Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Tactics employed included URL phishing and use of an initial dropper.
- The malware leveraged persistence mechanisms with registry modifications.
- Command-and-control communication utilized a combination of HTTPS and DNS tunneling.
Executive Summary
During our investigation of a recent phishing campaign targeting mid-sized organizations, we observed a sophisticated attack chain where an actor leveraged a series of malicious documents to gain initial access. The delivery mechanism was primarily spear-phishing emails that appeared legitimate, leading us to focus on specific indicators of compromise (IOCs) related to the email attachments. Our analysis revealed that these documents deployed a well-known Remote Access Tool (RAT), enabling the actor to maintain persistent access and exfiltrate sensitive data.
Initial Access
Initial access was achieved through targeted phishing emails containing malicious documents, specifically crafted in Microsoft Word format. These documents employed embedded macros, which prompted unsuspecting users to enable content, ultimately executing the malicious payload. Upon enabling macros, the dropper executed a PowerShell script that downloaded the secondary payload from a remote server. The primary macro used was:AutoOpen(), which triggered upon opening the document. This technique corresponds to the Phishing technique (T1566) documented in the MITRE ATT&CK framework.
Execution & Persistence
The dropper executed a binary that we identified as a version of Agent Tesla, a common RAT known for its keylogging and information stealing capabilities. Our analysis of the binary indicated that it utilized persistence mechanisms by modifying registry keys: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure it would execute upon user login. This utilized the Registry Run Keys / Startup Folder technique (T1547.001), solidifying the actor’s foothold within the environment.
Command and Control
The command-and-control (C2) infrastructure revealed a well-established pattern utilizing both HTTPS and DNS tunneling methods. The malware beaconed out every five minutes, connecting to a dynamic DNS service that the actor frequently updated to evade detection. The C2 communications included several standard HTTP GET and POST requests, which we captured detailing the exfiltration of sensitive credentials to specified endpoints. This aligns with the evident use of Application Layer Protocol (T1071) in MITRE’s classification.
Lateral Movement & Discovery
Once the actor established a presence within the affected system, lateral movement was achieved through the use of valid accounts and the exploitation of network shares. Our investigation revealed that the malware attempted to leverage Windows Admin Shares (T1077) to access other systems based on the credentials it had harvested. The actor also employed Mimikatz for credential dumping to facilitate lateral movement across the network with elevated privileges.
Impact & Objectives
The ultimate goal of this campaign appeared to be the exfiltration of sensitive business data, specifically drawing upon personal information and financial records. This targeted information indicated that the actor was preparing for a potential future ransomware deployment, reflecting a sophisticated approach to preemptively gather intelligence on their chosen victims. The impact of this could be severe, leading not only to financial losses but also reputational damage for those affected.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access via phishing emails containing malicious documents.
- T1547.001 – Registry Run Keys / Startup Folder: Persistence achieved through registry modification.
- T1071 – Application Layer Protocol: C2 communication via HTTPS and dynamic DNS.
- T1077 – Windows Admin Shares: Lateral movement through exploitation of shared resources.
Detection Opportunities
- Monitor and analyze outbound traffic to unusual DNS or HTTPS endpoints.
- Implement alerts for modifications to registry keys related to startup processes.
- Employ heuristic analysis on documents received via email, especially those with macros.
Analyst Notes
This case highlights the necessity for organizations to provide user training on phishing awareness and the risks associated with enabling macros in documents from unknown sources. Furthermore, robust endpoint detection and response (EDR) solutions should be in place to monitor for these kinds of malware behaviors, including C2 traffic and persistence mechanisms. As actors continue to refine their techniques, remaining vigilant and adaptable is key in thwarting potential breaches.
Source: Original Report