Deep Dives

In-Depth Analysis of a Sophisticated Phishing Campaign Utilizing Malware for Credential Harvesting

by n8n admin

Sarah Chen — Malware Reverse Engineer

Key Takeaways

  • The attack chain commenced with a targeted phishing email leveraging a malicious Word document.
  • A combination of Office macro abuse and Credential Dumping techniques was observed during execution.
  • The actor utilized a custom-built C2 infrastructure for long-term persistence and lateral movement tactics.

Executive Summary

During our investigation, we analyzed a phishing attack that employed a maldoc as the initial infection vector. The malicious Word document contained an embedded macro that, once enabled, triggered the execution of a PowerShell script. This script downloaded additional payloads—specifically, an infostealer designed to capture credentials and other sensitive data. Our analysis revealed that this campaign was well-structured, utilizing various MITRE ATT&CK techniques to evade detection while maintaining access to the targeted environment.

Initial Access

The attack’s genesis lay in a phishing email that cleverly masqueraded as an important communication from a trusted business partner. The message contained a link to what appeared to be a genuine Word document. Upon opening the attachment, the user was prompted to enable macros to view the content. It’s crucial to note that the actors employed social engineering techniques to encourage macro activation, which is a well-known tactic associated with the use of malicious Office documents. Observing this, we identified the document’s execution path as C:\Users\\Downloads\malicious_document.docm, revealing the common vector for initial access through user naivety.

Execution & Persistence

Once the macro was enabled, it executed a PowerShell command that downloaded and executed a PowerShell script hosted on a remote server controlled by the actors. The script was crafted to deploy a binary payload, specifically an infostealing malware dubbed StealerX. This malware was designed to capture user credentials from web browsers and send them back to the actors via HTTP POST requests. Our investigation found the script operating from the temporary folder path C:\Users\\AppData\Local\Temp\random.exe, indicative of a common strategy to avoid detection by antivirus solutions. Additionally, the malware was configured to create registry keys for persistence, specifically modifying HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure the payload executed on system startup.

Command and Control

The command and control (C2) communication exhibited several key indicators. All communication was conducted over HTTPS, which is characteristic of modern malware aiming to mask its network traffic. The C2 server utilized dynamic DNS services to obscure its true hosting locations, making attribution challenging. Our analysis revealed periodic beacons to the C2 server at example-dynamicdns.com, indicating that the malware frequently communicated with the server for command execution and data exfiltration. The successful implementation of these techniques facilitated the actor’s continuous access to the infected environment.

Lateral Movement & Discovery

During the investigation, we discovered that the actors leveraged Credential Dumping techniques to harvest credentials from memory and various applications installed on the infected system. The infostealer was equipped to scrape login credentials from browsers such as Chrome and Firefox, along with stored credentials in the Windows Credential Manager. This access allowed the actor to establish lateral movement within the network by leveraging stolen credentials to access shared resources. We observed this behavior aligning with technique T1075 – Pass the Hash, where attackers executed commands on other machines using the compromised credentials.

Impact & Objectives

Overall, the primary objective of this campaign was to harvest credentials and sensitive information from the network. The gathered data could potentially facilitate unauthorized access to critical systems or accounts, leading to greater financial or operational impacts on the victims. Furthermore, our analysis indicated that targets involved are part of a supply chain in the IT sector, suggesting that the actor’s end goal could involve gaining access to larger organizations indirectly. The consequences of credential theft highlight profound risks, including identity theft or unauthorized transactions.

MITRE ATT&CK Mapping

  • T1566 – Phishing: The campaign commenced with a highly targeted phishing email.
  • T1059.001 – PowerShell: Used for executing remote scripts.
  • T1003 – Credential Dumping: Facilitated extraction of saved credentials.
  • T1075 – Pass the Hash: Allowed lateral movement across the network.

Detection Opportunities

  • Monitor network traffic for unusual HTTPS communications towards dynamic DNS services.
  • Implement alerts for changes to registry keys associated with startup programs.
  • Utilize endpoint detection and response solutions to identify and block execution of known malicious PowerShell scripts.

Analyst Notes

This investigation has revealed the critical importance of user education regarding phishing threats, particularly around enabling macros in documents. Organizations should reinforce policies prohibiting macro execution from untrusted sources. Moreover, continuous monitoring for anomalous behavior within networks can significantly reduce the window of opportunity for actors to exploit stolen credentials into larger intrusions. Proactive measures, such as multi-factor authentication, should also be priority defenses for safeguarding against impacts from credential theft.

Source: Original Report

Related Posts