Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The Remark malware uses social engineering tactics to gain initial access, primarily utilizing phishing emails.
- Once executed, the malware establishes a robust command and control channel leveraging HTTP requests.
- Lateral movement is facilitated through exploiting known vulnerabilities, particularly within the SMB protocol.
Executive Summary
During our investigation into the recent Remark malware campaign, we observed the comprehensive attack methods employed by the threat actor. The malware primarily leverages social engineering and advanced persistence techniques to maintain a foothold in the targeted environment. The actor’s tactics align with various elements from the MITRE ATT&CK framework, demonstrating their skilled approach to executing multi-stage attacks focused on data exfiltration and network compromise.
Initial Access
In our analysis, we identified that the initial access vector for the Remark malware often involves an email campaign targeting hundreds of potential victims. The emails typically contain a Microsoft Word document attachment that, when opened, prompts the user to enable macros. This blatant social engineering tactic is designed to lure the user into executing malicious code. The actor employs the use of well-crafted themes in their emails that are pertinent to current events, enhancing the likelihood of user engagement. The macro within the document executes a PowerShell command that downloads the malware from a remote server.
Execution & Persistence
Once the malware is downloaded, our analysis revealed that it typically utilizes a dropper mechanism wherein it extracts and executes a secondary payload from a temporary directory, often located at C:\Users\%USERNAME%\AppData\Local\Temp\. This payload is designed for persistence; it modifies registry keys to ensure that the malware is executed during system boot. Specifically, our examination showed alterations made to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This type of persistence allows Remark to re-establish its presence even after system reboots or user interventions.
Command and Control
The sample we examined established an outbound connection to a command and control (C2) server via HTTP using the GET method. We noted that the C2 server employs a dynamic DNS service, which aids in obfuscation efforts by regularly changing IP addresses. The malware sends periodic beacons to the C2, indicating its operational status. Notably, our analysis of traffic logs indicated that the beacons included system information such as operating environment, user data, and other reconnaissance information, providing the attacker with insights necessary for subsequent actions within the network.
Lateral Movement & Discovery
As we dug deeper into the malware’s capabilities, we identified its use of various techniques for lateral movement, particularly focusing on network shares and the exploitation of the SMB protocol. Our investigation revealed attempts to authenticate to other systems using compromised credentials, highlighting the actor’s effort to expand their access. Additionally, the malware executed commands designed to enumerate local and network users, shared folders, and group policies, allowing the attacker to gather valuable information about the network topology.
Impact & Objectives
The ultimate objective of the Remark malware appears to center around data exfiltration and network disruption. Indicators of compromise (IOCs) included large amounts of data being compressed and prepared for transfer to external servers. The threat actor’s actions suggested a potential intent to stage data for ransom demands, given their methodical collection of sensitive information from compromised hosts. Throughout our investigation, we observed various payloads indicative of such activities, including database dumps and financial records.
MITRE ATT&CK Mapping
- T1566 – Phishing: The use of socially engineered emails to deliver malware payloads.
- T1203 – Exploitation for Client Execution: Exploiting vulnerabilities in document readers to execute malicious code.
- T1071 – Application Layer Protocol: Leveraging HTTP for command and control communications.
- T1021 – Remote Services: Using SMB for lateral movement.
Detection Opportunities
- Monitor for unusual PowerShell execution processes that download executables from untrusted sources.
- Implement alerts for modifications to the
HKCU\Software\Microsoft\Windows\CurrentVersion\Runregistry key. - Analyze network traffic for irregular HTTP requests, especially those leading to known dynamic DNS services.
Analyst Notes
As the Remark malware campaign continues to evolve, it is imperative for organizations to bolster their defenses against social engineering tactics and enhance incident response capabilities. A comprehensive security awareness program catered to end-users, along with proactive monitoring of network behavior, can greatly mitigate the risks associated with such threats. Continuous revision of security policies and timely updates to detection signatures will further fortify the organization’s posture against these persistent threats.
Source: Original Report