Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The actor utilized spear-phishing emails to bypass security measures.
- Post-exploitation techniques involved the use of Mimikatz for credential harvesting.
- Multiple C2 communication channels were established, leveraging both HTTP and DNS tunneling.
Executive Summary
During our investigation, we analyzed a malware sample affiliated with a sophisticated actor targeting financial institutions. The attack chain began with a spear-phishing campaign, deploying a specially crafted document that exploited known vulnerabilities in Microsoft Office applications. The initial access allowed the actor to deploy their implant, establishing footholds within the network. Subsequent stages of the attack leveraged advanced techniques for lateral movement and data exfiltration.
Initial Access
In the initial phase, the actor employed a multi-pronged strategy centered around well-crafted spear-phishing emails sent to key personnel within the organization. The emails contained a malicious Financial_Report.docm that, once opened, executed a series of macros leading to the download of a PowerShell script from a remote server. This script was responsible for downloading the main payload, detected as Trojan:Win32/AgentTesla, which is known for its keylogging capabilities and ability to exfiltrate sensitive information.
Execution & Persistence
Once executed, the malware established persistence using the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\StartupAgent. This ensured that the implant would survive system reboots. During our analysis, we observed that the implant was capable of evading detection by injecting itself into legitimate processes. The actor used techniques such as Process Injection (T1055) to avoid raising alarms during activity.
Command and Control
Our analysis revealed that the actor employed multiple C2 communication channels. The primary C2 was hosted on a server accessible via http://example-evilserver.com, utilizing standard HTTP requests to communicate with the implant. Additionally, we discovered a secondary channel leveraging DNS tunneling, which allowed the actor to issue commands even in environments with stringent network controls. The use of DNS over HTTPS (DoH) was particularly notable, as it blended malicious traffic with legitimate DNS queries, complicating detection efforts.
Lateral Movement & Discovery
Once inside the network, the actor initiated lateral movement utilizing native Windows tools. They employed Mimikatz (T1003) to extract credentials from memory, targeting the Local Security Authority Subsystem Service (LSASS) process. These credentials facilitated access to additional systems, expanding the actor’s footprint. The actor also executed Powershell Remoting (T1021) to perform reconnaissance across the network, identifying further targets for data exfiltration.
Impact & Objectives
The ultimate goal of the attack appeared to be financial gain through the extraction of sensitive data. The actor methodically prepared to exfiltrate information, with indicators suggesting that they were interested in customer banking information and internal financial documents. Our investigation uncovered scheduled tasks that indicated an ongoing data exfiltration process via FTP shares to an external network. This operational cadence highlighted the actor’s intent to create a long-term presence within the environment, allowing for continuous data harvest.
MITRE ATT&CK Mapping
- T1566 – Phishing: Spear-phishing emails tailored to target individuals.
- T1059 – Command and Scripting Interpreter: PowerShell scripts utilized to download and execute payloads.
- T1071 – Application Layer Protocol: Use of HTTP and DNS for command and control communications.
- T1003 – Credential Dumping: Mimikatz used for harvesting credentials.
Detection Opportunities
- Monitor for unusual process behavior, particularly signs of code injection or manipulation of
lsass.exe. - Implement email filter rules to detect and quarantine spear-phishing emails that contain macros.
- Analyze outgoing DNS requests for potential tunneling or unusually high volumes of requests that do not match expected patterns.
Analyst Notes
Throughout the investigation, we noted the actor’s sophisticated use of evasion techniques and their understanding of network protocols to blend malicious activity with normal operations. These tactics emphasize the need for a defense-in-depth strategy, where organizations continuously update their threat models based on emerging trends. Regular training for employees on identification of phishing attempts and robust monitoring of network traffic are essential components in mitigating advanced persistent threats.
Source: Original Report