Security researchers spotted a multi-pronged attack campaign that delivered a variant of the AZORult family along with other malicious payloads.
Cisco Talos learned of the AZORult-toting campaign after a telemetry entry revealed a process that involved the execution of a PowerShell loader. Upon closer examination, researchers determined that the PowerShell process came from an executable dropper contained within an ISO image. The attack instance observed by Cisco Talos downloaded a compressed version of the ISO image with ZIP onto the victim’s machine, a technique that indicates the attack likely originated from an email.
Once executed, the PowerShell loader installed the campaign’s malicious payloads and helped them achieve persistence. This loader behaved differently depending upon whether it had administrative privileges. In the event that it had these rights, it used its first URL to launch a Remcos remote access tool. Otherwise, this URL downloaded the DarkVNC remote-access tool. The campaign then loaded XMRigCC, a variant of an open-source cryptocurrency miner, before finally injecting an AZORult sample into the notepad.exe process.
A Busy Year for AZORult So Far
AZORult has been featured in numerous attack campaigns so far in 2020. Back in early February, for instance, SANS ISC detected a maldoc campaign that leveraged three layers of encryption to deliver a sample of the info-stealing malware family. About two weeks later, Kaspersky Lab spotted an attack in which malicious actors targeted Windows users with the Trojan via fake ProtonVPN installers.
Defend Against Attacks Abusing PowerShell
Security professionals can help their organizations defend against attacks that abuse PowerShell by disabling the use of this framework if there’s no business need for it. Companies should also consider implementing application whitelisting and restricting administrative access to only a necessary handful of machines to help curtail the spread of malware. Additionally, security teams should use a security information and event management (SIEM) tool and configure their solution to detect malicious PowerShell activity.