Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Malware utilizes malicious email attachments for initial access, leveraging social engineering techniques.
- Persistence is achieved through Windows Task Scheduler in conjunction with registry modifications.
- Command and Control (C2) communications rely on encrypted HTTP requests, coordinating lateral movement across the network.
Executive Summary
During our investigation of a recent malware campaign, we observed a sophisticated threat actor employing a range of techniques to gain foothold within a targeted environment. The malware, identified as a variant of the AgentTesla trojan, demonstrated advanced capabilities for data exfiltration and lateral movement. This post details the attack lifecycle, focusing on the methods used to circumvent defenses and achieve the actor’s objectives.
Initial Access
The attack commenced with spear-phishing emails that included variations of malicious attachments. Our analysis revealed these files to be crafted as Microsoft Office documents, specifically targeting users with enticing language that encouraged opening the files. Upon execution, the documents triggered macro-enabled scripts designed to download the payload. The sample we examined utilized cmd.exe to execute a PowerShell command that retrieved and executed the trojan from a remote server.
Execution & Persistence
Once installed, the malware established persistence primarily through the Windows Task Scheduler. The actor configured a task to execute the payload every time the system restarted. In parallel, we detected registry modifications under HKCU\Software\Microsoft\Windows\CurrentVersion\Run to ensure the malware would execute with the user’s login session. Notably, the malware also established a hidden directory under C:\ProgramData\hidden\, where it stored auxiliary scripts and configuration files.
Command and Control
The malware employed a robust C2 infrastructure to communicate stealthily with the actor’s server. Using encrypted HTTP requests, it blended in with legitimate traffic, making detection difficult. We observed a set of unique User-Agent strings, with randomized characteristics, which helped mimic regular web browser behavior. Examining the network traffic, we identified several suspicious domains registered under various TLDs, indicating high operational security on part of the attacker.
Lateral Movement & Discovery
Our investigation unearthed evidence of lateral movement tactics being employed by the malware post-exploitation. The actor utilized Windows Management Instrumentation (WMI) to probe for additional hosts on the network. Among the executed commands, we noted wmic /node:
Source: Original Report