Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Understanding the sophisticated initial access strategy using spear-phishing emails with weaponized documents.
- Examination of lateral movement techniques, specifically leveraging T1075 – Pass the Hash for credential theft.
- Identification of active Command and Control (C2) infrastructure through DNS tunneling and IP rotation tactics.
Executive Summary
During our analysis of a recent and sophisticated cyber-attack targeting financial institutions, we identified a well-coordinated campaign designed to exfiltrate sensitive data while maintaining persistence within the victim environment. The threat actor employed a variety of advanced tactics, techniques, and procedures (TTPs) to ensure operational efficiency and stealth. Our investigation into the malware variants and the underlying infrastructure utilized revealed intricate layers of obfuscation and evasion.
Initial Access
The initial access vector leveraged by the adversary was primarily through spear-phishing emails that appeared to come from legitimate sources. These emails contained enticing lures, often masquerading as important communications from within the financial sector. The key payload was a Microsoft Word document embedded with macros, which, when enabled, downloaded the actual malware from a remote server. The sample we examined used base64 encoding to obfuscate its PowerShell commands, showcasing a robust evasion tactic against initial security controls.
Execution & Persistence
Once executed, the malware deployed a dropper named DocDroper, which executed additional payloads to establish persistence on the compromised system. We observed that the dropper created a scheduled task at C:\Windows\System32\Tasks\MyFinanceTask to run the payload every time the system booted. Furthermore, registry modifications were made at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run to ensure the implant would remain operational even if the scheduled task failed.
Command and Control
Our analysis revealed that the actor employed a complex Command and Control (C2) infrastructure, leveraging DNS tunneling techniques to exfiltrate data stealthily. The implant communicated with an IP address that frequently shifted, utilizing dynamic DNS services to evade detection. We identified multiple domains, with behavioral patterns suggesting that the actor was using a form of beaconing. The malware sent periodic HTTP requests to these domains, each time using a different user-agent string to mimic legitimate traffic.
Lateral Movement & Discovery
After establishing persistence, the attacker moved laterally within the network. This was accomplished using stolen credentials and exploiting T1075 – Pass the Hash techniques, allowing them to access other machines without requiring clear-text passwords. We spotted evidence of the malware querying for local user accounts and gathering information about domain controllers, indicative of their effort to extend their reach throughout the network. The execution of commands from a remote shell facilitated further reconnaissance, leading to the gathering of sensitive documents and user credentials.
Impact & Objectives
The primary objectives of the threat actor appeared to be data exfiltration and establishing a foothold in the targeted environment for prolonged access. Once critical data, such as customer financial records and internal documentation, was identified, the data was compressed and sent back to the attacker’s C2 infrastructure. Additionally, the actor’s behavior suggested a secondary goal of disrupting services, considering the targeted organizations were heavily reliant on their operational uptime, particularly in the financial sector.
MITRE ATT&CK Mapping
- T1566 – Phishing: Use of spear-phishing emails with malicious attachments.
- T1203 – Exploitation for Client Execution: Exploitation of Microsoft Office vulnerabilities via macros.
- T1046 – Network Service Scanning: Scanning the network for vulnerabilities after gaining initial access.
- T1075 – Pass the Hash: Using stolen hashed credentials for lateral movement.
Detection Opportunities
- Monitor for anomalous execution of PowerShell commands and macros within Office documents.
- Implement detection rules for suspicious scheduled tasks created in the
C:\Windows\System32\Tasks\directory. - Utilize network traffic analysis to identify patterns consistent with DNS tunneling activities.
Analyst Notes
The investigation into this campaign underscores the evolving techniques employed by threat actors to target financial institutions. The reliance on phishing and lateral movement exploits highlights the need for robust user education and continuous monitoring for unusual account activities. Organizations must remain vigilant in updating their security protocols to account for such sophisticated threats, fostering a culture of awareness and rapid response against potential attacks.
Source: Original Report