Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The attack utilized a familiar Poison Ivy variant for initial access and persistence.
- Command and Control (C2) communications were found leveraging unsecured protocols, raising significant red flags.
- Detection of lateral movement was challenging due to the use of legitimate credentials and tools.
Executive Summary
During a recent investigation, we analyzed a targeted attack leveraging the Poison Ivy remote access Trojan (RAT). Our analysis revealed a well-orchestrated attack chain beginning with phishing emails that baited the victim into executing a malicious attachment. The actor primarily aimed to exfiltrate sensitive data and establish prolonged access to the network. This detailed examination will discuss the methodologies employed by the threat actor from initial access through impact, highlighting notable Technical Tactics, Techniques, and Procedures (TTPs) observed throughout the attack.
Initial Access
The initial access vector was a phishing campaign. Our telemetry indicated that the actor sent tailored emails with malicious attachments disguised as important documents. The attachment was a Microsoft Office file that exploited the CVE-2017-0199 vulnerability, allowing for remote code execution. Upon opening the attachment, the payload, masquerading as a legitimate docx file, executed a PowerShell command that downloaded the Poison Ivy implant from a remote server. The server used a dynamic DNS service, making the C2 domain appear less suspicious.
Execution & Persistence
Once the Poison Ivy implant was installed, it created a persistence mechanism within the system through the registry. The implant created an entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ with a value referencing the dropped executable. This ensured that the implant would be executed on each user login. We also observed the use of scheduled tasks, which the actor utilized to re-establish connectivity with the C2 server if the primary persistence method failed.
Command and Control
Our investigation revealed that the C2 communications utilized typical behaviors of Poison Ivy, primarily over HTTP and sometimes HTTPS. The implant’s beaconing occurred approximately every 30 seconds, reporting system information and awaiting commands from the C2 server. The actor was careful to encrypt their C2 traffic using basic XOR obfuscation techniques, but our analysis decompressed and analyzed this traffic, ultimately allowing us to identify commands for file upload and download. We also noted that the C2 server used a rotating domain strategy to evade detection, often cycling through multiple subdomains.
Lateral Movement & Discovery
Post-installation, the actor moved laterally within the network by utilizing legitimate credentials stolen during the reconnaissance phase. Techniques such as T1078 (Valid Accounts) were observed as the actor leveraged credentials obtained from local accounts and Active Directory. The Poison Ivy implant facilitated this lateral movement by providing access to shares and admin tools like PsExec. Additionally, we identified instances where the actor employed T1087 (Account Discovery) techniques, allowing them to query user accounts and identify additional targets within the network.
Impact & Objectives
The threat actor’s objectives appeared to focus on data exfiltration and establishing a foothold for potential future attacks. During our review, we detected attempts to exfiltrate files through commonly used file transfer protocols embedded within the Poison Ivy commands. Additionally, the implant gathered a vast array of sensitive information from the compromised machine, including documents, credentials, and system configurations, all of which were then staged for exfiltration. The culmination of these activities indicates a clear intent to leverage the compromised environment for further strategic advantage.
MITRE ATT&CK Mapping
- T1566 – Phishing: The threat actor utilized phishing emails to facilitate initial access.
- T1203 – Exploitation for Client Execution: Exploited a vulnerability in Microsoft Office to execute the payload.
- T1059 – Command and Scripting Interpreter: Leveraged PowerShell to execute commands and facilitate beaconing.
- T1078 – Valid Accounts: The actor used legitimate login credentials for lateral movement.
- T1087 – Account Discovery: The actor queried user accounts during the reconnaissance phase.
Detection Opportunities
- Monitor for suspicious PowerShell execution, particularly those involving the
-EncodedCommandparameter. - Establish alerting for anomalous registry changes in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\. - Inspect network traffic for unusual outbound HTTP/HTTPS traffic, especially with dynamic DNS domains.
Analyst Notes
This incident underscores the importance of a multi-layered defense strategy, particularly regarding user education about phishing. Continuous monitoring and threat-hunting exercises ought to be in place to detect lateral movement indicators and command-and-control traffic associated with known RATs like Poison Ivy. Combining user training with technology can significantly boost resilience against such targeted attacks.
Source: Original Report