Skip to content

2018-11-13-traffic-analysis-exercise-turkey-and-defense.md

Latest commit

 

History

History
38 lines (30 loc) · 2.74 KB

2018-11-13-traffic-analysis-exercise-turkey-and-defense.md

File metadata and controls

38 lines (30 loc) · 2.74 KB
Raw

2018-11-07 - TRAFFIC ANALYSIS EXERCISE - TURKEY AND DEFENCE

Executive Summary

On 2018-11-07, an infected Windows host (10.22.15.119 / Danger-Win-PC) was observed communicating with malicious infrastructure. The activity is consistent with the execution of a malicious executable file, which was downloaded and executed on the host. The primary Command and Control (C2) candidate identified includes shumbildac.com.

Affected Host

  • IP Address: 10.22.15.119
  • MAC Address: 00:11:2f:d1:6e:52
  • Hostname: Danger-Win-PC
  • User Account Observed: carlos.danger

Evidence and Methods

All findings were derived from the analysis of 2018-11-07-traffic-analysis-exercise.pcap and the associated suricata alerts file using Wireshark and tshark filters and aggregation.

1. Malicious Activity Start Time

  • Method: Reviewed the alerts file to identify the start time of malicious activity.
  • Result: The alerts file indicates that malicious activity started on 2018-11-07 at 20:47 UTC.

2. Host MAC and Hostname Identification (DHCP)

  • Method: Filtered DHCP traffic for the IP address 10.22.15.119 using bootp.ip.client==10.22.15.119.
  • Result: The MAC address 00:11:2f:d1:6e:52 and hostname Danger-Win-PC were identified for the IP address 10.22.15.119.

3. User Account Identification (Kerberos)

  • Method: Filtered Kerberos traffic from the IP address 10.22.15.119 using ip.src == 10.22.15.119 && kerberos.CNameString.
  • Result: The Kerberos authentication requests revealed the following accounts:
    • Computer account: danger-win-pc$
    • User account: carlos.danger

4. Malicious File Identification (HTTP)

  • Method: Filtered HTTP traffic to identify the download of the malicious executable file using ip.dst==10.22.15.119 && http contains "MZ" && http contains "DOS".
  • Result: The following unique file was observed:
    • ngul5.xap (439,808 bytes)
  • Analysis: The file ngul5.xap was downloaded from shumbildac.com/WES/fatog.php?l=ngul5.xap. The size of the EXE file is 439,808 bytes. The SHA256 hash of the EXE file is 97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71. The type of malware is Ursnif or Gozi/IFSB (as derived from VirusTotal).

Timeline (derived from suricata alerts and pcap analysis)

  • 2018-11-07 20:47 UTC: A malicious document (MalDoc) requests a payload from 46.29.160.132 and the file ngul5.xap is downloaded from shumbildac.com/WES/fatog.php?l=ngul5.xap.
  • 2018-11-07 20:48 UTC: The malware sends command and control (CnC) beacons to 192.162.244.171.
  • 2018-11-07 20:49 UTC - 21:20 UTC: Multiple detections of malicious SSL certificates from sources 95.181.198.115 and 46.229.214.92.