Sarah Chen — Malware Reverse Engineer
Key Takeaways
- This campaign employs a custom-built Remote Access Trojan (RAT) for persistent access.
- The actor utilized a multi-stage execution chain to obfuscate their payloads.
- Command and Control (C2) communications exhibited patterns indicative of a well-structured infrastructure to evade detection.
Executive Summary
During the recent investigation of a sophisticated phishing campaign targeting several mid-sized enterprises, we observed a meticulously crafted attack chain. The initial access was facilitated through a well-engineered phishing email, which contained a malicious Excel file. Within this file was an encoded script executing a custom Remote Access Trojan (RAT). Our analysis revealed that the RAT enabled the actor to establish persistent access to the victim’s environment while evading traditional detection mechanisms.
Initial Access
The attack commenced with a deceptive email sent to targets, masked as urgent financial correspondence. The attached file, named Invoice_2023.xlsx, was designed to entice recipients to enable macros. This tactic aligns with T1566 – Phishing, where the actor exploits social engineering to trick users into executing malicious content. When macros were enabled, a PowerShell command was executed that retrieved additional payloads from a remote location.
Execution & Persistence
Upon execution, the payload downloaded a fully-featured RAT, which we designated as DarkLink RAT. This malware is capable of extensive resource exploitation, including keystroke logging and screen capture. The RAT was stored at C:\Users\Public\Documents\DarkLink\, allowing it to blend into standard directories. The persistence mechanism involved the creation of a registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ with the value set to execute the RAT upon user login.
Command and Control
The C2 domain utilized by the actor was http://mysecurecontrol.com, which the RAT connected to at regular intervals to receive commands. During our analysis, we identified a pattern in the beaconing, occurring every 60 seconds. This structured timing not only facilitated command execution but also provided stability in maintaining the connection. The malware employed HTTPS, adding an additional layer of encryption to its communication, hindering detection and analysis efforts.
Lateral Movement & Discovery
Once inside the network, the actor utilized a combination of PowerShell scripts and WMIC commands to perform lateral movements. We discovered that the RAT was capable of credential dumping via T1003 – Credential Dumping. It targeted valuable user account details stored in local and cached locations. This was followed by attempts to access other systems within the domain using the stolen credentials, showcasing a typical lateral movement tactic employed by advanced persistent threats.
Impact & Objectives
The primary goal of the actor appeared to be data exfiltration and reconnaissance of network configurations. Sensitive data, including financial records and employee personal information, was targeted for extraction. Our team noted that traffic patterns suggested large volumes of data were sent over the C2 channel, raising red flags in network monitoring tools. This indicates that the actor sought to achieve strategic objectives, likely for financial gain or espionage purposes.
MITRE ATT&CK Mapping
- T1566 – Phishing: Utilizing deceptive emails to lure victims into executing malicious attachments.
- T1203 – Exploitation for Client Execution: Exploiting software vulnerabilities in the targeted applications.
- T1003 – Credential Dumping: Acquiring credentials to facilitate lateral movement within the network.
Detection Opportunities
- Employ advanced email filtering and threat intelligence feeds to identify and block phishing attempts.
- Monitor for unusual PowerShell execution patterns, particularly those involving remote downloads.
- Establish network detection rules for known C2 domains and unusual outbound traffic.
Analyst Notes
This investigation underscores the importance of adopting a layered approach to security, particularly in the face of sophisticated phishing tactics and custom malware development. Organizations should ensure comprehensive training for employees and robust email filtering solutions to thwart initial access methods. Constant monitoring of network traffic for anomalous behaviors, especially surrounding the use of PowerShell and unknown domains, can significantly bolster incident detection capabilities.
Source: Original Report