Sarah Chen — Malware Reverse Engineer
Key Takeaways
- The analyzed stealer malware employs Credential Dumping techniques to harvest sensitive information.
- Our investigation revealed a complex Command and Control infrastructure utilizing both HTTP and DNS tunneling.
- The actor displayed sophisticated Lateral Movement tactics, leveraging Windows Admin Shares and remote execution tools.
Executive Summary
During our analysis of the latest stealer malware, we uncovered a detailed operational framework employed by the threat actor. This malware, designed for extensive data exfiltration, demonstrates heightened sophistication in both its delivery mechanism and its evasion techniques. By tracing the malware’s path—from initial access through to impact—we gathered insights that reveal the actor’s methodologies and objectives, highlighting the need for robust detection measures.
Initial Access
The infection chain began with a phishing campaign targeting employees of a mid-sized financial organization. We observed that the actor utilized highly customized email templates containing malicious attachments masquerading as financial documents. The attachments were crafted in such a way that opening them would drop a .NET-based dropper, leading to the installation of the primary stealer payload. This aligns with the Phishing technique, categorized as T1566 in the MITRE ATT&CK framework. Upon execution, the dropper saved the embedded payload to %APPDATA%\Local\Temp\ and initiated the execution sequence.
Execution & Persistence
Post-execution, our analysis revealed that the stealer employed a multi-faceted persistence strategy. It created a scheduled task using the Windows Task Scheduler to ensure its execution on system startup. The task was registered under the name SystemUpdateTask, and it pointed to the payload located at %APPDATA%\Local\Temp\stealer.exe. Further examination indicated that the malware also made modifications to the registry, specifically creating a new key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ to achieve persistence. This behavior aligns with the Registry Run Keys / Startup Folder technique, classified as T1060.
Command and Control
The Command and Control (C2) setup employed by the malware was particularly intricate. The sample we examined communicated through a multi-layered structure involving both HTTP and DNS. At first glance, the traffic appeared benign, frequently masquerading as legitimate web traffic to evade network detection measures. We identified multiple domains resolving to dynamic IP addresses, which we believe were used for load balancing among the actors’ servers. The primary C2 domain was discovered to be example-c2.com, which was frequently updated to maintain the operational integrity of the malware. Our analysis of the DNS queries indicated the use of DNS tunneling techniques, further complicating detection capabilities. This corresponds with the Application Layer Protocol technique, noted as T1071.
Lateral Movement & Discovery
During the investigation, we traced lateral movement tactics that raised various flags. The malware incorporated built-in functionalities that enabled it to perform Credential Dumping using tools like Mimikatz to harvest credentials from memory. We noted the presence of command invocations targeting lsass.exe, resulting in a rapid and scalable means to gather user credentials. Additionally, the actor employed Windows Admin Shares to facilitate lateral movement across the network. The commands executed involved net use to establish connections to accessible shares on other machines within the environment. This behavior aligns with the Lateral Movement technique, categorized as T1021, specifically T1021.001 – Remote Services: SMB/Windows Admin Shares.
Impact & Objectives
The ultimate goal of the actor appeared to be comprehensive data exfiltration aimed at gathering sensitive user information, including personal identifiable information (PII) and financial data. Throughout our investigation, we discovered that the malware actively sent stolen data back to the C2 server in encrypted format, making it particularly challenging for traditional detection mechanisms to identify. Additionally, the sheer volume of data processed suggested that the actor planned for a wider attack campaign following initial reconnaissance. The exfiltration was confirmed through various network logs containing patterns consistent with the Exfiltration Over Command and Control Channel technique, marked as T1041.
MITRE ATT&CK Mapping
- T1566 – Phishing: The malware was delivered via a phishing email containing a malicious attachment.
- T1060 – Registry Run Keys / Startup Folder: The malware created registry entries to ensure persistence.
- T1071 – Application Layer Protocol: The malware used HTTP and DNS for C2 communication.
- T1021.001 – Remote Services: SMB/Windows Admin Shares: The actor utilized Windows shares for lateral movement.
- T1041 – Exfiltration Over Command and Control Channel: The malware exfiltrated data back to the C2 server.
Detection Opportunities
- Monitor for unusual registry changes, specifically in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\. - Implement alerts on scheduled task creations that do not conform to baseline behavior.
- Deploy network monitoring to catch anomalous DNS traffic patterns indicating potential tunneling attempts.
Analyst Notes
This investigation underscores the importance of a multi-layered threat defense strategy that combines user education on phishing, robust endpoint detection and response capabilities, and thorough monitoring of network traffic. Given the sophistication of the actor, continuous adaptation and vigilance are crucial in mitigating risks posed by emerging threats of this nature. Enhanced visibility and response capabilities are essential to protect sensitive data within any organization.
Source: Original Report