Sarah Chen — Malware Reverse Engineer
Key Takeaways
- A sophisticated phishing campaign utilizing a custom dropper was observed, enabling initial access through credential harvesting.
- The deployment of Cobalt Strike as the primary post-exploitation toolkit indicated a well-coordinated attack lifecycle.
- Lateral movement was conducted through the exploitation of Windows Admin Shares and use of valid credentials, highlighting the threat actor’s knowledge of their targets.
Executive Summary
During our analysis of a recent cyber intrusion, we observed a concerted effort by a threat actor leveraging a custom dropper to execute their malicious agenda. The attack commenced with a deceptive phishing email crafted to entice users into downloading a seemingly benign document. Once executed, this document delivered a dropper, which in turn facilitated the installation of a well-known penetration testing framework, Cobalt Strike. Our investigation mapped the entire attack lifecycle, revealing a range of MITRE techniques employed throughout the engagement.
Initial Access
The initial access vector was a targeted phishing email that contained a malicious link. Users clicking the link were redirected to a site that mimicked a legitimate service, where they were prompted to log in. Credentials entered were captured and sent to the attacker-controlled server. This initial access phase was cunningly orchestrated, utilizing legitimate-looking infrastructure to bypass common security filters. The harvested credentials were later used for lateral movement within the network.
Execution & Persistence
Following credential capture, the actor deployed a custom dropper file named document.exe. This executable was executed via user execution as it masqueraded as an important document. During our analysis, we observed that this dropper extracted an obfuscated script designed to download and run the Cobalt Strike payload. Persistence was established using registry modifications; specifically, the dropper created a registry key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure the payload executed on system login.
Command and Control
Post-exploitation, the Cobalt Strike implant initiated a synchronous connection to its Command and Control (C2) server utilizing HTTPS for communication. The domain used for the C2 appeared benign, further complicating traffic monitoring efforts. We analyzed the base64-encoded data being transmitted and identified indicators that pointed to additional payload fetching from the C2. This included instructions for lateral movement and exfiltration operations.
Lateral Movement & Discovery
With a foothold established, the actor employed the T1075 – Pass the Hash technique to propagate through the network. Utilizing harvested credentials, they accessed shared administrative resources. The tactics involved mapped out network shares and scanned for machines with RDP enabled. Furthermore, our analysis revealed the actor querying for active sessions using net session and net view commands, solidifying their understanding of the environment and enabling extensive lateral movement.
Impact & Objectives
Attention quickly turned towards data exfiltration as the actor aimed to extract sensitive information from targeted systems. The implanted Cobalt Strike was configured to deploy additional tools, such as Mimikatz, to further harvest credentials and sensitive information. The ultimate objective seemed to involve not just data theft, but also potential disruption of operations, as hints of ransomware-like behaviors began to emerge based on encrypted file signatures we discovered during the investigation.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access achieved through a phishing campaign.
- T1203 – Exploitation for Client Execution: Custom dropper executed via user actions.
- T1070 – Indicator Removal on Host: Techniques used to remove signs of compromise.
- T1021 – Remote Services: Utilizing Windows Admin Shares for lateral movement.
Detection Opportunities
- Monitor network traffic for unusual outbound HTTPS requests, particularly to known benign domains.
- Implement alerts for registry changes under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Analyze user activities for suspicious remote connection attempts or frequent access to administrative shares.
Analyst Notes
This campaign exemplifies the continued effectiveness of social engineering tactics coupled with robust exploitation techniques. Unlike many low-effort phishing attempts, the sophistication displayed here reflects a dedicated adversary leveraging multiple TTPs to achieve their objectives. Organizations are urged to enhance their phishing awareness training and reinforce endpoint detection mechanisms.
Source: Original Report