Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The ElderGas ransomware employs aggressive social engineering tactics for initial access.
- Post-exploitation, the malware utilizes the T1071.001 – Application Layer Protocol: Web Protocols technique to establish communication with its C2 servers.
- Effective lateral movement is facilitated by exploiting existing trust relationships within the environment.
Executive Summary
In our investigation of the ElderGas ransomware campaign, we observed a well-orchestrated attack vector beginning with a phishing email. The attacker leveraged urgency and a sense of legitimacy, tricking users into executing a malicious payload. Our analysis revealed that the payload was a dropper, which upon execution, deployed the ransomware into the infected environment. The ElderGas ransomware, characterized by its encryption capabilities and demanding sizeable ransoms, posed a significant operational risk to the impacted organizations.
Initial Access
Initial access was gained through a sophisticated spear-phishing attack. The actor crafted an email mimicking an internal notice from a reputable service provider, including a link to what appeared to be an important document. Clicking on the link led to a malicious download masquerading as a PDF file. During the investigation, we found that the payload was a dropper executable named ElderDrop.exe, which is often delivered in documents using macros — a method that exploits user trust in legitimate documents.
Execution & Persistence
Once executed, the dropper performed a series of operations. First, it extracted the ransomware payload from a compressed archive C:\Users\Public\Temp\ElderGas.zip and initiated its execution under the guise of a legitimate Windows process. This is where we noted the implementation of the T1059.001 – Command-Line Interface technique to run the payload silently. For persistence, the malware created a registry entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ElderGas, ensuring the ransomware remains resident across reboots. This method effectively kept the ransomware operational even after user attempts to terminate it.
Command and Control
Our analysis revealed that the ElderGas ransomware attempts to connect to its command and control infrastructure immediately after execution. This is achieved via T1071.001 – Application Layer Protocol: Web Protocols, where the malware communicates over HTTP/S to an IP address with a rotating domain, complicating detection efforts. The traffic initially appears benign, making it challenging for conventional security measures to identify anomalies. We traced some connections to previously seen IPs associated with other known ransomware families, indicating a possible overlap in infrastructure.
Lateral Movement & Discovery
After establishing a foothold within the environment, ElderGas began lateral movement using the T1021.002 – Remote Services: SMB/Windows Admin Shares technique. The ransomware gathered credentials using T1087.001 – Account Discovery: Domain Account to exploit Windows shares and move laterally across the network. We detected the lateral movement via unusual access attempts from domain administrator accounts accessing other critical servers, highlighting the effectiveness of the actors’ tactics in covering their tracks while escalating privileges.
Impact & Objectives
The primary goal of the ElderGas campaign was to encrypt files across the network, rendering them inaccessible to the users. Our observations noted that the ransomware not only targeted user data but also system backups, effectively crippling the organization’s recovery capabilities. The ransom note left on infected machines demanded payment in cryptocurrency to restore access, further underscoring the impact on organizational operations and data integrity. The actor’s objectives were clearly articulated in the ransom note, detailing threats of data deletion and public exposure of sensitive information if demands were not met.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial vector via targeted email campaigns.
- T1059.001 – Command-Line Interface: Used to execute commands silently in the background.
- T1071.001 – Application Layer Protocol: Web Protocols: Used for C2 communication via HTTP/S.
- T1021.002 – Remote Services: SMB/Windows Admin Shares: Employed for lateral movement across the network.
- T1087.001 – Account Discovery: Domain Account: Utilized for credential harvesting and privilege escalation.
Detection Opportunities
- Monitor network traffic for unusual outbound HTTP/S requests, particularly those associated with known ransomware communication patterns.
- Implement endpoint detection solutions capable of identifying the execution of known dropper patterns and suspicious registry modifications.
- Conduct regular audits and reviews of user permissions and access logs to identify unusual login activities or lateral movements.
Analyst Notes
The ElderGas ransomware campaign illustrates the need for organizations to prioritize user security awareness and robust incident response planning. Understanding the tactics employed by attackers can significantly enhance detection and prevention measures. Organizations should consider employing a defense-in-depth strategy, incorporating both user education and technological defenses to reduce risk. Regular updates to security tools and incident response playbooks, alongside threat intelligence sharing, will bolster an organization’s resilience against this evolving threat landscape.
Source: Original Report