original Report