Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The campaign leverages spear-phishing emails with malicious attachments to gain initial access.
- Advanced evasion tactics, including the use of macros and living-off-the-land techniques, facilitate execution and persistence.
- Lateral movement tactics focus on exploiting credential dumping to escalate privileges and access sensitive systems.
Executive Summary
Throughout our investigation of a recent threat actor campaign targeting financial institutions, we observed a sophisticated use of spear-phishing emails utilizing malicious documents as the primary vector for initial access. The actor implemented advanced tactics to ensure persistence within compromised environments and employed multiple techniques to achieve their objectives, including credential harvesting and lateral movement within the victim’s network. Our analysis revealed evidence suggesting that this operation is part of an ongoing effort to exploit vulnerabilities in financial systems to facilitate data exfiltration and potentially deploy ransomware.
Initial Access
The threat began with targeted spear-phishing emails sent to employees of financial institutions. These emails contained malicious attachments, often disguised as important financial documents. Upon opening these `.doc` files, users were prompted to enable macros, which initiated the execution of embedded scripts. The specific macro utilized performed several functions, including downloading remote payloads using PowerShell commands. Our investigation detected these actions, indicating that initial access was achieved via the execution of the macro and subsequent download of an executable dropper.
Execution & Persistence
The dropper exhibited behavior consistent with the strong use of obfuscation techniques to avoid detection by security systems. During our analysis, we discovered that the malicious payload was originally dropped to the path C:\ProgramData\mse64.exe. This executable is engineered to establish persistence through the creation of registry keys. Notably, the implant modified the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, adding a value pointing to the dropper executable. This behavior ensured that the payload would run on every system startup, effectively maintaining a foothold.
Command and Control
For command and control (C2), the actor employed a dynamic DNS server that provided a level of anonymity. The implant established outbound connections to domains such as malicious-domain[.]com, configured to receive additional commands and exfiltrate data. Our analysis revealed that the C2 communications were conducted over HTTPS, utilizing a custom protocol likely designed to minimize detection. The use of encryption presents a significant challenge for cybersecurity defenses, underscoring the need for monitoring both DNS query logs and SSL/TLS traffic for unusual patterns.
Lateral Movement & Discovery
Once footholds were established on initial targets, the actor pursued lateral movement strategies to further compromise the network. Leveraging credential dumping techniques via tools such as Mimikatz, the threat actor harvested credentials from the memory and local storage of compromised systems. This information allowed them to gain access to multiple systems without raising immediate alarms. The actor employed legitimate administrative tools for lateral movement, which fall under the Living Off the Land (LotL) tactic, to further obfuscate their actions and make detection more challenging.
Impact & Objectives
The primary objective of this campaign appeared to be financial gain through data exfiltration. Sensitive data from financial transactions and personal information of clients were identified as high-value targets. The actor’s capability to move laterally throughout systems exponentially increased their access to critical information, potentially leading to further fraud or the deployment of ransomware to extort money from the organizations. Our investigation also raised concerns about potential supply chain impacts, as third-party vendors linked to these financial institutions were also targeted.
MITRE ATT&CK Mapping
- T1566 – Phishing: Spear-phishing emails were leveraged to distribute malicious documents.
- T1086 – PowerShell: The payload utilized PowerShell for downloading additional components.
- T1071 – Application Layer Protocol: C2 communications were conducted over HTTPS.
- T1555 – Credentials from Password Stores: The actor used credential dumping techniques to escalate privileges.
- T1210 – Exploitation of Remote Services: The use of administrative tools for lateral movement reflects exploitation tactics.
Detection Opportunities
- Implement monitoring for unusual PowerShell command activity, particularly those that download executables.
- Regularly review and audit the execution of macros within document files across the network.
- Set up alerts for modifications to registry keys associated with startup programs, focusing on unusual files being registered.
Analyst Notes
This investigation highlights the ongoing need for robust user training regarding phishing attacks and the importance of securing email gateways against such threats. Additionally, organizations should enforce strict controls on the use of PowerShell and other scripting languages, along with the implementation of technologies to monitor and alert on anomalous behavior. Given the sophisticated nature of this attack, continuous threat hunting and rapid response capabilities are paramount in mitigating risk exposure.
Source: Original Report