Malware Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor

Summary

The Larva-24009 threat actor is running phishing campaigns against enterprises worldwide, including organizations in South Korea. The attacks use LNK files to launch obfuscated PowerShell scripts that install backdoors and remote access tools. The adversary focuses on credential theft, screenshot capture, and keylogging to collect and exfiltrate sensitive user data.

Investigation

The investigation uncovered a multi-stage infection chain beginning with phishing emails containing decoy documents and malicious LNK files. Analysts observed PowerShell being used for persistence and scheduled task creation, followed by the deployment of QuasarRAT and UltraVNC. The threat actor also abuses NirSoft utilities for automated system reconnaissance and the Telegram API to report successful infections.

Mitigation

Organizations should treat email attachments and executable files from unknown or unverified sources with extreme caution. Security software, including V3, should be updated regularly to detect known malware signatures. Enforcing strict PowerShell execution policies and monitoring Task Scheduler for suspicious or unauthorized entries can further reduce exposure.

Response

If Larva-24009 activity is detected, affected systems should be isolated immediately to limit lateral movement and further data exfiltration. Responders should examine scheduled tasks and registry changes for persistence mechanisms. Network logs should also be reviewed for connections to known C2 infrastructure and signs of unauthorized RDP or UltraVNC sessions.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access and seeks to establish persistence/execution using a shortcut file. The attacker creates a malicious .lnk file that, when clicked, invokes powershell.exe. To evade simple string-based detection, the command uses the -EncodedCommand parameter. The command is designed to look like it is interacting with a decoy file in the %TEMP% directory to blend in with system noise. The target telemetry is a process creation event where powershell is the process, -EncodedCommand is present, and %TEMP% or .lnk is part of the argument string.

• Regression Test Script:

  # Simulation script to trigger the detection rule
  # 1. Define the malicious payload (Base64 encoded 'Write-Host "Infiltration Successful"')
  $payload = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("Write-Host 'Infiltration Successful'"))
  
  # 2. Construct the command line that matches the detection logic:
  # Contains 'powershell', '-EncodedCommand', and '%TEMP%'
  $commandLine = "powershell.exe -EncodedCommand $payload -File $env:TEMPdecoy_script.lnk"
  
  # 3. Execute the command to generate the telemetry
  Start-Process "powershell.exe" -ArgumentList "-EncodedCommand $payload -File $env:TEMPdecoy_script.lnk" -WindowStyle Hidden

• Cleanup Commands:

  # Remove any files created during the simulation
  Remove-Item -Path "$env:TEMPdecoy_script.lnk" -ErrorAction SilentlyContinue