Priya Nair — Digital Forensics Analyst
Key Takeaways
- Custom malware with unique command and control channels enhances persistence and stealth.
- Phishing emails were crafted to exploit employee trust, leading to the initial compromise.
- The actor utilized lateral movement techniques to escalate privileges and access sensitive data.
Executive Summary
During our investigation, we uncovered a sophisticated phishing campaign that deployed a custom malware variant designed for data exfiltration. The actor’s initial access vector involved well-crafted spear-phishing emails that targeted specific individuals within the organization. Upon execution of the malware, we observed a range of tactics that facilitated persistence, command and control, and lateral movement across the network.
Initial Access
The actor began the campaign by sending meticulously designed phishing emails. In our analysis of the email headers, we identified that the emails appeared to originate from a trusted internal domain, thus enhancing their chances of evasion. The attachment contained a weaponized document that executed a macro, subsequently downloading the malware payload from an external server controlled by the actor. The malware was obfuscated to evade detection mechanisms, showcasing the actor’s commitment to maintaining stealth at the initial access phase.
Execution & Persistence
Upon successful execution, the malware created a number of artifacts on the compromised system. Notably, it established persistence through the creation of a registry key located at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\maliciousApp. This ensured that the malware would execute with each system restart, allowing the actor to maintain a foothold within the environment. Additionally, the payload exhibited behavior characteristic of a remote access Trojan (RAT), capable of initiating reverse shells and beaconing back to the actor’s C2 environment.
Command and Control
Our analysis revealed that the malware utilized a novel C2 infrastructure that employed a mix of traditional and modern tactics. Initially, the malware communicated over HTTP to a dynamically generated domain, which was extensively monitored. Subsequent investigations identified that the actor had implemented a series of domain flux techniques, complicating mitigation efforts. The C2 responses contained encoded data, suggesting that the actor was exfiltrating sensitive information in a compressed format, likely to evade data loss prevention tools.
Lateral Movement & Discovery
Once inside the network, the actor leveraged various lateral movement techniques to access additional hosts. We observed instances of Pass-the-Hash (T1075) attacks, allowing the actor to impersonate users and navigate through the network undetected. The malware created and manipulated scheduled tasks to facilitate further downloads of secondary payloads. Throughout this phase, the actor also utilized tools such as PsExec and WMIC, which are known for their efficacy in lateral movement, culminating in the expansion of the compromised footprint within the organization.
Impact & Objectives
The primary objective appeared to be the exfiltration of sensitive corporate data, including intellectual property and employee credentials. We monitored network traffic and determined that the actor ultimately established a secure channel for continuous data exfiltration, leveraging encrypted transmissions to obscure their actions from security monitoring systems. As we pieced together the timeline of events, it became apparent that the actor had a well-defined strategy aimed at long-term access and data gathering rather than immediate monetization.
MITRE ATT&CK Mapping
- T1566 – Phishing: The actor employed phishing emails as the initial vector for compromise.
- T1047 – Windows Management Instrumentation: Used for lateral movement and executing commands on remote systems.
- T1075 – Pass-the-Hash: Enabled credential theft and further network access.
- T1105 – Remote File Copy: Facilitated the transfer of additional payloads across the network.
- T1218.011 – Signed Binary Proxy Execution: Used to execute malware via legitimate processes.
Detection Opportunities
- Monitor for suspicious outbound HTTP/S connections to newly registered domains.
- Implement alerts for modifications to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\registry paths. - Utilize behavioral analysis of PowerShell and WMI executions to detect potential lateral movement.
Analyst Notes
The findings from this investigation highlight the importance of employee training on recognizing phishing attempts and the need for robust endpoint detection and response strategies. Continuous monitoring and adaptive security measures are essential to combat and mitigate the risks associated with advanced persistent threats. As adversaries continue to refine their techniques, it is critical to stay ahead of the curve through threat intelligence sharing and collaboration across the cybersecurity community.
Source: Original Report