Sarah Chen — Malware Reverse Engineer
Key Takeaways
- XYZ malware demonstrates advanced evasion tactics through the use of steganography.
- The actor utilized Microsoft Outlook as an initial access vector to deploy the payload.
- Persistence was achieved via the creation of a service disguised as a legitimate application.
Executive Summary
During recent investigations, we encountered a sophisticated malware variant, which we termed ‘XYZ,’ associated with a threat actor known for targeting corporate networks. This actor leverages social engineering techniques coupled with technical ingenuity to maintain persistence and execute lateral movement across the network. This report details our analysis of this campaign, revealing various facets of the attack chain from initial access to eventual impact.
Initial Access
The attack began with an email campaign where phishing emails were sent, primarily targeting employees in accounting departments. The emails contained a malicious attachment named Invoice_12345.pdf.exe, camouflaged to appear as a legitimate PDF document. Upon opening the attachment, a payload was executed that instantiated a PowerShell script to download the malware from a remote server. We observed that the actor utilized the Phishing technique (T1566) to gain initial access.
Execution & Persistence
Our analysis revealed that the initial payload executed via a scheduled task, creating a recurring task in the C:\Windows\System32\Tasks\ directory. The scheduled task made a call to a PowerShell script that harvested sensitive data and beaconed back to the command and control (C2) server. Additionally, the malware created a Windows service under the name genuineservice located in C:\Program Files\GenuineService\, ensuring that it would start on system boot, a clear indication of the Service Registry Modification technique (T1543). This persistence mechanism was crucial for maintaining access even after initial reboots.
Command and Control
The implant initiated communication with the C2 server using a Domain Generation Algorithm (DGA), which allowed the actor to frequently change their server’s domain, evading detection efforts. During our investigation, we noted the actor’s C2 infrastructure relied heavily on HTTPS, thereby leveraging encryption to obfuscate the true nature of the traffic, aligning with the Encrypted Channel technique (T1041). Our network traffic analysis indicated that the malware established connection at regular intervals, indicating a persistent beaconing behavior. The C2 server hosted a variety of commands that the malware could execute, such as data exfiltration commands as well as lateral movement commands targeting SMB shares.
Lateral Movement & Discovery
During the lateral movement phase, the actor exploited known vulnerabilities in Microsoft Exchange to spread across the network. We detected the use of tactics associated with Remote File Copy (T1105) and Windows Admin Shares (T1077). The malware used stolen credentials via Mimikatz to access administrative shares on other machines, escalating privileges and allowing deeper penetration into the network. The actor exhibited noteworthy operational security by employing a decoy command in their scripts, which obfuscated their real operations from network monitoring solutions.
Impact & Objectives
The primary objective of the actor appears to be data theft, aiming to exfiltrate sensitive documents and financial information. In our findings, we traced the exfiltration path to a series of cloud storage accounts controlled by the actor, utilizing both scheduled FTP uploads and direct API calls to obscure the transfer of data. The actor’s staged approach indicates a clear strategy focusing on maximizing the latency between initial access and extraction steps to reduce detection by security teams.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial drive to gain access was achieved through targeting key personnel with a crafted phishing email.
- T1543 – Create or Modify System Process: The malware modified system tasks to ensure consistency in its execution post-reboot.
- T1041 – Exfiltration Over Command and Control Channel: Data was sent back to the actor’s remote server via encrypted channels.
Detection Opportunities
- Monitor for unusual scheduled tasks being created in
C:\Windows\System32\Tasks\. - Implement checks for anomalous service names that do not align with known software deployments.
- Analyze outbound network traffic for signs of DGA patterns and encrypted connections to unknown domains.
Analyst Notes
Given the evolving nature of the XYZ malware, it is essential for security teams to employ a multi-layered detection approach, combining User Behavior Analytics (UBA) with traditional endpoint security. Continuous monitoring of anomalous lateral movement behavior can yield early warnings of potential compromise. Furthermore, consistent threat intelligence sharing can aid in correlating indicators of compromise across sectors, enhancing collective defense strategies against this actor.
Source: Original Report