Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- This malware campaign utilizes a sophisticated multi-stage approach to undermine network security.
- Initial access is achieved via spear phishing, leveraging social engineering techniques.
- Lateral movement techniques are employed to widen the attack surface after initial execution.
Executive Summary
During our investigation into a recent malware campaign, we observed a complex and well-orchestrated attack that unfolded in multiple stages. The malicious actor deployed a combination of social engineering tactics and sophisticated malware components aimed at both data exfiltration and network disruption. Our analysis revealed that the attack vector primarily relied on spear phishing emails with malicious attachments that served as the initial access point. This analysis will detail each stage of the attack lifecycle, from initial access through to the persistence mechanisms and the eventual command and control (C2) operations.
Initial Access
The initial access phase of the attack was initiated through a well-crafted spear phishing email targeting employees at a financial services firm. The email contained a seemingly innocuous attachment named Invoice_Q3_2023.docx. Our examination of the document revealed that it exploited an embedded macro to run a PowerShell script upon opening. This tactic aligns with the T1059.001 – Command-Line Interface: PowerShell technique from the MITRE ATT&CK framework. The macro executed a Base64-encoded payload which, when decoded, pointed to a downloader executable.
Execution & Persistence
Upon execution, the downloader fetched the main implant from a remote server. The sample we analyzed employed a common method of obfuscation to hide its true nature by using encrypted strings and self-extraction techniques. The payload, identified as Nanocore RAT, aimed to establish persistence on the infected system by writing registry keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure that it would execute at startup. This relies on the T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder technique for persistence.
Command and Control
Following successful installation, the implant initiated communication with its C2 server. Our analysis detected the use of a dynamic DNS service, indicating a deliberate effort to obfuscate the C2 infrastructure. The implant sent periodic beacons every 15 minutes, which is a standard pattern used by the actor to maintain connectivity without raising suspicion. The traffic was encapsulated within HTTP requests, with User-Agent strings masquerading as various legitimate applications. This aligns with the T1071.001 – Application Layer Protocol: Web Protocols technique.
Lateral Movement & Discovery
After establishing a foothold on the primary target, the malware employed tools and techniques for lateral movement. We discovered instances of Mimikatz, which the actor utilized to harvest credentials from memory. This was corroborated by the detection of several T1003.001 – Credential Dumping: LSASS Memory events in our logs. Utilizing the compromised credentials, the actor executed additional commands remotely against a secondary system, leveraging PsExec to deploy the RAT across multiple machines within the network.
Impact & Objectives
The ultimate goal of this campaign appeared to focus on data exfiltration and potential ransomware deployment. Once embedded within the network, the actor began enumerating critical directories and files for sensitive documents along with configurations related to financial transactions. The malware’s design included a module capable of compressing documents before exfiltration. We identified multiple exfiltration events targeting external IP addresses controlled by the threat actor, leading us to conclude that the primary objective was data theft followed by potential extortion.
MITRE ATT&CK Mapping
- T1059.001 – Command-Line Interface: PowerShell: Used for executing macros and scripts for initial payload execution.
- T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder: Leveraged for persistence through registry modifications.
- T1071.001 – Application Layer Protocol: Web Protocols: Encapsulated C2 communication in HTTP requests.
- T1003.001 – Credential Dumping: LSASS Memory: Employed for harvesting credentials to facilitate lateral movement.
Detection Opportunities
- Monitor for unusual PowerShell script executions from document attachments, particularly those that originate from external email sources.
- Implement alerts for changes to the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runregistry path. - Inspect network traffic for patterns indicative of C2 communications, especially those utilizing dynamic DNS services.
Analyst Notes
This campaign underscores the need for robust email filtering mechanisms and user training around handling email attachments. Notably, the techniques employed indicate a well-resourced actor capable of adapting known exploits and tools for their operations, reinforcing the necessity for continuous monitoring and threat hunting initiatives within organizations. Understanding the methods and TTPs of adversaries not only aids in current detection efforts but also informs defenses against future attacks.
Source: Original Report