Malware Traffic analysis Exercise
SCENARIO:
•
LAN segment range: 10.1.21.0/24 (10.1.21.0 through 10.1.21.255)
Domain: wokemountain.com
Domain Controller: WokeMountain-DC
LAN segment gateway: 10.1.21.1
LAN segment broadcast address: 10.1.21.255
TASK:
• Write an incident report based on the pcap and alerts.
• The incident report should contain the following:
• Executive Summary
• Details (of the infected Windows host)
• Indicators of Compromise (IOCs)
ANSWERS:
Executive Summary
On 2021–01–20 at 23:40 UTC, a Windows host used by Orlando McCoy
was infected with Ursnif (Gozi/ISFB) malware.
Details
MAC address: 00:60:67:d3:47:8b
IP address: 10.1.21.101
Host name: DESKTOP-NB72TZA
Windows user account: orlando.mccoy
Looking at interesting HTTP traffic:
(http.request or tls.handshake.type eq 1) and !(ssdp)
Follow the stream:
Go to show data as : Raw
Then save as.
Upload the file to a hex editor of your choice.
Find the part in the text that has MZ, this part indicates is an EXE or DLL
Once you have the binary opened in a hex editor, just select everything before
the first two bytes of the malware EXE or DLL file, represented by the characters
MZ after the HTTP response header. Delete that section of your exported binary,
then save the updated file.
From there, you can submit the file to VirusTotal to confirm it is malware and a
DLL. Here’s what I found when I did it:
https://www.virustotal.com/gui/file/236491cfe870f6b374d80e427ef8f8bfbf24f50d4
029128b001d95c8c90845cb/details
Finding the Host info:
Get "CyberGuard: Malware and Vulnerabilities Analysis"’s stories in your inbox
Join Medium for free to get updates from this writer.
ip.addr == 10.1.21.101 && kerberos && tcp.port == 88
Then I pivoted to statistics and conversations, look at the IPs with the most communications to the victim.
I ran some of this IPs in virus total and some positives results came showing as below.
A bit of knowledge on further findings on network activity.
MITRE ATT&CK tactics and techniques. Here’s how they align:
1. **DRSUAPI (Directory Replication Service Remote Protocol):**
— MITRE ATT&CK Tactics:
— Initial Access (e.g., exploiting vulnerabilities in DRSUAPI for initial compromise)
— Credential Access (e.g., using tools like Mimikatz to extract credentials from memory)
— Lateral Movement (e.g., leveraging compromised credentials to move laterally within an Active Directory environment)
2. **DCERPC (Distributed Computing Environment Remote Procedure Call):**
— MITRE ATT&CK Tactics:
— Initial Access (e.g., exploiting vulnerabilities in DCERPC services)
— Execution (e.g., using DCERPC for remote code execution)
— Credential Access (e.g., capturing credentials passed over the network)
— Lateral Movement (e.g., moving laterally using compromised systems)
3. **EPM (Endpoint Mapper):**
— MITRE ATT&CK Tactics:
— Discovery (e.g., using EPM to discover available RPC services)
— Lateral Movement (e.g., exploiting weaknesses in EPM to facilitate lateral movement between systems)
4. **RPC_NET (Remote Procedure Call Network):**
— MITRE ATT&CK Tactics:
— Initial Access (e.g., exploiting vulnerabilities in RPC_NET services)
— Execution (e.g., using RPC_NET for remote code execution)
— Credential Access (e.g., intercepting credentials passed over RPC_NET)
— Lateral Movement (e.g., using RPC_NET for lateral movement between systems)
These are just a few examples, and the actual tactics and techniques may vary depending on the specific vulnerabilities and attack vectors present in each service.
Indicators of Compromise (IOCs)
• 209.141.51.196 port 80–209.141.51.196 — GET /Lk9tdZ
• 209.141.51.196 port 80–209.141.51.196 — GET /files/1.bin
• 185.186.244.130 port 80 — greatewallfirewall.xyz — GET /postfix/[long
base64 string with backslashes and underscores].yml
• port 53 — IP address check to myip.opendns.com
• 162.0.224.165 port 80–162.0.224.165 — GET /grab32.rar
• 193.239.84.250 port 443 — [no domain] — HTTPS/SSL/TLS traffic
• 193.239.84.250 port 443 — booloolo3.com — HTTPS/SSL/TLS traffic
• 84.252.95.102 port 443 — [no domain] — HTTPS/SSL/TLS traffic
• 84.252.95.102 port 443 — booloolo4.com — HTTPS/SSL/TLS traffic
SHA256 hash: 236491cfe870f6b374d80e427ef8f8bfbf24f50d4029128b001d95c8
c90845cb
• File size: 340,824 bytes
• File location: http://209.141.51.196/files/1.bin
• File description: malware DLL file associated with Ursnif (Gozi/ISFB)
Thanks for Tuned in until next time!
