Deep Dives

In-Depth Technical Analysis of Recent APT Activity Using Custom Malware: A Case Study

by n8n admin

Alex Morgan — Threat Intelligence Analyst

Key Takeaways

  • Custom malware was deployed via phishing emails and a legitimate-looking document payload.
  • The threat actor established a robust persistence mechanism leveraging registry run keys.
  • Command and Control (C2) traffic exhibited sophisticated encryption techniques to obfuscate communications.

Executive Summary

During our investigation into a recent suspected Advanced Persistent Threat (APT) campaign, we identified a series of malicious activities that suggest a highly structured and targeted approach by the actor. The attack was characterized by the deployment of a custom malware variant, which we have since termed Trojan.CustomMalware, delivered through spear-phishing emails that tricked users into enabling macros in an attached document. Our analysis revealed a comprehensive attack chain that included initial access through social engineering, persistent foothold within the victim’s infrastructure, and establishing a channel for exfiltration of sensitive information.

Initial Access

We observed that the attacker utilized spear-phishing emails containing malicious attachments to gain initial access. The emails appeared legitimate and included personalized information aimed at the target. Within these emails, the embedded documents used macros to initiate Trojan.CustomMalware execution upon user interaction. The file path of the document was typically named in a manner that mimicked legitimate business correspondence, often located at C:\Users\[Username]\Documents\Important_Document.docm.

Execution & Persistence

Upon execution, the malware would drop additional payloads into the victim’s machine. Our investigation revealed that the actor employed various persistence techniques, specifically using HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure that Trojan.CustomMalware was executed each time the user logged in. We noted an entry created named LegitUpdate pointing to the malware executable located at C:\ProgramData\LegitUpdate.exe.

Command and Control

The C2 communications demonstrated a noteworthy sophistication. The malware beaconed out to an IP address that was rotating across various domains, making detection challenging. Our analysis identified that the domains employed DNS over HTTPS (DoH) to further obfuscate the traffic. This not only hid the C2 requests but also helped the actor bypass network filters. The communication protocol used encrypted payloads that employed a custom encryption scheme, making it difficult to analyze the contents without decryption.

Lateral Movement & Discovery

Following initial infection, the actor utilized credential dumping techniques, specifically leveraging T1003 – Credential Dumping, to acquire user credentials stored within the system. This enabled them to move laterally within the network. We found instances where the malware attempted to connect to other machines within the same subnet using T1021 – Remote Services, specifically by using PsExec to execute commands remotely, thus establishing a wider grip on the network resources.

Impact & Objectives

The ultimate objectives of the attack appeared to focus on data exfiltration. Our examination established that the malware attempted to harvest sensitive files and credentials, which it packaged and encrypted prior to exfiltration over the established C2 channels. The actor’s operational goal seemed to encompass the collection of proprietary or sensitive organizational data tied to a specific sector, potentially for future resale or manipulation in intelligence operations.

MITRE ATT&CK Mapping

  • T1566 – Phishing: The attacker initiated the attack through phishing emails with malicious attachments.
  • T1059 – Command and Scripting Interpreter: The malware executed PowerShell scripts to modify system configurations.
  • T1071 – Application Layer Protocol: Used for the C2 communication over HTTPS.
  • T1105 – Remote File Copy: Leveraged to move lateral through the network.
  • T1033 – Scheduled Task: Used for persistence across system reboots.

Detection Opportunities

  • Implement heuristics to identify unusual registry key behaviors, particularly in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
  • Monitor network traffic for encrypted DNS requests that may indicate covert C2 communications.
  • Employ endpoint detection and response (EDR) tools to flag execution of PsExec and similar lateral movement utilities.

Analyst Notes

The incident underscores the need for a consolidated approach to phishing defense strategies and endpoint protection. Not only should organizations implement advanced threat detection mechanisms, but also conduct regular training for employees on recognizing phishing attempts. The active use of behavioral analysis in endpoint solutions will provide an additional layer of security, allowing for faster identification of abnormal activities related to persistence and lateral movement within networks.

Source: Original Report

Related Posts