Ransomeware Attack (Redline)

Ransomeware Attack (Redline)

Tags

forensic

ID matched

Created

Apr 30, 2023 05:28 AM

Last Updated

Last updated July 15, 2023

1. 사전 준비 2. 풀이 참고

1. 사전 준비

Redline 다운로드

https://fireeye.market/apps/211364

메모리 덤프 다운로드 (비밀번호 321)

https://api.letsdefend.io/download/downloadfile/AnalysisSession.zip

2. 풀이

Q1. Please you find the dropped dll, include the whole path including the dll file

Process 상에서 수상한 프로세스 포착

notion image

File System에서 해당 파일 정보 확인하여 dll 목록 확인

notion image

의심 되는 MpsVc.dll의 해쉬값을 VirusTotal에서 검색

notion image

정답

C:\Users\charles\AppData\Local\Temp\MpsVc.dll

Q2. What is the MD5 hash for the dll?

dll 파일의 Details 창으로부터 해쉬값 확인

notion image

정답

040818b1b3c9b1bf8245f5bcb4eebbbc

Q3. What i s the name of ransomware note that got dropped?

바탕화면의 파일 목록 확인

notion image

정답

2s6lc-readme

Q4. What is the URL that the initial payload was downloaded fro m? (Include the whole URL with the payload)

Prefetch에서 수상한 lsass.exe 파일 확인

notion image

File Download History에서 주소 확인

notion image

정답

http://192.168.75.129:8111/Documents/lsass

Q5. The ransomware drops the copy of the legitimate application into the Temp folder. Please provide the filename including the extension

FileSystem에서 dll과 동일한 시간에 생성된 파일 확인

notion image

정답

MsMpEng.exe

Q6. What is name of the ransomware?

VirusTotal 정보로부터 이름 확인

https://www.virustotal.com/gui/file/0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402

정답

sodinokibi

참고

Getting Started to LetsDefend

Register to soc analyst/incident response training platform

Getting Started to LetsDefend

https://app.letsdefend.io/challenge/ransomware-attack

Getting Started to LetsDefend

LetsDefend's DFIR Challenge: Ransomware Attack Walk-Through - Cyber Gladius

A Walk-Through of the LetsDefend's DFIR Ransomware Attack Challenge!

LetsDefend's DFIR Challenge: Ransomware Attack Walk-Through - Cyber Gladius

https://cybergladius.com/letsdefends-dfir-challenge-ransomware-attack-walk-through/

LetsDefend's DFIR Challenge: Ransomware Attack Walk-Through - Cyber Gladius