Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- The attacker employed a multi-stage phishing strategy to deliver a custom payload.
- Persistence was achieved using a scheduled task and registry modifications.
- Network traffic analysis revealed beaconing patterns indicative of a C2 infrastructure utilizing a strong obfuscation technique.
Executive Summary
Our investigation into a recent phishing campaign uncovered a sophisticated threat actor leveraging custom malware for data exfiltration. The attack path revealed a layered approach, starting from initial access via credential harvesting and culminating in extensive lateral movement within the target’s network. Throughout the analysis, we identified multiple TTPs aligned with known APT behavior, which underscores the need for vigilant defenses against evolving threats.
Initial Access
The initial access vector for this attack involved a well-crafted phishing email that mimicked communications from a legitimate vendor. The email contained a link that redirected victims to a compromise site where a malicious document was hosted. Upon downloading the document, users were prompted to enable macros, triggering the execution of a PowerShell script that downloaded the initial payload. We noted the use of T1573.001 – Remote Services: RDP to enhance access to the victim’s environment, which allowed the actor to gather credentials stealthily before pivoting further into the network.
Execution & Persistence
Once the PowerShell script executed, it downloaded a dropper component, which was responsible for fetching a more robust payload. This payload was identified as a custom backdoor that operated on a variety of Windows systems, maintaining persistence through a scheduled task located at C:\Windows\System32\Tasks\. Additionally, we observed modifications made to registry keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure that the implant would execute at user login.
Command and Control
Our analysis of network traffic unveiled a structured command and control (C2) channel established using HTTPS requests to a domain that utilized dynamic DNS services. The malware communicated with C2 servers at irregular intervals, initiating beaconing patterns every 60 seconds. This method of communication employed base64-encoded payloads within the HTTP traffic, which evaded several signature-based detection systems. We classified the actor’s C2 tactics under T1071.001 – Application Layer Protocol: Web Protocols, illustrating the degree of sophistication behind their evasion techniques.
Lateral Movement & Discovery
During the investigation, we found evidence of lateral movement leveraging stolen credentials from the initial infection. The actor employed T1021.002 – Remote Services: SMB/Windows Admin Shares to access additional systems on the network. We documented the specific file shares accessed, revealing a pattern of probing for sensitive documents across multiple endpoints. The discovery phase allowed the attacker to map the network topology effectively, indicating potential targets with high-value information.
Impact & Objectives
As the operation unfolded, the primary objective appeared to be data exfiltration. The backdoor facilitated unauthorized access to critical business applications, which contained sensitive customer information. Following extensive data retrieval, the threat actor attempted to exfiltrate this information via encrypted HTTP requests, further reinforcing their evasion strategy. The incident highlighted the adversary’s goal to establish a foothold within the organization while systematically extracting intellectual property.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial vector exploiting user trust to deliver malware.
- T1059.001 – Command and Scripting Interpreter: PowerShell: The execution of the downloaded script leveraging native PowerShell commands.
- T1071.001 – Application Layer Protocol: Web Protocols: The use of HTTP/HTTPS for C2 communications.
- T1021.002 – Remote Services: SMB/Windows Admin Shares: Credential theft and lateral movement across the network.
Detection Opportunities
- Monitor for anomalous PowerShell execution related to file downloads and script executions from unexpected locations.
- Implement traffic analysis to identify irregular beaconing patterns to potential C2 addresses.
- Utilize endpoint detection and response (EDR) systems to analyze scheduled tasks and registry modifications that may indicate persistence mechanisms for malware.
Analyst Notes
This campaign exemplifies the continuous evolution of threat actors and their tactics, techniques, and procedures. Our findings strongly recommend that organizations enhance their security awareness training and implement advanced detection mechanisms. By understanding the methods and patterns used by these adversaries, defenders can better prepare for, detect, and respond to similar threats in the future.
Source: Original Report