Deep Dives

In-Depth Analysis of a Recent Malware Campaign Targeting Financial Institutions

by n8n admin

Alex Morgan — Threat Intelligence Analyst

Key Takeaways

  • The campaign utilized spear-phishing emails as the primary vector for initial access.
  • Persistence mechanisms leveraged Windows Task Scheduler and misleading naming conventions.
  • Command and Control (C2) communications were obscured through domain generation algorithms (DGAs).

Executive Summary

Throughout our investigation, we analyzed a sophisticated malware campaign targeting several financial institutions across North America. The attackers demonstrated a keen awareness of their targets’ security postures, opting for a multi-faceted approach to infiltrate and maintain access on victim systems. The initial entry point was primarily through spear-phishing emails laden with malicious attachments designed to exploit known vulnerabilities in widely used applications. Our comprehensive analysis shed light on how the threat actor maintained persistence, communicated with their C2 infrastructure, and conducted lateral movement within compromised networks.

Initial Access

Initial access was gained through targeted spear-phishing emails that contained Office documents with embedded macros. During our analysis of the email headers, we noted that the sender’s domain resembled that of a known supplier, enhancing the likelihood of successful social engineering. Users who enabled macros inadvertently downloaded the first payload, detected as Trojan.Banker. This component initiated the subsequent stages of the attack chain by executing a PowerShell command to download further malicious modules. The initial access vector aligns with the T1566 – Phishing technique from the MITRE ATT&CK framework, illustrating a common yet effective tactic employed by cyber adversaries.

Execution & Persistence

Upon execution, the malware dropped additional payloads to the system. Our analysis revealed that the main implant utilized a combination of dynamic loading to evade detection and persistent mechanisms through the Windows Task Scheduler. The task was created with the command schtasks /create /tn

Source: Original Report

Related Posts