Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The Shadary malware campaign employs sophisticated techniques for initial access via spear phishing.
- Persistence mechanisms leverage registry and scheduled task manipulations to maintain footholds.
- Command and Control (C2) infrastructure uses dynamic DNS for obfuscation, complicating detection efforts.
Executive Summary
In our investigation of the Shadary malware campaign, we observed a multi-faceted approach to cyber intrusions characterized by initial access through targeted spear phishing emails. The actors demonstrated a high level of technical sophistication, with various tactics employed to ensure the longevity of their access and the stealth of their operations. This report delves deep into the specific techniques used throughout the attack chain, revealing critical insights for defenders and SOC teams alike.
Initial Access
Initial access was executed via a well-crafted spear phishing email containing a malicious attachment masquerading as a legitimate document. Upon opening, the document exploited vulnerabilities found in the Microsoft Office suite to execute a malicious PowerShell script. Our analysis revealed that the actor utilized the T1203 – Exploit Public-Facing Application technique to leverage CVE-XXXX-XXXX, causing the execution of arbitrary code on the victim’s machine. This facilitated the drop of the main payload in %APPDATA%\Roaming\Shadary\shadary.exe.
Execution & Persistence
Following the successful execution of the initial payload, we noted that the Shadary malware established persistence through several methods. The sample we examined created a registry entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Shadary, ensuring the implant would reload upon system restart. Moreover, a scheduled task was configured to execute the malware periodically under the SYSTEM context, significantly increasing the actor’s chances of evasion against security measures.
Command and Control
The Command and Control (C2) communications were carried out using an intricate network of domains leveraging dynamic DNS systems. The use of T1071.001 – Application Layer Protocol: Web Protocols was evident, as the malware communicated over HTTPS to hide its traffic amid legitimate web flows. The domains resolving to malicious-c2.dynamicdns.com were cycled frequently, presenting challenges in tracing the infrastructure back to the threat actors. Our investigation into the packet captures highlighted various C2 patterns, including periodic beacons every 15 minutes, indicating a standard operating procedure for exfiltrating data and receiving commands.
Lateral Movement & Discovery
Our analysis demonstrated that Shadary incorporated lateral movement strategies by leveraging T1021.001 – Remote Services: Remote Desktop Protocol. Post-compromise, the actor targeted machines within the internal network using stolen credentials harvested from the initial breach. Tools like Mimikatz were found to be utilized for credential dumping, enabling the adversary to navigate through the network with elevated privileges undetected. This detailed reconnaissance allowed the actor to map user roles and identify high-value targets for data exfiltration.
Impact & Objectives
The primary impact of the Shadary campaign appears rooted in data exfiltration and espionage. With the ability to move laterally across the network, the actor aimed to harvest sensitive information from various departments, leveraging internal resources such as email systems and shared drives. Analysts observed substantial data transfers, suggestive of the intent to siphon proprietary data and intellectual property. Given the strategic method of encoding and compressing data before exfiltration via the established HTTPS channels, the effect of this operation on operational integrity and future security posture cannot be understated.
MITRE ATT&CK Mapping
- T1203 – Exploit Public-Facing Application: Utilization of document exploits to execute malicious code.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Leveraging PowerShell for initial payload execution and subsequent command delivery.
- T1071.001 – Application Layer Protocol: Web Protocols: Establishing C2 communications over web protocols.
- T1021.001 – Remote Services: Remote Desktop Protocol: Facilitating lateral movement through RDP.
- T1003.001 – Credential Dumping: LSASS Memory: Using tools like Mimikatz to extract credentials.
Detection Opportunities
- Monitor for unusual registry modifications in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\that do not match known good configurations. - Implement DLP solutions to detect abnormal data exfiltration patterns, especially through HTTPS traffic.
- Correlate user logins with RDP sessions to identify anomalous lateral movement attempts.
Analyst Notes
This campaign exemplifies sophisticated attack methodologies that can compromise an organization through seemingly innocuous entry points. The ability of the actor to maintain persistence and conduct lateral movements underscores the necessity for advanced threat detection measures. Organizations should prioritize user education on phishing attacks, bolster endpoint protection, and enhance logging for suspicious activities to mitigate such threats.
Source: Original Report