Deep Dives

Unmasking the Tekton Malware Attack: A Technical Examination of Infiltration and Data Exfiltration Tactics

by n8n admin

Sarah Chen — Malware Reverse Engineer

Key Takeaways

  • Tekton employs sophisticated social engineering tactics for initial access via malicious email attachments.
  • The malware implements persistence through registry modification and scheduled tasks.
  • Command and Control (C2) communications leverage encrypted channels for evasion and data exfiltration.

Executive Summary

During our investigation of the recent Tekton malware campaign, we observed a well-orchestrated attack chain that began with social engineering tactics. The actor utilized enticing email attachments to lure targets into executing the malware, which in turn compromised multiple endpoints within the network. Our analysis revealed details about how the malware establishes persistence, executes commands, and communicates with its command and control infrastructure.

Initial Access

The initial access vector we analyzed involved a phishing email with a malicious attachment disguised as an important document. Upon opening the attachment, the user inadvertently executed the dropper. Investigation of the dropper revealed a PowerShell script embedded in a Word document that utilized VBA macros to instantiate the payload. This aligns with the MITRE ATT&CK technique T1572 – Protocol Tunneling as it was designed to circumvent network defenses. The dropper’s file path on the infected machine was C:\Users\User\AppData\Local\Temp\temp.doc.

Execution & Persistence

Once executed, Tekton injected its payload into running processes to evade detection. The primary executable we examined, identified with a hash of f45a2baa5e2dd6bca1fd1b92832790b9, altered crucial registry keys to ensure persistence. Specifically, it modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run to include a reference to its launcher executable. Additionally, it created a scheduled task named ‘TektonUpdate’ to facilitate re-execution on system reboot, thereby maintaining its foothold.

Command and Control

Our analysis of the C2 communications revealed the malware employed a mix of encrypted and obfuscated traffic to communicate with its operators. The communication patterns pointed to multiple domains, many of which displayed content similar to legitimate services, making them harder to distinguish from benign traffic. The primary C2 server recorded was update.texservices.com. Traffic analysis highlighted that the malware utilizes HTTPS for C2 communication, confirming the implementation of T1071.001 – Application Layer Protocol: Web Protocols to blend in with regular web traffic.

Lateral Movement & Discovery

Following initial compromise, the actors behind Tekton leveraged Windows administrative tools for lateral movement. Our investigation identified the use of Mimikatz, a well-known credential harvesting tool used to extract credentials from memory. We noted the recursive invocation of net.exe to discover other systems in the environment. The commands executed included net view and psexec for transferring the malware to adjacent devices, a classic example of T1021.001 – Remote Services: SMB/Windows Admin Shares. This TTP allowed them to expand their reach within the organization effectively.

Impact & Objectives

Ultimately, the objective of the Tekton attack appeared to be the exfiltration of sensitive data. Our telemetry indicated that large volumes of data were being sent to the C2 infrastructure during the late hours of operation, pointing to an attempt to minimize detection. The exfiltration methods utilized reflected **T1041 – Exfiltration Over Command and Control Channel**, as data was compressed and encrypted before transmission. Additionally, the presence of demand for ransomware-like capabilities suggested a potential secondary goal to extort the victim organization.

MITRE ATT&CK Mapping

  • T1572 – Protocol Tunneling: The technique used by the malware to bypass detection by tunneling through legitimate protocol channels.
  • T1071.001 – Application Layer Protocol: Web Protocols: The use of web protocols to obfuscate command and control communications.
  • T1021.001 – Remote Services: SMB/Windows Admin Shares: Techniques employed for lateral movement across the network using Windows administrative tools.
  • T1041 – Exfiltration Over Command and Control Channel: Refers to steganographic methods used for data exfiltration through encrypted channels.

Detection Opportunities

  • Monitor for unusual email attachments, particularly those containing obfuscated or encoded PowerShell scripts.
  • Employ endpoint detection and response (EDR) tools to identify unexpected changes in HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry keys.
  • Analyze network traffic for connections to known malicious domains and inspect for abnormal outbound HTTPS communications.

Analyst Notes

As we continue to monitor the threat landscape, the Tekton malware exemplifies a blend of old tactics with effective obfuscation techniques. This case highlights the importance of user education on phishing emails and emphasizes the necessity for robust detection mechanisms on endpoint and network layers. Our ongoing analyses of emerging tactics and techniques will enable timely threat mitigation strategies that can safeguard organizations from such advances.

Source: Original Report

Related Posts