The story of a real vishing attack: detailed incident walkthrough

NB: Not everything described in this blog may apply to your environment. If you need help, or want to add additional knowledge to this blog, feel free to reach out to our team here. For emergencies or anything urgent, please see the incident response page.

Digital forensics and incident response: uncovering ransomware traces with rapid and coordinated defence

For us, it all started with an alert, signalling the potential execution of a suspicious command through WMI (Windows Management Instrumentation). The concerned party contacted our Incident Response team for an investigation. While they believed their existing security solution had blocked the execution, we decided to take active measures to be sure. Victims should also contact their financial institution immediately after discovering a vishing attack to mitigate harm and secure compromised accounts.

To strengthen security measures, we quickly enrolled our own EDR solution and as a precaution, we immediately isolated the affected host from the network. This isolation restricted the machine’s internet access, in case the malware had successfully installed itself on the system.

Subsequently, we retrieved the malicious zip file the victim had downloaded. The zip file was encrypted with a password. The victim could only recall part of the password. We briefly attempted to ‘bruteforce’ the password, but quickly decided to change tack.

That said, we were able to list the contents of the zip file. Among the files, one stood out — ADExplorer.exe, a legitimate tool distributed by Microsoft. With this information, one of our analysts saw an opportunity to extract the contents of the zip file by using a known plaintext attack. By obtaining the original ADExplorer from Microsoft here, the incident responders could execute the following commands to retrieve the same zip file without an encryption:

zip AdExplorer64.zip AdExplorer64.exe
~/pkcrack/bin/extract AdExplorer64.zip AdExplorer64.exe AdExplorer64.plain
~/pkcrack/bin/pkcrack -C ../CITFIX#29.zip -c 'CITFIX#29/extra/ADExplorer64.exe' -p AdExplorer64.plain -d cracked.zip -a

We used the “pkcrack” tool for this part of the operation. Subsequently, a new zip file was created which had the password removed. This zip could be unpacked, which initiated an in-depth analysis of the malware. It became evident that ADExplorer had been employed to sideload the DLL within the zip file the victim downloaded and executed.

At a high level, insights from our malware analysis revealed that the client’s EDR solution had not completely stopped malicious actions. This finding was supported by the remaining signs of persistence on the compromised system and signs of execution of ‘recon’ commands. For instance, the prefetch artefacts clearly showed the execution of whoami.exe, net.exe and tasklist.exe.

As the .dll was heavily obfuscated, we executed the malware in a sandbox and saw that resmon.exe was being started and multiple pieces of shellcode were injected into this process. resmon is a nice target to spawn and inject to, as it appears to be bypassing the antimalware system interface (AMSI) on the Windows. Typically, attackers use perfmon.exe as a shellcode host these days, so seeing resmon is peculiar. By dumping the memory of resmon and using PEsieve, we uncovered an implant, written in C#, which is responsible for communication with the command and control domains (listed in the IOC section). The implant downloads additional payloads as .jpg files from the domains mentioned in the IOC section. These .jpg files are not real pictures, but contain for instance a payload that is executed for further reconnaissance.

PEsieve dumped the C# implants to disk, which allowed us to decompile them with tools such as dnSpy. This revealed yet another layer of obfuscation. By manually going through these files, we learned how the implant downloads, decrypts and executes the jpg payloads from the C2 server. The implant generates a GUID based on several characteristics of the system on which it runs. This is used to fetch the jpg. After decryption using TEA, the reconnaissance payload executes immediately, grabs a screenshot of the desktop and runs commands such as whoami, net and tasklist. Furthermore, it determines if the infected system is part of an Active Directory. If this is the case, it will attempt to query the LDAP server (usually the Domain Controller itself) and retrieves a list of domain administrators and domain computer, all of which are sent to the C2 server. Additional payloads were not observed, but since the attackers can run arbitrary code, anything is possible…

Mitigation and prevention: safeguarding your organisation against vishing attacks, ransomware and cybercrime

1. User awareness to spot vishing red flags and avoid divulging sensitive information

With vishing attacks, as with phishing, we know that humans are the weak spot – most of the time. Similarly to phishing, it’s best practice to create awareness about voice phishing techniques. This can be done by hiring a third party, or to organise sessions with your employees, to discuss how to recognise vishing calls and the implications of such attacks.

Scammers often use a follow up phone call to enhance the credibility of their schemes. By following up a phishing email with a phone call, attackers create a false sense of legitimacy for their malicious intent, making victims more susceptible to deception.

2. Have a policy in place

It is also advisable to establish a policy that employees must adhere to when receiving calls from the IT department. Protecting sensitive information, such as bank account details, is crucial to prevent scams. An authentication policy can help prevent such attacks in the future. Retail outlets, for example, can use the store number to verify, which is usually only known internally. For offices, a staff number can be used. The most common advice is: “If you do not trust it, look up the number yourself (not from the screen!) and call back.”

3. Managed Security Service Provider

As mentioned in previous blogposts, it is important for organisations to have a well-configured EDR solution, such as CrowdStrike Falcon or Defender for Endpoint (P2/Business). These solutions take action when malicious behaviour gets detectied. We have seen EDR tools block malicious actions, but follow-up by a human cyber expert is also necessary, as these tools are not always able to clean up perfectly. If you leave the alert ‘as is’ just because it was blocked, the threat may still exist and some artifacts may remain. In this case, the EDR missed the injection into resmon and the attackers had unfettered access to the system for several hours.

Attackers can also gain access to bank accounts through vishing, manipulating personal information to deplete victims’ finances.

Organisations should respond to alerts even if the execution was blocked. It is important to investigate what happened, how it occurred, how to prevent it and how to remove any remnants of the action/infection. This EDR product only cleared the infection afterwards, but leaving the persistance mechanisms in place. This was even worse as the product in place removed evidence and did not stop the threat. We recommend using an EDR solutions which also offers ‘raw’ telemetry, to give analysts additional insights behind the fact.

4. Access control

Tools like AppLocker can prevent end-users from executing programs without admin credentials. This provides an extra measure, since the adversary needs admin credentials to install his backdoor through vishing.

It’s also crucial to protect your social security number, as scammers often request this sensitive information to manipulate individuals or resolve issues without escalation.

Threat intelligence and IoC lists: the power of proactive defence

How do vishing attacks work?

Vishing attacks typically involve a combination of social engineering tactics and technology to trick victims into revealing sensitive information. Understanding the mechanics of these attacks can help individuals and organizations better protect themselves.