Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The campaign extensively uses embedded macros in malicious Office documents as the initial access vector.
- We identified callbacks to a custom C2 server, revealing the adversary’s infrastructure and operational patterns.
- Lateral movement was performed using Windows Management Instrumentation (WMIC), exploiting administrative privileges acquired during the initial compromise.
Executive Summary
During our investigation into a recent phishing campaign targeting financial institutions, we observed a sophisticated use of social engineering techniques coupled with malicious Microsoft Office documents. These documents, when opened, executed embedded macros that initiated a chain of events leading to unauthorized access and system manipulation.
The identified malware features a multi-stage payload that extracts sensitive information and facilitates lateral movement across the network. Our analysis reveals not only the mechanisms of infection but also the subsequent steps taken by the attackers to maintain persistence and exfiltrate data.
Initial Access
The initial access vector in this campaign was an enticing email sent to potential victims, containing a hyperlink leading to a seemingly legitimate document hosted on a cloud storage service. Upon clicking the link, the victims were prompted to download a file named Invoice_2023.docm. This document contained malicious macros, which, when enabled, executed a PowerShell command that downloaded an additional payload from the actor’s Control-and-Command (C2) server.
This technique aligns with the Phishing (T1566) technique from MITRE ATT&CK, showcasing how attackers exploit human behavior to achieve their objectives. During our review, it became evident that the email also employed misleading language, evoking a sense of urgency to manipulate potential victims into enabling macros without hesitation.
Execution & Persistence
Once the embedded macros were executed, they initiated the download of a secondary payload—identified as Emotet. This malware is notorious for its ability to deploy additional ransomware or credential stealers once it has established a foothold within a network.
Our analysis revealed that the sample created a scheduled task within the Windows Task Scheduler to achieve persistence. The task executed a PowerShell script from the path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\setup.bat, ensuring that the implant remained active across reboots. We also noted alterations to the registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, adding entries that further reinforced the malware’s persistence strategies.
Command and Control
Communication with the C2 server was identified via DNS queries that pointed to maliciousdomain[dot]com. Our investigation revealed that the server utilized a domain generation algorithm (DGA), making it challenging to take down by changing the address frequently. The malware would send base64 encoded data packets every few minutes, allowing the actor to maintain real-time control over the infected host.
We summarized the network indicators associated with this C2 traffic, helping identify similar patterns in other incidents. The adversary’s use of robust encryption and obfuscation techniques meant that detection was complicating, requiring deeper packet inspection techniques to analyze payloads effectively.
Lateral Movement & Discovery
The malware displayed a sophisticated lateral movement strategy. Using WMIC commands, the payload sought administrative shares across the network and utilized credentials harvested through previous infection stages to infiltrate additional connected systems.
Instances of command execution such as wmic /node:
Source: Original Report