Sarah Chen — Malware Reverse Engineer
Key Takeaways
- Malicious Office documents used as a vector for initial access
- Covert command and control using encrypted HTTP traffic
- Lateral movement leveraging legitimate administrative tools
Executive Summary
During our analysis of a recent phishing campaign, we uncovered a sophisticated threat actor employing unsolicited email attachments to deliver malicious Microsoft Office documents. The documents contained embedded macros that initiated payload execution. Our investigation revealed multiple stages of the attack, including persistence mechanisms, command and control (C2) infrastructure, and methods for lateral movement within target environments.
Initial Access
The attack vector began with a phishing email crafted to resemble correspondence from a legitimate organization. The email enticed users to open an attached Word document, seemingly mundane but deceptively laced with malicious content. Upon opening the document, users were prompted to enable macros, which is a typical tactic to obfuscate the execution of malicious scripting. The document we analyzed was named Invoice_Details.docm, exhibiting a familiar invoice format but containing malicious VBA macros that triggered the download of an initial payload.
Execution & Persistence
Once the macros were enabled, they extracted a secondary payload hosted on a remote server. This payload, identified as AgentTesla, is a well-known information stealer that collects sensitive data, including credentials and keystrokes. Upon execution, AgentTesla injected itself into common processes, such as explorer.exe, to avoid detection. For persistence, it established a registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ with a value pointing to its executable, ensuring it would execute at every user login.
Command and Control
The C2 communication was observed using encrypted HTTP traffic, indicative of the actor’s efforts to remain anonymous and avoid detection by network security measures. The payload beaconed to http://examplemaliciousdomain.com/update, where it transmitted collected data and awaited further commands. During our examination, we noted the use of a dynamic DNS service, allowing the actor to frequently change IP addresses, thus complicating potential mitigation efforts by defenders.
Lateral Movement & Discovery
After initial infection, the threat actor sought lateral movement opportunities across the network. They leveraged legitimate administrative tools such as PsExec and WMIC to transfer the AgentTesla payload to other machines. We documented the transfer of the executable to systems located in the same Active Directory domain, followed by the enumeration of user accounts and shares, enhancing their reach and potential data exfiltration options.
Impact & Objectives
Ultimately, the objective of the campaign appeared to be information theft. The data collected by AgentTesla included sensitive login credentials, potentially allowing for further exploitation into more critical systems. The threat actor seemed particularly interested in financial data, with several commands designed to seek out files relevant to transactions and accounting records. The broad access resulting from effective lateral movement and discovery efforts could impact organizational integrity and lead to significant financial losses if not swiftly addressed.
MITRE ATT&CK Mapping
- T1566 – Phishing: The initial delivery method was a phishing email containing a malicious Word document.
- T1086 – PowerShell: The threat occurred through scripts executed via VBA macros in the Office document.
- T1071 – Application Layer Protocol: C2 communication utilized encrypted HTTP traffic to evade detection.
- T1021.001 – Remote Services: Remote Desktop Protocol: Lateral movement used remote desktop tools to access other machines.
Detection Opportunities
- Monitor for suspicious email attachments with macros, particularly those resembling invoices or financial documentation.
- Implement application whitelisting to block unknown executables and use of PowerShell from Office documents.
- Configure alerting on unusual registry modifications, particularly in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\that indicate persistence mechanisms.
Analyst Notes
This campaign underscores the ongoing threat posed by social engineering techniques, specifically through email phishing. Continued education on the risks associated with macro-enabled documents is paramount for users. Additionally, enhancing endpoint security solutions to analyze and block suspicious behavior will be critical in mitigating similar attacks.
Source: Original Report