Mike Torres — Incident Response Specialist
Key Takeaways
- Blazing Star utilizes sophisticated phishing techniques combined with malicious document exploits for initial access.
- The malware employs advanced persistence mechanisms, utilizing registry modification and scheduled tasks.
- Command-and-control communications are obfuscated through HTTPS traffic, complicating detection efforts.
Executive Summary
During our analysis of the Blazing Star malware, we observed a meticulously orchestrated attack chain characterized by its use of phishing emails to deliver malicious Office documents. This served as the initial access vector, leveraged by the actor to deploy and establish their foothold within the victim’s environment. The payload employed several evasive tactics to ensure longevity and concealment while communicating with command and control (C2) servers over encrypted channels.
Initial Access
The attack began with a carefully crafted phishing email designed to entice users into enabling macros in a malicious Word document. Our investigation revealed that the document played on social engineering to appear as a legitimate invoice, utilizing a convincing format. Once the document was opened and macros were enabled, an embedded Visual Basic for Applications (VBA) script executed, downloading the Blazing Star implant from a remote server.
Execution & Persistence
The initial payload was a lightweight dropper that extracted the main executable of the Blazing Star malware to the local filesystem. Our analysis identified the dropped file located at C:\Users\Public\Documents\invoice.exe, often masquerading as a legitimate business application. Upon execution, the implant established persistence by modifying registry keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, creating a value called InvoiceApp to ensure the malware runs upon user login.
Command and Control
The implant initiated outbound connections to a C2 server using HTTPS. By analyzing network traffic, we noted patterns indicative of obfuscated commands being sent and received. The malware communicated with the command center at https://example-c2.domain.com, employing certificate pinning and encrypted payloads to avoid detection by standard traffic analysis tools. This level of sophistication made it difficult for network defender tools to flag the suspicious activity, as it blended with legitimate traffic.
Lateral Movement & Discovery
Once established, the Blazing Star implant began lateral movement techniques, utilizing T1075 – Pass the Hash to traverse the network. We observed attempts to access shared resources on neighboring machines by leveraging hashed credentials stored within memory. The implant also engaged in reconnaissance activities (e.g., executing net view and net user commands) to map out the internal network landscape and identify potential targets.
Impact & Objectives
The objectives of the attack appeared to focus on data exfiltration and the potential lateral movement towards sensitive infrastructure. Through our telemetry, we detected attempts to access email accounts and shared network drives, indicating the actor’s goal was to harvest credentials and intellectual property. The impact of such malware can ripple throughout an organization, risking not only data loss but also significant operational downtime if remediation efforts are not swift.
MITRE ATT&CK Mapping
- T1566 – Phishing: The actor used spear-phishing emails to deliver a malicious payload.
- T1071.001 – Application Layer Protocol: Web Protocols: The implant used HTTPS for C2 communication.
- T1086 – PowerShell: Execution of PowerShell scripts embedded within the malicious document.
- T1035 – Service Execution: Malicious service created to maintain persistence.
Detection Opportunities
- Monitor for unusual registry changes under
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Inspect email logs for signs of phishing attempts and suspicious attachments.
- Analyze outbound traffic for encrypted connections to unknown domains, focusing on anomalies in user behavior.
Analyst Notes
The Blazing Star campaign serves as a reminder that modern attacks continue to evolve, with actors adapting and optimizing their strategies to evade detection. Continuous monitoring and adapting defenses to these methodologies is essential for enhancing security posture. By focusing on behavioral detection and anomaly-based monitoring, organizations can significantly improve their resilience against such advanced threats.
Source: Original Report