Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Credential dumping remains a prevalent method for obtaining sensitive information post-exploitation.
- Our analysis of the Mimikatz tool highlights its techniques for lateral movement and privilege escalation.
- Monitoring for suspicious access to sensitive data stores and usage of process injection techniques can help mitigate risks.
Executive Summary
During our investigation of several recent security incidents, we observed the consistent use of Mimikatz as a tool for credential dumping. The actor leveraged this sophisticated malware to facilitate lateral movement within compromised networks. Mimikatz’s capability to manipulate Windows authentication protocols proved invaluable for the threat actor, ultimately allowing them persistent access to critical internal systems. In this detailed analysis, we will trace the attack chain, examining the TTPs employed and their implications for organizations.
Initial Access
In the examined cases, initial access was gained primarily through phishing campaigns, which delivered malicious email attachments. These attachments typically contained VBA macros or executables disguised as legitimate documents. Once the target executed the attachment, a dropper was deployed, often utilizing a fake PDF or Word document to persuade the user. Following execution, the dropper established a connection to the actor’s command and control (C2) infrastructure, allowing for further instructions to be issued.
Execution & Persistence
After initial execution, the malware initiated a series of commands to deploy secondary payloads. Our analysis revealed that persistence mechanisms often involved creating scheduled tasks or modifying HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry keys, ensuring that the payload would execute on system startup. This approach highlights an actor’s focus on maintaining access and control over the compromised environment, often relying on Windows Management Instrumentation (WMI) for stealthy executions.
Command and Control
Throughout our investigation, we identified distinct patterns in the C2 communications. The malware beaconed to an IP address associated with known malicious domains using HTTPS for data exfiltration. This behavior aligns with T1071.001 – Application Layer Protocol: Web Protocols. We observed the usage of standard web traffic ports (e.g., port 443) to blend in with normal traffic, making detection more challenging. The C2 server responded to queries with encrypted payloads, which our analysts decrypted to unveil additional instructions for further exploitation.
Lateral Movement & Discovery
Utilization of Mimikatz during the lateral movement phase is notable. The actor employed techniques indicative of T1003.001 – Credential Dumping: LSASS Memory and T1075 – Pass the Hash. By injecting into the lsass.exe process, the malicious actor successfully extracted usernames and password hashes, facilitating access to additional systems. Additionally, we identified lateral movement activities via psexec and WMI, which allowed them to further proliferate their presence across the organization’s infrastructure.
Impact & Objectives
The ultimate objectives of these actors included data exfiltration, disruption of services, and potential furthering of their presence within the network for future attacks. By leveraging stolen credentials, the threat actor could gain administrative access to critical systems. In instances where their operation was not disrupted, they achieved full domain administrator privileges, which drastically increased their capability to manipulate and exfiltrate data.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: Communication over web protocols to establish C2.
- T1003.001 – Credential Dumping: LSASS Memory: Extracting credentials by accessing LSASS processes.
- T1075 – Pass the Hash: Using hashed credentials to authenticate without requiring clear-text passwords.
Detection Opportunities
- Implement monitoring for access to
lsass.exeto identify unauthorized credential dumping attempts. - Utilize endpoint detection and response (EDR) tools to alert on the creation of suspicious scheduled tasks related to persistence mechanisms.
- Conduct regular network traffic analysis to detect anomalous C2 communications, especially those resembling SSL traffic on port 443.
Analyst Notes
Our research underscores the importance of a holistic defensive posture that encompasses not only perimeter defenses but also robust endpoint monitoring and incident response capabilities. Organizations must stay vigilant against evolving tactics used by actors, including their preference for legitimate administrative tools such as Mimikatz. Adopting proactive threat hunting practices will enhance the ability to detect and mitigate ongoing attacks effectively.
Source: Original Report