👽

Infection with Cobalt Strike (tshark)

sections

포렌식

1. 사전 준비

tshark 설치

networkminer 설치

https://www.netresec.com/?page=Blog&month=2014-02&post=HowTo-install-NetworkMiner-in-Ubuntu-Fedora-and-Arch-Linux

pcap 다운로드 (비밀번호 321)

https://files-ld.s3.us-east-2.amazonaws.com/5H42K.zip

2. 문제

Q1. Investigate the PCAP file, what is one of the popular document signing services used by the attacker to deliver the malware?

다음의 명령어로 정보 확인

정답

docusign

Q2. Investigate the PCAP file, what is the full URL used by the attacker to create the malicious document?

다음의 명령어로 정보 확인

다음의 명령어로 정보 확인

정답

http://ecofiltroform.triciclogo.com/swellheaded.php

Q3. On the malicious website from the previous question, what kind of encoding technique used by the attacker to create the malicious document?

networkminer를 통한 swellheaded.php 파일 내용 확인

정답

bas64

Q4. What is the name of the malicious document opened by the user?

다음의 명령어로 정보 확인

정답

0524_4109399728218.doc

Q5. After the user interacts with the malicious file, it runs malicious DLL on the system. What is the DLL run command?

JoeSandbox에서 0524_4109399728218.doc 검색하여, Full Report 확인

Automated Malware Analysis Report for 0524_4109399728218.doc - Generated by Joe Sandbox

Deep Malware Analysis - Joe Sandbox Analysis Report

https://www.joesandbox.com/analysis/854354/0/html

정답

hancitor

Q6. After the user interacts with the malicious file, it runs malicious DLL on the system. What is the DLL run command?

Process Tree에서 정보 확인

정답

rundll32.exe c:\users\[username]\appdata\roaming\microsoft\word\startup\ket.t,EUAYKIYBPAX

Q7. What is the C2 URL?

Malware Configuration에서 정보 확인

정답

http://euvereginumet.ru/8/forum.php

Q8. What is the URL that serves the payload?

다음의 명령어로 정보 확인

정답

http://gromber6.ru/6hjusfd8.exe

Q9. What is the name of the malware this payload links back to?

6hjusfd8.exe 파일의 MD5을 확보

JoeSandbox 검색

정답

Ficker Stealer

Q10. What is the popular hacking framework being used in this campaign?

다음의 게시물에서 정보 확인

Quick Malware Analysis: Hancitor, Ficker Stealer, Cobalt Strike, and NetSupport pcap from 2021-02-02

Thanks to Brad Duncan for sharing this pcap! https://www.malware-traffic-analysis.net/2021/02/02/index.html We did a quick analysis of this ...

https://blog.securityonion.net/2021/09/quick-malware-analysis-hancitor-ficker.html

정답

Cobalt Strike

Q11. What is the popular storage service used by the attacker to deliver the malware?

다음의 명령어로 정보 확인

정답

google docs

참고

Getting Started to LetsDefend

https://app.letsdefend.io/challenge/port-scan-activity

PREVPort Scan Activity (tshark)