Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Dridex malware employs sophisticated evasion techniques and multi-stage infection processes.
- This campaign leverages phishing emails containing malicious Microsoft Word documents to achieve initial access.
- Indicators of Compromise (IOCs) include specific URL patterns, file hashes, and registry modifications related to persistence mechanisms.
Executive Summary
During our analysis of a recent Dridex campaign, we observed that the actor adopted a multi-faceted approach to compromise networks. The attack vector started with phishing, employing macros embedded in Microsoft Word documents to execute the payload, which subsequently led to a well-defined Command and Control (C2) infrastructure. These C2 servers facilitated the drop of additional malware, including banking Trojans, aimed at stealing credentials and sensitive data from the infected hosts.
Initial Access
Our investigation uncovered that the initial access vector primarily consisted of phishing emails targeting financial institutions. These emails contained links to seemingly benign Microsoft Word documents. Upon opening the documents, users were prompted to enable macros, triggering a PowerShell command designed to download the malicious binary from a remote server. The download URL was obfuscated, making it harder for users to identify the malicious intent. Additionally, the URL patterns matched known Dridex-related indicators, with domains such as malicious.example.com being frequently observed.
Execution & Persistence
Once the macro executed, it initiated the download of a DLL file masquerading as a legitimate application, specifically targeting Windows systems. The sample we examined was named legitapp.dll and wrote itself to the C:\Users\%USERNAME%\AppData\Local\Temp\ directory. Throughout our analysis, we noticed that this DLL would leverage the DLL Search Order Hijacking technique, allowing it to execute maliciously while appearing to be a benign system process. It also created a scheduled task to ensure persistence across system reboots, registering it under HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
Command and Control
The C2 infrastructure established by the actor showed resilience; it utilized multiple domains for redirection in case of takedown attempts. The Dridex payload was designed to beacon back to hardcoded domains at regular intervals. During our analysis, we identified that the beacons contained system information, which included the user’s environment, operating system version, and installed software. These beacons communicated over HTTP and HTTPS, with our telemetry pointing to unusual outbound traffic on ports 80 and 443, characteristic of Dridex communications.
Lateral Movement & Discovery
Following the initial compromise, the malware established mechanisms for lateral movement within the network. We observed that Dridex employed the Windows Management Instrumentation (WMI) for discovery tasks, giving it the ability to enumerate other devices connected to the network. Our analysis also revealed that through stolen credentials, the actor leveraged Pass-the-Hash techniques to navigate through the environment undetected, enabling them to further deploy payloads across various endpoints in the network.
Impact & Objectives
The primary objective of the Dridex campaign appeared to be the exfiltration of sensitive financial information, as indicated by the payloads deployed. The malware was capable of intercepting credentials entered into banking websites, which highlights its functionality as an effective Credential Harvester. Additionally, the speed of lateral movement throughout the organization was alarming, as we witnessed several instances of the malware hitting critical systems within hours of the initial infection. This scenario underscores the urgency for organizations to adopt proactive defenses against such multifaceted threats.
MITRE ATT&CK Mapping
- T1071.001 – Application Layer Protocol: Web Protocols: The malware communicates with C2 over HTTP/HTTPS, utilizing common web ports to evade detection.
- T1059.001 – Command-Line Interface: Windows Command Shell: Utilizes PowerShell to execute the initial payload download.
- T1070.001 – Indicator Removal on Host: Clear Windows Event Logs: The malware may clear logs to hide traces of the attack.
Detection Opportunities
- Monitor for unusual outbound connections to known malicious domains associated with Dridex.
- Employ endpoint detection measures that can recognize anomalous PowerShell execution patterns.
- Analyze scheduled tasks for modifications or newly created entries that could signal persistence mechanisms.
Analyst Notes
The persistence and adaptability of Dridex make it a significant threat to organizations, particularly in financial sectors. Observing its behavior provides insights into the tools and techniques favored by cybercriminals. Continuous monitoring and threat intelligence sharing will be vital in mitigating the impacts of such sophisticated attacks moving forward.
Source: Original Report