Mike Torres — Incident Response Specialist
Key Takeaways
- The attack utilized Agent Tesla, a well-known and prolific keylogger and credential-stealer.
- Initial access was achieved through targeted phishing emails with malicious attachments.
- Lateral movement was conducted using valid accounts, indicating prior reconnaissance and target selection.
Executive Summary
During our investigation into a recent wave of phishing attacks, we observed that threat actors employed Agent Tesla to compromise endpoints and harvest credentials from unsuspecting users. This report delves into the complete attack lifecycle, from initial access via phishing to lateral movement and data exfiltration activities that followed. Our analysis revealed specific tactics, techniques, and procedures (TTPs) employed by the attackers, including the deployment of sophisticated social engineering methods to increase the likelihood of user interaction with the malicios payloads.
Initial Access
Initial access was obtained through a well-crafted email designed to entice users into downloading malicious attachments. In one instance, the email claimed to contain an invoice, which led to a file named Invoice_2023.zip. When extracted, this ZIP archive included an executable file Invoice.exe that, when executed, silently installed the Agent Tesla malware.
The phishing emails were sent from previously compromised accounts, suggesting that the threat actors spent time conducting reconnaissance to identify potential targets within a larger organization. The social engineering was tailored to be relevant to the sector of the victims, which significantly increased the chance of success.
Execution & Persistence
Upon execution, the Agent Tesla implant proceeded to establish persistence on the victim’s machine. Our analysis revealed that the malware created a registry key to ensure its execution at startup. Specifically, we noted the following registry path was employed: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Invoice. This persistence mechanism ensured that the malware would reactivate even after the system was rebooted.
Additionally, Agent Tesla leveraged a variety of obfuscation methods to evade detection, including packing techniques and encrypted payload loading, which allowed the malware to remain dormant until activated by user actions such as keystrokes or COVID-19-related searches.
Command and Control
The Agent Tesla variant we analyzed communicated with its command and control (C2) infrastructure over HTTP and HTTPS, employing a variety of domain names, such as example-c2-domain[.]com, which resolved to IP addresses previously identified in other threat intelligence reports regarding Agent Tesla. During the investigation, we observed consistent beaconing intervals of approximately every 60 seconds. The communications involved sending keystroke logs and screenshots back to the C2 server, revealing the extent of data exfiltration the adversaries sought to achieve.
To further obscure their activities, the threat actors used domain generation algorithms (DGAs), which resulted in a ever-changing set of C2 addresses that made it difficult for defenders to maintain reliable block lists for detection.
Lateral Movement & Discovery
Following successful data harvesting, the compromised accounts were leveraged for lateral movement within the network. The actor used common administrative tools, such as Powershell and PsExec, to traverse the environment and gain higher privileges. Notably, we discovered the execution of commands resembling Invoke-Expression and Invoke-Command, which were run in the context of other user profiles.
Additionally, the actor conducted reconnaissance by enumerating local users and shared resources across the network using commands like net user and net view. This lateral movement indicated that the threat actors were not just seeking immediate financial gain but were interested in a more extensive supply of sensitive data.
Impact & Objectives
The ultimate objective of this operation centered on the theft of credentials and sensitive data, enabling the threat actors to facilitate further attacks, potentially including ransomware deployment or business email compromise. The data exfiltrated included usernames, passwords, and personally identifiable information (PII), all of which can be monetized or utilized for follow-up attacks against other entities in the victim’s supply chain.
Moreover, the potential for reputational damage and significant financial loss for affected organizations cannot be overstated, especially as data protection regulations impose heavy fines for data breaches.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial access vector using phishing emails with attachments.
- T1059.001 – PowerShell: Command and Scripting Interpreter: Windows PowerShell: Utilized for executing commands for lateral movement.
- T1105 – Remote File Copy: Facilitated transfer of the malware to other systems within the network environment.
- T1071.001 – Application Layer Protocol: Web Protocols: The communication with C2 over HTTP/HTTPS.
Detection Opportunities
- Implement advanced email filtering solutions that can detect malicious attachments and phishing attempts.
- Monitor for suspicious registry modifications, especially in common autorun locations.
- Deploy endpoint detection and response (EDR) tools to identify anomalies in process execution, particularly those involving Powershell and PsExec.
Analyst Notes
The resurgence of Agent Tesla as a preferred malware tool in recent phishing campaigns serves as a reminder of the persistent and adaptive nature of threat actors. We recommend organizations conduct regular training for their employees to recognize phishing attempts, along with continuous monitoring for unusual network behavior. By bolstering defenses and refining detection capabilities, security teams can enhance their resilience against these evolving threats.
Source: Original Report