Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The phishing campaign utilizes malicious Excel files as the initial payload to deploy the formbook malware.
- Our investigation revealed the use of PowerShell scripts for the execution of the dropper on compromised hosts.
- We observed the actor leveraging DNS tunneling for command and control to evade detection.
Executive Summary
During the investigation of a recent phishing campaign, we uncovered a sophisticated deployment of the formbook malware through seemingly innocuous Excel spreadsheets. The delivery mechanism exploited social engineering tactics to entice users into enabling macros, which subsequently executed a series of malicious payloads. Our analysis of the sample indicated a clear attack chain that exhibited multiple stages, including stealthy execution and C2 communication methodologies aimed at data exfiltration.
Initial Access
The initial access vector for this campaign involved phishing emails crafted to resemble genuine communication from trusted entities. These emails contained links to download malicious Excel files disguised as important documents. Upon executing the Excel file, users would be prompted to enable macros, a tactic that facilitated the execution of embedded malcode. The macros utilized were obfuscated to hide their intentions, employing Base64 encoding to mask the PowerShell commands responsible for dropping the actual formbook payload.
Execution & Persistence
Once the Excel file’s macro executed, it triggered a PowerShell command that downloaded the formbook dropper from a remote server. Our analysis revealed specific commands that used Invoke-WebRequest to retrieve the malware, which was subsequently saved in the user’s %TEMP% directory as %TEMP%\doc.exe. The dropper would then create a registry run key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure persistence on system reboots. The registry key was observed being populated with the payload executable path, allowing the implant to survive system restarts and remain resident on compromised hosts.
Command and Control
Following the successful execution, the formbook malware established communication with its command and control (C2) server using a DNS tunneling approach. Our analysis estimated that the malware would send beacons to the C2 every 60 seconds, exfiltrating data in small chunks to avoid detection by network monitoring solutions. This DNS tunneling was achieved by encoding the stolen information into DNS queries which utilized a unique domain structure. Additionally, we identified that the C2 communications employed a list of evasion techniques, including randomized intervals and variable query sizes.
Lateral Movement & Discovery
As the implanted formbook malware executed its routines, it started gathering system information and network details. The implant collected data such as username, machine name, and local IP address, which could be sent back to the actor’s C2. Furthermore, we observed lateral movement techniques indicative of typical Credential Dumping under the MITRE ATT&CK framework. The malware attempted to harvest stored credentials from browsers and other applications, leveraging known API calls for credential access.
Impact & Objectives
The primary objective of this campaign appeared to be data theft, focusing on sensitive information such as login credentials and proprietary information. The formbook malware has been associated with various theft variants, including sensitive documents and credential harvesting from browsers. The actor’s ultimate goal may include leveraging this data for financial gain, unauthorized access to other systems, or staging further attacks against the organization’s infrastructure.
MITRE ATT&CK Mapping
- T1193 – Spear Phishing Link: Delivery of the malicious Excel file through social engineering.
- T1059.001 – PowerShell: Use of PowerShell scripts in Excel macros to launch the malware.
- T1071.001 – Application Layer Protocol: Web Protocols: DNS tunneling for command and control communications.
Detection Opportunities
- Monitor for unusual DNS queries, particularly those with mixed alphanumeric patterns indicative of DNS tunneling.
- Implement strict email filtering rules to detect and reduce the likelihood of phishing emails reaching users.
- Utilize endpoint detection solutions to track the execution of rogue PowerShell commands, especially those attempting to download executables from the internet.
Analyst Notes
This incident underscores the need for robust user training around phishing and the dangers of macro-enabled documents. It is critical for organizations to maintain up-to-date incident response procedures to deal with such initial access vectors and potential fallout. Employing threat hunting methodologies that include tracking user behavior and monitoring for known malicious IOCs related to formbook and other similar malware could significantly enhance perimeter defenses.
Source: Original Report