Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Malicious payloads were delivered via an advanced phishing campaign utilizing an EvilDoc template.
- The actor demonstrated use of sophisticated command and control (C2) infrastructure to maintain persistence.
- Detection strategies must evolve to identify anomalous Microsoft Office interactions and outbound network connections to known malicious domains.
Executive Summary
This investigation analyzes a recent phishing campaign that leveraged the EvilDoc malware for data exfiltration. Our analysis revealed that attackers crafted a convincing email containing a malicious link to a fake document hosted on a compromised domain. The payload, once executed, established a robust C2 channel, enabling lateral movement within the network and eventually leading to data theft. As we dissect the attack methods and tooling, we will highlight key indicators of compromise (IOCs) and provide insight into mitigation strategies.
Initial Access
During the investigation, we observed that the initial access was achieved through a phishing email designed to replicate a legitimate business communication. The email contained a link directing the target to a malicious URL where the EvilDoc dropper was hosted. Once users clicked on the link, they were prompted to enable macros, a common lure that facilitated the loading of the malicious document. The payload was delivered as a .docm file and, upon execution, initiated a connection to the actor-controlled C2 server.
Execution & Persistence
The EvilDoc template executed PowerShell commands to download additional payloads. Our analysis revealed that the malware used PowerShell to execute scripts that not only established persistence but also enabled exfiltration of sensitive data. The persistence mechanism involved creating a registry entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\Current\Run which triggered the execution of malicious scripts on system start. Additionally, the implant employed various obfuscation techniques to evade detection by security solutions.
Command and Control
The command and control strategy employed by the actor was intricate and multi-layered. We identified that the malware beaconed to a dynamic DNS service shared across multiple attack campaigns. This provided the attacker with a level of anonymity and resilience against takedown efforts. The C2 server was responsible for delivering additional payloads and instructions, including data exfiltration commands. The communication persisted over HTTPS, further complicating detection efforts.
Lateral Movement & Discovery
Following successful execution and persistence, the implant enabled the actor to conduct lateral movement within the network. Utilizing Credential Dumping techniques as highlighted in MITRE ATT&CK framework, the malware harvested sensitive credentials stored in memory and other accessible locations. The adversary laterally moved using Windows Admin Shares (T1077), allowing access to additional machines while expanding their foothold within the environment. Our research highlighted various net use commands used to map network drives, demonstrating the actor’s exploration of network resources.
Impact & Objectives
The ultimate objective of this campaign appeared to be data exfiltration. The actor focused on stealing sensitive documents and credentials that could be monetized or used in further attacks. Our analysis of data logs revealed numerous attempts to exfiltrate data to a secondary C2 endpoint. This indicates a planned operation to not only harvest initial data but to establish a long-term presence within the victim’s network, potentially for future ransomware or extortion campaigns.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access achieved through crafted emails containing malicious links.
- T1059.001 – PowerShell: Utilization of PowerShell for executing malicious payloads and establishing persistence.
- T1071.001 – Application Layer Protocol: Web Protocols: C2 communications over HTTPS to evade detection.
- T1071.002 – Application Layer Protocol: Other: Dynamic DNS for C2 to increase evasion.
- T1086 – PowerShell: Employment of PowerShell scripts for lateral movement and data collection.
Detection Opportunities
- Monitor for anomalous PowerShell executions, particularly those that download and execute scripts from external URLs.
- Implement email filtering rules to detect and block phishing attempts containing malicious URLs.
- Analyze outbound traffic for connections to known malicious domains, particularly those associated with dynamic DNS services.
Analyst Notes
Given the evolving tactics employed by the threat actor, it’s crucial for organizations to remain vigilant. Continuous monitoring, along with user education aimed at recognizing phishing attempts, can mitigate risks significantly. Implementing advanced threat detection solutions focused on behavioral anomalies within network traffic and user actions will provide added layers of defense against such sophisticated attacks.
Source: Original Report