Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Deployment of the ‘RedEye’ infostealer observed via malicious email attachments, leveraging social engineering techniques.
- The implant exhibits strong persistence mechanisms and utilizes registry modifications for longevity.
- Communication with the Command and Control (C2) server is heavily obfuscated, indicating advanced evasion strategies employed by the threat actor.
Executive Summary
During our analysis of the ‘RedEye’ malware campaign, we discovered a sophisticated infostealer targeting corporate environments. This investigation focused on the initial access vector, the execution and persistence strategies employed, and the methods the malware utilizes for command and control. Our findings highlight not only the capabilities of the malware but also the TTPs of the actor behind it, providing a roadmap for detection and mitigation.
Initial Access
We observed that the initial access vector for ‘RedEye’ was primarily through spear-phishing emails, which contained malicious attachments. The emails were crafted to appear legitimate, enticing users to open them. Once the attachment was executed, the malware was able to leverage vulnerabilities in Microsoft Office documents to drop the payload onto the victim’s machine. This behavior aligns with the T1566 – Phishing technique from the MITRE ATT&CK framework.
Execution & Persistence
Upon execution, the sample we examined wrote itself to the user’s profile directory under %APPDATA%\Local\Temp\RedEye.exe, ensuring that it remained out of sight of casual scrutiny. The implant created a Windows service for persistence using the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RedEyeService, which automatically re-executes the payload upon system reboot. Our analysis revealed that this persistence method enables the operator to maintain access even after the initial infection vector has been removed.
Command and Control
Communication with the C2 server was conducted over HTTPS, greatly complicating detection efforts. The malware periodically beaconed to https://update.redsys.com::443, with the payloads being encrypted using a custom algorithm, indicating advanced obfuscation methods. The traffic patterns suggested a timed request every 30 minutes, which reflects a stealthy approach to maintain access, while avoiding potential network-based detections.
Lateral Movement & Discovery
By leveraging Windows Management Instrumentation (WMI) and PowerShell scripts, the malware demonstrated lateral movement capabilities across the network, aiming to gather sensitive information such as user credentials and network shares. Specifically, we documented the use of T1021.001 – Remote Services for Windows Remote Management (WinRM) to execute further commands on other machines within the environment. The actor employed enumeration tactics to locate additional targets within the network, which enabled them to amplify the scale of their campaign.
Impact & Objectives
The primary objective of the ‘RedEye’ malware appears to be data exfiltration. Our investigation detected attempts to gather credentials stored in browsers, email clients, and other sensitive applications, indicating that the actor’s end goal is likely to sell this information on the dark web or use it for further attacks. Furthermore, the presence of the infostealer could lead to significant operational disruptions for affected organizations, highlighting the critical need for rapid response capabilities.
MITRE ATT&CK Mapping
- T1566 – Phishing: The threat actor delivered the payload using social engineering techniques through malicious emails.
- T1060 – Registry Run Keys / Startup Folder: The malware modifies registry settings to ensure persistence.
- T1021.001 – Remote Services: The actor utilized WMI for lateral movement across the network.
Detection Opportunities
- Monitor for unusual file creations in
%APPDATA%that match known patterns for malicious executables. - Deploy detection rules for malicious email attachments based on known indicators of compromise (IOCs) related to ‘RedEye.’
- Implement network traffic analysis for abnormal beaconing patterns directed to suspicious domains.
Analyst Notes
The ‘RedEye’ campaign serves as a strong reminder of the evolving tactics employed by threat actors in the infostealer landscape. As our analysis underscores, proactive detection and incident response capabilities must be continually reinforced to combat these advanced threats. Continuous monitoring for potential indicators of compromise, alongside user training to recognize phishing attempts, will be pivotal in mitigating risks associated with such malware.
Source: Original Report