Collect, Exfiltrate, Sleep, Repeat

Two sentences summarizing the intrusion: An August 2022 incident began with a malicious Word document carrying a VBA macro that installed a PowerShell-based implant, established persistence via scheduled tasks, and used a renamed AutoHotkey-based keylogger to collect and exfiltrate data over an encrypted C2 channel. Attribution points to OilRig/TA452 Iranian threat actors, with activity occurring overnight and involving targeted malware tooling rather than common commodity loaders. Hashtags: #OilRig #TA452 #ApplyForm #AutoHotkey #PowerShell #Lumen

Keypoints

The intrusion started with a malicious Word document containing a VBA macro prompting macro enablement to run.
A VBA macro created multiple scripts (Updater.vbs, Script.ps1, temp.ps1) and pleaded persistence via a scheduled task, with the implant written entirely in PowerShell.
The threat actor used a renamed AutoHotkey binary (module.exe) to execute a PowerShell/AHK-based keylogger (module.ahk) and scheduled tasks to run it.
Discovery was performed via PowerShell cmdlets and built-in Windows utilities (e.g., whoami, net, tracert) with targeted LDAP domain account enumeration using Convert-LDAPProperty.
Data collected by the keylogger and discovery steps was compressed (makecab) and exfiltrated over the C2 channel, which used AES-CBC encryption.
C2 communications showed GET/POST patterns to a remote host (45.89.125.189), with multiple stages of PowerShell scripts coordinating exfiltration and commands.

MITRE Techniques

[T1566.001] Spearphishing Attachment – The intrusion began with a malicious macro embedded in a Word document. “The intrusion began with the execution of a malicious macro within a Word document.”
[T1059.005] Visual Basic for Applications – The attack used a VBA macro embedded in Word to drop and run additional components. “The intrusion began with the execution of a malicious macro within a Word document.”
[T1059.001] PowerShell – The implant was fully implemented in PowerShell and used Script.ps1/temp.ps1 to drive actions. “The implant was fully implemented using PowerShell.”
[T1053.005] Scheduled Task/Job – Persistence via scheduled tasks was created to execute components (Updater.vbs, Script.ps1). “installed persistence through a scheduled task.”
[T1112] Modify Registry – The keylogger used a registry key (UpdateReg) to store keystroke data. “registry key is where the keylogger saved captured keystrokes.”
[T1113] Screen Capture – The attacker captured desktop screenshots with a PowerShell-based script (sc.ps1). “sc.ps1 contains PowerShell code to capture a screenshot of the system.”
[T1056.001] Keyboard Input Capture (Keylogging) – The keylogger components include module.exe (renamed AutoHotkey) and module.ahk. “The keylogger itself was comprised of an executable, module.exe, which was a renamed AutoHotkey binary.”
[T1560.001] Archive Collected Data – Keystroke logs and discovery data were compressed (makecab) before exfiltration. “makecab …”
[T1573.001] Encrypted Channel – C2 communications encrypted (AES-CBC) between victim and server. “AES encrypted PowerShell command example:”
[T1071.001] Web Protocols – C2 traffic used HTTP GET/POST to a remote host. “ET MALWARE TA452 Related Backdoor Activity (GET)/(POST)”; “First communication to the C2 … get”
[T1082] System Information Discovery – Discovery included system info checks (Get-ComputerInfo, Defender status). “Get-ComputerInfo | out-string” and “Get-MpComputerStatus”
[T1069.002] Domain Account Discovery – LDAP-based domain account enumeration via Convert-LDAPProperty. “retrieve information on domain accounts.”
[T1033] System Owner/User Discovery – Enumerated current user context (whoami, environment variables). “Get information on current user” and “ls $env:temp”
[T1049] System Network Connections Discovery – Network discovery via Get-NetTCPConnection. “Get-NetTCPConnection | Out-String”
[T1083] File and Directory Discovery – Enumerated files and directories (Get-ChildItem …). “Enumerate files”
[T1112] Modify Registry (again, for keylogger data storage) – see above
[T1110] Keylogging (additional mapping) – captures keystrokes to logFileuyovaqv.bin (XOR encoded). “The readkey.ps1 file grabbed the keystrokes from the KeypressValue registry key, XOR’s the data…”

Indicators of Compromise

[IP] 45.89.125.189 – C2 server endpoint used for GET/POST communications (first C2 contact). – 45.89.125.189/get, 45.89.125.189/put
[File hash] 9a7d5f126904adc194df4dcbc2c5715c, a86088cf31c72cc4648ee8dfa082979a74044203 – Hashes associated with components listed in the activity, with 2 more hashes.
[File name] Updater.vbs, Script.ps1 – Files dropped/injected as part of the scheduled task → PowerShell chain.
[URL] http://45.89.125.[.]189/get – C2 beacon URL observed in network traffic.