Mike Torres — Incident Response Specialist
Key Takeaways
- The recent malware campaign employs a sophisticated dropper utilizing T1071.001 – Application Layer Protocol: Web Protocols to communicate with its command and control (C2) server.
- Our investigation revealed the actor’s use of T1071.001 for mimicking legitimate HTTPS traffic to evade detection and maintain persistence.
- Indicators of compromise (IOCs) include unique hash values and specific registry modifications associated with the malicious payload.
Executive Summary
During our analysis of a recent malware incident impacting several financial institutions, we observed a highly orchestrated attack involving multifaceted tactics to establish and maintain control over victim systems. This malware campaign is characterized by a well-defined attack chain, utilizing a custom-designed dropper to deploy the main payload and subsequently establish a robust C2 infrastructure. Our analysis focuses on the techniques employed by the attacker, illuminating the intricate methods by which they achieve lateral movement and data exfiltration.
Initial Access
The breach initially occurred through a phishing email campaign, which distributed a malicious document. This document exploited a T1203 – Exploit Public-Facing Application vulnerability in Microsoft Office applications. When users opened the document and enabled macros, the macro invoked a PowerShell script that facilitated the download of the dropper from a remote server. The dropper, identified as Downloader.XYZ, then executed an initial payload targeting the Windows environment.
Execution & Persistence
Once executed, the dropper extracted the primary malware component, embedding it into the user’s system at the path C:\Users\Public\Documents\ServiceUpdater.exe. This executable is designed to run at startup, achieving persistence through the modification of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, inserting a value that points to the malware’s location. This persistence mechanism allowed the implant to remain active even after system reboots.
Command and Control
Our analysis revealed that the implant establishes a silent connection back to a C2 server using T1071.001 – Application Layer Protocol: Web Protocols. The implant generates encrypted HTTP requests, embedding exfiltrated data in HTTPS packets to evade network detection systems. This communication pattern includes periodic beacons that send system information and status updates to the C2, leveraging a rotating domain strategy to maintain connection resilience.
Lateral Movement & Discovery
After establishing a foothold, the actor attempted lateral movement through T1557 – Adversary-in-the-Middle techniques, gaining access to administrative credentials stored in local sessions. Utilizing those credentials, the implant sought access to additional workstations. We identified evidence of the actor leveraging Windows Management Instrumentation (WMI) to enumerate network shares and extract sensitive information from neighboring machines, indicating a broad intent to compromise an entire network segment.
Impact & Objectives
The campaign’s primary objective appeared to be the exfiltration of personally identifiable information (PII) and financial credentials from the targeted institutions. Our analysis identified attempts to gather sensitive data from local databases, as well as screenshots and keylogging capabilities to capture user credentials dynamically. The impact extends beyond immediate data theft; the potential long-term effects on customer trust and financial losses could be substantial, possibly extending into regulatory penalties.
MITRE ATT&CK Mapping
- T1203 – Exploit Public-Facing Application: The campaign’s initial access vector involved exploiting vulnerabilities in Microsoft Office applications.
- T1071.001 – Application Layer Protocol: Web Protocols: The malware communicated with its C2 server over HTTPS, utilizing legitimate web traffic patterns to blend in.
- T1557 – Adversary-in-the-Middle: The attacker utilized positional information within the network to facilitate lateral movement.
Detection Opportunities
- Monitor network traffic for unusual outbound connections to newly registered domains, especially those exhibiting HTTPS traffic patterns.
- Implement behavioral analysis to detect unauthorized changes to the registry keys typically associated with startup persistence methods.
- Utilize endpoint detection solutions to identify PowerShell executions or script invocations, especially those triggered by document macro actions.
Analyst Notes
This malware incident underscores the need for enhanced email security protocols and user education on the dangers of phishing attacks. Given the sophistication of the dropper and its ability to communicate covertly through encrypted traffic, organizations should consider extensive monitoring capabilities to detect anomalies indicative of such persistent threats. Our ongoing research is focused on further unpacking the C2 mechanisms employed and developing preventive measures based on findings from this investigation.
Source: Original Report