Sarah Chen — Malware Reverse Engineer
Key Takeaways
- This campaign utilized a multi-faceted phishing method to gain initial access.
- The malware exhibited advanced persistence mechanisms through registry modifications and scheduled tasks.
- Effective lateral movement was achieved via the exploitation of Windows Admin Shares, escalating privileges for further exploitation.
Executive Summary
During our investigation of a recent phishing campaign, we encountered a sophisticated use of social engineering techniques leading to the deployment of a Remote Access Trojan (RAT). The initial access vector was primarily through carefully crafted emails that mimicked legitimate business communications, designed to trick users into executing a malicious attachment. Our analysis of the payload revealed advanced persistence methods and a robust command and control (C2) infrastructure, indicating the actor’s intent to maintain a long-term foothold within the network.
Initial Access
Upon delving into the attack, we observed the threat actor leveraging a standard phishing approach, utilizing emails that impersonated a trusted document-sharing service. The attachment, named Invoice_2023.zip, contained a macro-enabled document. When opened, it executed a PowerShell command that downloaded the NetWire RAT from an external server. This method aligns with techniques outlined in the MITRE ATT&CK framework under T1566 – Phishing.
Execution & Persistence
The malware executed a multi-stage dropper that unpacked the RAT payload into the user’s temporary directory, specifically at C:\Users\. The analysis revealed that upon execution, the NetWire RAT employed persistence mechanisms by modifying the Windows Registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, creating a new entry to ensure it would execute on every login. Additionally, a scheduled task was created to invoke the RAT periodically, showcasing a clear intent for persistence.
Command and Control
Our analysis revealed that the RAT established communication with a dynamic IP address, which changed frequently. The traffic was encrypted, making packet analysis fruitless without further decryption. We identified that the malware used custom protocols to communicate with the C2, featuring an elaborate series of beacons sent every few minutes. The worker nodes within this network indicated a well-structured hierarchy for data exfiltration, hinting at a professional level of operational security on the actor’s part.
Lateral Movement & Discovery
Following the initial infection phase, lateral movement was executed utilizing the legitimate credentials harvested during the RAT’s operations. The threat actor employed the T1075 – Pass the Hash technique to move laterally across the network, accessing Windows Admin Shares. The actor utilized common administrative tools such as PsExec and wmic for remote command execution, further showcasing their understanding of the Windows environment and administrative tasks.
Impact & Objectives
The investigation underscored that the actor’s primary objectives included stealing sensitive information and establishing a foothold for potential future attacks. We found evidence of data exfiltration occurring via a secure FTP channel (SFTP), where files were uploaded to a remote server. The impact resulted in potential data leaks that could expose proprietary business information, leading to significant financial and reputational damage to the victim organization.
MITRE ATT&CK Mapping
- T1566 – Phishing: Technique used to gain initial access through social engineering.
- T1059.001 – PowerShell: Utilized for executing malicious commands to download the RAT.
- T1075 – Pass the Hash: Technique for lateral movement by using cached credentials.
Detection Opportunities
- Monitor for unusual registry modifications related to startup items, particularly in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Implement outbound traffic filtering to detect communication patterns to known malicious domains associated with RAT activities.
- Alert on the execution of Microsoft Office documents containing macros, especially from untrusted email sources.
Analyst Notes
This case highlights the importance of user awareness training to mitigate the risks associated with phishing. Given the evolving threat landscape, adaptive defense strategies should be implemented to detect and respond to these sophisticated attacks effectively. Continuous monitoring of network traffic and implementing layer defense mechanisms are crucial in preventing similar incursions in the future.
Source: Original Report