Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Recent phishing campaigns utilize sophisticated techniques to deliver banking trojans.
- Initial access is often gained via credential theft and follows with lateral movement across networks.
- Detection strategies must adapt to evolving TTPs employed by actors disseminating these threats.
Executive Summary
During our investigation into a recent wave of phishing attacks targeting financial institutions, we observed that the initial access vector was primarily through deceptive emails designed to harvest user credentials. The actor deployed a combination of known banking trojans, specifically focusing on sophisticated malware such as Emotet and TrickBot. Our analysis revealed that the incorporation of these tools facilitated access to sensitive financial information, while enabling commands that allowed them to maneuver through corporate networks. This report outlines the stages of the attack chain, revealing significant insights into the tactics—techniques and procedures (TTPs) employed.
Initial Access
Initial access was achieved through a phishing campaign that leveraged social engineering to entice users into clicking on malicious links. The emails often displayed urgency, claiming account issues that necessitated immediate action. We identified examples of URLs like http://example.com/loginupdate that redirected victims to counterfeit login pages mimicking the appearance of legitimate banking websites. Many victims unwittingly provided their credentials, effectively handing over access to the attackers.
Execution & Persistence
Upon acquiring valid user credentials, the operators deployed a dropper that facilitated the download of the primary payload, identified as Dridex. The sample we examined showed persistence mechanisms involving registry modifications within HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, ensuring continued execution upon user logon. Additionally, we noted the use of PowerShell scripts to streamline the deployment of the software and create further persistence, utilizing commands such as Invoke-WebRequest for downloading the malicious payload from a C2 server.
Command and Control
Our investigation traced the command and control (C2) infrastructure utilized by the threat actor. The C2 servers predominantly communicated using HTTP and HTTPS protocols, obfuscating traffic to evade detection. We recorded domain names such as malicioussite123.com and noted patterns in DNS queries that aligned with the persistence mechanism, indicating that the actors used a specific set of domains for maintaining their communications. The payload also featured beacons that exfiltrated data at regular intervals, each request containing stolen credentials and session cookies, demonstrating the actor’s focus on maximizing their haul from the intrusion.
Lateral Movement & Discovery
With initial access secured, the actor employed techniques to extend their foothold within the network and gather intelligence. Using Windows Admin Shares, they executed commands remotely via SMB, facilitating lateral movement across systems. Specifically, we observed attempts to access administrative shares such as \TARGETMACHINE\C$, allowing them to deploy further payloads or extract sensitive data. The actors orchestrated automated reconnaissance commands, leveraging tools like PowerView to map the network and identify additional valuable systems.
Impact & Objectives
The ultimate objective of this campaign was to siphon funds and gather sensitive data from compromised entities. We noted that the targeted organizations experienced significant financial losses due to the rapid exfiltration of bank account details and unauthorized transactions, following unauthorized access to online banking sessions. The fallout also included reputational damage as news of the breaches surfaced, highlighting vulnerabilities in security postures.
MITRE ATT&CK Mapping
- T1566 – Phishing: Use of socially engineered emails to capture credentials.
- T1071.001 – Application Layer Protocol: Web Protocols: Utilized for C2 communication through HTTP/HTTPS.
- T1021.001 – Remote Services: SMB/Windows Admin Shares: Used for lateral movement across the network.
Detection Opportunities
- Monitor email headers and URLs for known phishing indicators.
- Implement logging and alerting for suspicious registry modifications related to autorun entries.
- Establish network-based detections for unusual DNS queries to known malicious domains.
Analyst Notes
This case reinforces the importance of comprehensive user training and robust email filtering solutions to combat phishing attacks. Beyond that, organizations should prioritize monitoring their networks for anomalous behavior that is indicative of lateral movement and C2 communications, helping in early detection and prevention of future incursions. Continuous threat hunting and incident response readiness are key to mitigating potential impacts from such sophisticated attacks.
Source: Original Report