Deep Dives

In-Depth Analysis of the Recent ‘Panda’ Malware Campaign: A Threat Intelligence Perspective

by n8n admin

Alex Morgan — Threat Intelligence Analyst

Key Takeaways

  • The ‘Panda’ malware campaign demonstrates advanced evasion techniques and multi-staged delivery mechanisms.
  • Our analysis revealed that the malware employs multiple persistence strategies, including the modification of registry keys and the use of scheduled tasks.
  • Effective detection relies on monitoring C2 communication patterns and registry modifications.

Executive Summary

During our investigation into the ‘Panda’ malware campaign, we analyzed multiple samples associated with the threat actor. This campaign exhibits a high level of sophistication with various techniques used to establish persistence, evade detection, and execute commands on compromised systems. The malware showcases a clear intent to exfiltrate sensitive data while maintaining stealth. Indicators of compromise (IOCs) were derived from our analysis, providing valuable insights for defenders to bolster their security posture.

Initial Access

The initial access phase started with the delivery of a malicious email, containing a socially engineered attachment that masqueraded as an important document. The attachment, when executed, dropped a secondary payload, a loader that we identified as PandaLoader. This loader was responsible for downloading additional components from the threat actor’s command and control (C2) server. This behavior aligns with the MITRE ATT&CK technique T1071.001 – Application Layer Protocol: Web Protocols, utilizing HTTPS for stealthy communication.

Execution & Persistence

Upon execution, PandaLoader attempted to extract and execute its payload, which involved using a cmd.exe command to invoke another executable. Additionally, we observed two persistence mechanisms: it created a new entry in the Windows registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and scheduled a task via schtasks.exe for regular execution. This dual approach exemplifies the use of the T1547.001 – Boot or Logon Initialization Scripts technique, ensuring that the malware survives system reboots.

Command and Control

Communication with the C2 was established through a domain known to be used by the actor for this campaign. Our analysis revealed that the malware made periodic beacons to this domain over HTTPS, signaling its successful execution and readiness to receive further commands. The traffic patterns included encrypted payloads that concealed the nature of the communications, which presents a direct application of T1071 – Application Layer Protocol techniques to blend into legitimate web traffic.

Lateral Movement & Discovery

After establishing a foothold in the initial compromised host, the malware attempted lateral movement using Windows Management Instrumentation (WMI). We observed the execution of wmiquery.exe, which was employed to gather information about other systems on the network. This behavior corresponds to T1085 – Rundll32 and T1021.001 – Remote Services: Remote Desktop Protocol techniques, as the actor intended to expand their presence across the enterprise environment.

Impact & Objectives

The objectives of the ‘Panda’ malware campaign seem to revolve around data exfiltration and establishing long-term persistent access to compromised networks. During our investigation, we identified patterns indicating the theft of sensitive documents and credential harvesting, leveraging tools like CredentialDump to collect user credentials. The resulting impact could range from financial loss, reputational damage, to compliance violations, particularly if sensitive data were exposed.

MITRE ATT&CK Mapping

  • T1071.001 – Application Layer Protocol: Web Protocols: Evasion through the use of HTTPS for C2 communication.
  • T1547.001 – Boot or Logon Initialization Scripts: Creating registry entries and scheduled tasks for persistence.
  • T1085 – Rundll32: WMI used for information gathering within the network.

Detection Opportunities

  • Monitor registry modifications, particularly at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, for any suspicious modifications.
  • Utilize network traffic analysis to identify anomalous HTTPS traffic patterns, especially to known malicious domains.
  • Implement endpoint detection rules to capture the execution of wmiquery.exe and other related WMI commands, particularly outside of normal operational activity.

Analyst Notes

The ‘Panda’ malware campaign serves as a reminder of the evolving tactics employed by threat actors. Continuous monitoring and updates to detection mechanisms are critical in staying ahead of such sophisticated threats. Organizations should consider enhancing their email filtering solutions and adopting a zero-trust architecture to minimize the risk of initial access. Regular user training to recognize phishing attempts can significantly reduce the chances of successful attacks leveraging similar TTPs.

Source: Original Report

Related Posts