Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Rhysida ransomware exploits vulnerabilities in remote desktop protocols for initial access.
- The malware demonstrates advanced evasion techniques, including process hollowing and task scheduling for persistence.
- Command and control communications utilize various domain generation algorithms, complicating detection efforts.
Executive Summary
During our investigation of a recent attack attributed to the Rhysida ransomware group, we observed a sophisticated approach to compromise victim networks. This particular assault began with targeted spear-phishing emails that led to initial access through compromised remote desktop services. Once inside the network, the actor employed a series of techniques to expand their foothold, exfiltrate sensitive data, and deploy the ransomware payload effectively. This analysis delves into the attack lifecycle, highlighting the tactics, techniques, and procedures (TTPs) used for both intrusion and eventual impact on the victim organization’s operations.
Initial Access
Our analysis revealed that the Rhysida malware group primarily uses spear-phishing as a means of gaining initial access. The attack we investigated began with an email containing an embedded malicious link that, when clicked, led to the download of a dropper identified as rhysida.exe from a malicious web server. The dropper executed a PowerShell command that ultimately downloaded and installed the final payload, which we identified as the Rhysida ransomware. Moreover, we noted the exploitation of a RDP vulnerability that enabled the actors to bypass traditional authentication methods, allowing unauthorized access into the target’s internal network.
Execution & Persistence
Once the dropper successfully established a foothold, it executed the ransomware payload while also creating a persistent backdoor. The persistence mechanism involved modifying the Windows Task Scheduler to execute the rhysida.exe every time the system started. This was achieved by creating a new task with the command: schtasks /create /tn
Source: Original Report