{"id":1437,"date":"2022-01-09T21:50:41","date_gmt":"2022-01-09T21:50:41","guid":{"rendered":"https:\/\/www.herbiez.com\/?p=1437"},"modified":"2022-01-11T03:47:57","modified_gmt":"2022-01-11T03:47:57","slug":"2022-01-09-first-round-with-brim-using-decembers-malware-traffic-exercise","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=1437","title":{"rendered":"2022-01-09 First Round with Brim Using December’s Malware Traffic Exercise"},"content":{"rendered":"

It has been a long while since I have done any blogging. Since it has been a hot minute since I have done a post I thought that I would take this opportunity to learn something new and expand my tool-belt. So this first step back into the blogging world is going to be about a tool called Brim<\/a> using the latest malware exercise from Brad found over at his site here<\/a> and the SANS site here<\/a>. So let’s start with what Brim is – a tool that helps visualize PCAP data in a different way with WAY<\/strong> faster indexing then Wireshark. It also uses it’s own query language called “Zed” while also using some of the same tools found from the *nix world. The interesting part is how it uses Zeek and it’s nomenclature\/syntax as well. There is a great video covering the basics of Brim over on their Github page<\/a>\u00a0which you can find here: Brim YouTube<\/a>.<\/p>\n

So here is what the PCAP from the exercise looked like when first moving it into Brim.<\/p>\n

\"\"<\/a><\/p>\n

Looking at this, it immediately reminded me of looking at Bro\/Zeek raw logs since it is just a LOT<\/strong> of information all at one (aka: wall of text). Nice thing is that you can toggle the headers in the Brim app (I have it on auto to help save screen real-estate) which makes the data easier to read. The other nice thing is that you can see where a bulk of the activity is and, if needed, focus during that time frame.<\/p>\n

\"\"<\/a><\/p>\n

With that being said, I focused on the questions that were asked from this exercise while not relying on Wireshark to look\/hunt for the answers. The questions asked were:<\/p>\n

- What was the IP address of the infected Windows computer?
\n- What was the host name of the infected Windows computer?
\n- What was the user account names from the infected Windows computer? (should be \"name\" not \"names\")
\n- What was the date and time the infection activity began?
\n- What was the family of malware that caused this infection.<\/code><\/strong><\/p>\n

<\/a><\/p>\n

With the initial screen up, I wanted to get an idea of what kind<\/em> of data I was dealing with and where<\/em> it was. So I started with the following query to help me understand what paths (in my head I think of these like indexes or perhaps sourcetypes from Splunk).<\/p>\n

count() by _path | sort -r<\/code><\/strong><\/p>\n

This query let me know what the spread looked like from a data perspective and where I may needed to focus my hunt. The other query that I stumbled across stemmed from the Suricata queries built into Brim. The query used here was very much in the same vein of just getting the lay of the land, but from Suricata’s perspective.<\/p>\n

count() by event_type<\/code><\/strong><\/p>\n

\"\"<\/a><\/p>\n

Seeing that Suricata saw “alerts” in the PCAP, I decided to drill down some here. For that I used the generic query of: alert<\/code><\/strong><\/p>\n

Here I saw that there were a mix of event-types between “alerts” and “SSL”. After looking at the SSL event-type, I decided that there was nothing there and that I did not need to focus any more there. So I changed the query to:<\/p>\n

event_type==\"alert\"<\/code><\/strong><\/p>\n

to help narrow and focus my hunt. Here is where I started really investigating things since I could easily look at the different Suricata alert signatures triggered on while also easily seeing what the timestamp was for said alert. Considering the amount of data presented, I used this query to quickly help summarize what I was seeing from the above query:<\/p>\n

event_type==\"alert\" | count() by alert.severity,alert.category,alert.signature,alert.signature_id,alert.rev | sort -r count<\/code><\/strong><\/p>\n

This query allowed me to summarize\/count the data for “alert” since I was counting by the sev level, category, signature, and the signature revision.<\/p>\n

\"\"<\/a><\/p>\n

This helped me answer the question of what type of malware was used in this infection. In this case, it looks to be Emotet\/Dridex<\/strong>.<\/p>\n

Switching back to the event_type==\"alert\"<\/code><\/strong> query, and scrolling all the way down to the earliest alert, I saw what looks to be the start of the compromise (between 19:42:00 – 19:43:00 timeframe<\/strong>) along with what I saw above – the family of malware associated with this infection.<\/p>\n

\"\"<\/a><\/p>\n

I could also tell what the IP address of the compromised system was (10.12.3.66<\/strong>) and that there was a binary file that was seen in the PCAP as well as PoSH being used via the user-agent right before this binary file. Looking at the log detail for the binary that was downloaded:<\/p>\n

\"\"<\/a><\/p>\n

I decided to take a quick look at where else these malicious IP addresses was seen in the PCAP. The query used for this was 139.59.6.175<\/code><\/strong> which gave me the following information.<\/p>\n

\"\"<\/a><\/p>\n

Right clicking on one of the hashes and then clicking on the “Virustotal Lookup” option in the pop-up menu lead me to the Virustotal page<\/a> where the file was classified as “Dridex\/Emotet”. The IP address seen with this binary came up clean on Virustotal and several other OSINT sites via Machinae.<\/p>\n

\r\n********************************************************************************\r\n* Information for 139.59.6.175\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites&amp;amp;amp;amp;amp;amp;lt;\/code&amp;amp;amp;amp;amp;amp;gt;\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('14061', '139[.]59.0.0\/20', '1990-06-27', 'apnic', 'SG')\r\n[-] Network Information: ('139[.]59.0.0\/20', 'DOIA2-AP', 'Digital Ocean Inc administrator', '139[.]59.0.0 - 139[.]59.15.255')\r\n[-] Registration Info: ('DigitalOcean, LLC', '2020-05-31')\r\n[-] Registration Locality: IN\r\n[-] Abuse Email: abuse@digitalocean[.]com\r\nabuse@digitalocean[.]com\r\n[+] IPVoid Results\r\n[-] Number of detections: 0\r\n[-] IP Void Detection Rate: 0%\r\n[-] No Malc0de Results\r\n[-] No AbuseIPDB Results\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/139.59.6.175\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/139.59.6.175\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Not Rated\r\n[-] No VirusTotal pDNS Results\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n<\/pre>\n
One of the only places that I was able to find anything was on URLScan<\/a>.<\/p>\n
Looking at some of the other alerts from this query and drilling in, I wanted to first see what IP addresses were associated with each of the Dridex alerts skipping the SMTP ones as Emotet has, historically, used compromised systems to send out malspam which I suspect this is more of the same. So I will circle back to that later.<\/p>\n
ET JA3 Hash - [Abuse.ch] Possible Dridex
\nET CNC Feodo Tracker Reported CnC Server group 17
\nET CNC Feodo Tracker Reported CnC Server group 18
\nET CNC Feodo Tracker Reported CnC Server group 23
\n<\/code><\/p>\n
Using the following query I was able to pull these with relative ease:<\/p>\n
\"ET JA3 Hash - [Abuse.ch] Possible Dridex\" | count() by dest_ip,dest_port
\n\"ET CNC Feodo Tracker Reported CnC Server group 17\" | count() by dest_ip,dest_port
\n\"ET CNC Feodo Tracker Reported CnC Server group 18\" | count() by dest_ip,dest_port
\n\"ET CNC Feodo Tracker Reported CnC Server group 23\" | count() by dest_ip,dest_port
\n<\/code><\/p>\n
Leaving me with the following IP addresses (merged for ease of readability):<\/p>\n
CNT - IP : Dest_Port
\n-------------------
\n26 - 172.104.227.98 : 443
\n6 - 163.172.50.82 : 443
\n18 - 91.207.181.106 : 8080
\n1 - 51.159.35.157 : 443
\n1 - 51.75.33.120 : 443
\n1 - 91.207.181.106 : 8080
\n<\/code><\/p>\n
Machinae gave me back the following details about these IPs:<\/p>\n
\r\n********************************************************************************\r\n* Information for 172.104.227.98\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites&amp;amp;amp;amp;amp;amp;lt;\/code&amp;amp;amp;amp;amp;amp;gt;\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('63949', '172[.]104.224.0\/19', '2015-06-19', 'arin', 'US')\r\n[-] Network Information: ('172[.]104.0.0\/15', 'NET-172-104-0-0-1', 'LINODE-US', '172[.]104.0.0 - 172[.]105.255.255')\r\n[-] Registration Info: ('Linode', '2015-06-19', '2016-12-29')\r\n[-] Registration Locality: ('Philadelphia', 'PA', '19106', 'US')\r\n[-] Abuse Email: abuse@linode[.]com\r\n[-] Tech Email: support@linode[.]com\r\n[+] IPVoid Results\r\n[-] Number of detections: 5\r\n[-] IP Void Detection Rate: 6%\r\n[-] Engines: ('CRDF', '(hXXps):\/\/threatcenter[.]crdf[.]fr\/check[.]html')\r\n[-] Engines: ('Feodo Tracker', '(hXXps):\/\/feodotracker[.]abuse[.]ch\/')\r\n[-] Engines: ('IPsum', 'hXXps:\/\/github[.]com\/stamparm\/ipsum')\r\n[-] Engines: ('JustSpam_org', '(hXXp):\/\/www[.]justspam[.]org\/')\r\n[-] Engines: ('Snapt NovaSense', 'hXXps:\/\/novasense-threats[.]com\/')\r\n[-] No Malc0de Results\r\n[+] AbuseIPDB Results\r\n[-] AbuseIPDB reports: 2\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/172.104.227.98\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/172.104.227.98\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Malicious Websites\r\n[+] VirusTotal pDNS Results\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-09', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-08', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-07', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-06', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-05', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-05', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-05', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-03', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2022-01-02', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-29', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-29', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-29', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-28', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-28', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-26', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-25', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-25', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-25', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-25', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-25', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-25', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-24', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-24', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-24', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-24', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-23', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-20', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-20', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-17', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-17', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-14', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-14', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXp:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-13', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-12', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-12', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-12', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-12', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-12', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-12', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-11', 'hXXps:\/\/172[.]104.227.98\/')\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n********************************************************************************\r\n* Information for 163.172.50.82\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('12876', '163[.]172.0.0\/16', '1992-02-14', 'ripencc', 'GB')\r\n[-] Network Information: ('163[.]172.0.0\/16', 'ONLINE_NET_DEDICATED_SERVERS', '163[.]172.0.0 - 163[.]172.255.255')\r\n[-] Registration Info: ('Dedicated Servers and cloud assignment, abuse reports : (hXXp):\/\/abuse[.]online[.]net', '2015-09-11', '2015-09-16')\r\n[-] Registration Locality: FR\r\n[+] IPVoid Results\r\n[-] Number of detections: 1\r\n[-] IP Void Detection Rate: 1%\r\n[-] Engines: ('CRDF', '(hXXps):\/\/threatcenter[.]crdf[.]fr\/check[.]html')\r\n[-] No Malc0de Results\r\n[+] AbuseIPDB Results\r\n[-] AbuseIPDB reports: 1\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/163.172.50.82\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/163.172.50.82\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Malicious Websites\r\n[+] VirusTotal pDNS Results\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-24', 'hXXp:\/\/163[.]172.50.82\/')\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n********************************************************************************\r\n* Information for 91.207.181.106\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('48275', '91[.]207.181.0\/24', '2008-10-30', 'ripencc', 'RU')\r\n[-] Network Information: ('91[.]207.180.0\/23', 'TSMS-ABKHAZIA-NET', '91[.]207.180.0 - 91[.]207.181.255')\r\n[-] Registration Info: ('Abkhasia, Suhum', '2008-10-30', '2019-04-29')\r\n[-] Registration Locality: RU\r\n[+] IPVoid Results\r\n[-] Number of detections: 5\r\n[-] IP Void Detection Rate: 6%\r\n[-] Engines: ('Barracuda_Reputation_BL', '(hXXp):\/\/www[.]barracudanetworks[.]com\/')\r\n[-] Engines: ('CRDF', '(hXXps):\/\/threatcenter[.]crdf[.]fr\/check[.]html')\r\n[-] Engines: ('Feodo Tracker', '(hXXps):\/\/feodotracker[.]abuse[.]ch\/')\r\n[-] Engines: ('IPsum', 'hXXps:\/\/github[.]com\/stamparm\/ipsum')\r\n[-] Engines: ('Snapt NovaSense', 'hXXps:\/\/novasense-threats[.]com\/')\r\n[-] No Malc0de Results\r\n[+] AbuseIPDB Results\r\n[-] AbuseIPDB reports: 1\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/91.207.181.106\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/91.207.181.106\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Malicious Websites\r\n[+] VirusTotal pDNS Results\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'a[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'admi[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'b[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'c[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'd[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'dev[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'dmarc[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'e[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'f[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'g[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'razarizaru[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'suerside[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'tvip[.]am-a[.]su')\r\n[-] pDNS data from VirusTotal: ('2022-01-06', 'www.klient[.]am-a[.]su')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXps:\/\/91[.]207.181.106\/')\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXp:\/\/91[.]207.181.106\/')\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n********************************************************************************\r\n* Information for 51.159.35.157\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('12876', '51[.]158.0.0\/15', '1993-09-01', 'ripencc', 'FR')\r\n[-] Network Information: ('51[.]159.0.0\/16', 'ONLINENET_DEDICATED_SERVERS', '51[.]159.0.0 - 51[.]159.255.255')\r\n[-] Registration Info: ('2018-02-09', '2018-02-28')\r\n[-] Registration Locality: FR\r\n[+] IPVoid Results\r\n[-] Number of detections: 3\r\n[-] IP Void Detection Rate: 3%\r\n[-] Engines: ('CRDF', '(hXXps):\/\/threatcenter[.]crdf[.]fr\/check[.]html')\r\n[-] Engines: ('IPsum', 'hXXps:\/\/github[.]com\/stamparm\/ipsum')\r\n[-] Engines: ('Snapt NovaSense', 'hXXps:\/\/novasense-threats[.]com\/')\r\n[-] No Malc0de Results\r\n[+] AbuseIPDB Results\r\n[-] AbuseIPDB reports: 1\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/51.159.35.157\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/51.159.35.157\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Malicious Websites\r\n[+] VirusTotal pDNS Results\r\n[-] pDNS malicious URLs from VirusTotal: ('2021-12-15', 'hXXp:\/\/51[.]159.35.157\/')\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n********************************************************************************\r\n* Information for 51.75.33.120\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('16276', '51[.]75.0.0\/16', '1993-09-01', 'ripencc', 'FR')\r\n[-] Network Information: ('51[.]75.33.120\/29', 'OVH_251937800', '51[.]75.33.120 - 51[.]75.33.127')\r\n[-] Registration Info: ('Failover Ips', '2019-12-26', '2019-12-26')\r\n[-] Registration Locality: PL\r\n[-] Abuse Email: abuse@ovh[.]net\r\n[+] IPVoid Results\r\n[-] Number of detections: 3\r\n[-] IP Void Detection Rate: 3%\r\n[-] Engines: ('CRDF', '(hXXps):\/\/threatcenter[.]crdf[.]fr\/check[.]html')\r\n[-] Engines: ('IPsum', 'hXXps:\/\/github[.]com\/stamparm\/ipsum')\r\n[-] Engines: ('Snapt NovaSense', 'hXXps:\/\/novasense-threats[.]com\/')\r\n[-] No Malc0de Results\r\n[+] AbuseIPDB Results\r\n[-] AbuseIPDB reports: 1\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/51.75.33.120\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/51.75.33.120\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Malicious Websites\r\n[!] Error from VirusTotal pDNS: Expecting value: line 1 column 1 (char 0)\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n********************************************************************************\r\n* Information for 91.207.181.106\r\n* Observable type: ipv4 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] IP Whois Results\r\n[-] ASN Information: ('48275', '91[.]207.181.0\/24', '2008-10-30', 'ripencc', 'RU')\r\n[-] Network Information: ('91[.]207.180.0\/23', 'TSMS-ABKHAZIA-NET', '91[.]207.180.0 - 91[.]207.181.255')\r\n[-] Registration Info: ('Abkhasia, Suhum', '2008-10-30', '2019-04-29')\r\n[-] Registration Locality: RU\r\n[+] IPVoid Results\r\n[-] Number of detections: 5\r\n[-] IP Void Detection Rate: 6%\r\n[-] Engines: ('Barracuda_Reputation_BL', '(hXXp):\/\/www[.]barracudanetworks[.]com\/')\r\n[-] Engines: ('CRDF', '(hXXps):\/\/threatcenter[.]crdf[.]fr\/check[.]html')\r\n[-] Engines: ('Feodo Tracker', '(hXXps):\/\/feodotracker[.]abuse[.]ch\/')\r\n[-] Engines: ('IPsum', 'hXXps:\/\/github[.]com\/stamparm\/ipsum')\r\n[-] Engines: ('Snapt NovaSense', 'hXXps:\/\/novasense-threats[.]com\/')\r\n[-] No Malc0de Results\r\n[+] AbuseIPDB Results\r\n[-] AbuseIPDB reports: 1\r\n[!] Error from RansomwareTracker: 503 Server Error: Backend unavailable, connection timeout for url: https:\/\/ransomwaretracker.abuse.ch\/host\/91.207.181.106\r\n[-] No SANS Results\r\n[!] Error from freegeoip.io: 403 Client Error: Forbidden for url: https:\/\/freegeoip.io\/json\/91.207.181.106\r\n[+] Fortinet Category Results\r\n[-] Fortinet URL Category: Malicious Websites\r\n[!] Error from VirusTotal pDNS: Expecting value: line 1 column 1 (char 0)\r\n[-] No McAfee Threat Results\r\n[-] No ThreatCrowd IP Report Results\r\n[-] No GreyNoise Results\r\n<\/pre>\n
I pivoted to see what kind of connections had been made to these malicious IP addresses. I did this using the following query:<\/p>\n
_path==\"conn\" conn_state!=\"REJ\" | 172.104.227.98 or 163.172.50.82 or 91.207.181.106 or 51.159.35.157 or 51.75.33.120 or 91.207.181.106<\/code><\/strong><\/p>\n
where conn_state!=\"REJ\"<\/code><\/strong> excluded anything with the REJ status (see this link<\/a> from the Zeek doc for more information). That gave me the following:<\/p>\n
\"\"<\/a><\/p>\n
It was here that I could see how frequent the callouts where from the compromised system and how much data was passed. It also looks like the traffic is either encrypted (TCP\/443) or encoded (TCP\/8080) so unfortunately I could not see what happened there.<\/p>\n
I then pivoted from here to see how many malicious JA3\/JA3S hashes were seen based on IP address. Using the query:<\/p>\n
_path==\"ssl\" | count() by id.resp_h,ja3,ja3s | sort -r count<\/code><\/strong><\/p>\n
gave me the following list of IPs\/hashes:<\/p>\n
\r\nid.resp_h\tja3\tja3s\tcount\r\n172.104.227.98\t51c64c77e60f3980eea90869b68c58a8\tfd4bc6cea4877646ccd62f0792ec0b62\t23\r\n91.207.181.106\t51c64c77e60f3980eea90869b68c58a8\tfd4bc6cea4877646ccd62f0792ec0b62\t16\r\n212.227.15.183\t37cdab6ff1bd1c195bacb776c5213bf2\t265fb1760174263f1728167115d17fe8\t10\r\n108.177.122.108\t37cdab6ff1bd1c195bacb776c5213bf2\t187380bdca925da6fbafacf0d356d2fe\t8\r\n81.169.145.133\t37cdab6ff1bd1c195bacb776c5213bf2\te54965894d6b45ecb4323c7ea3d6c115\t7\r\n194.25.134.114\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t6\r\n173.247.253.179\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t5\r\n202.53.169.50\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t4\r\n108.177.122.108\t37cdab6ff1bd1c195bacb776c5213bf2\t2b341b88c742e940cfb485ce7d93dde7\t4\r\n213.165.67.113\t37cdab6ff1bd1c195bacb776c5213bf2\t265fb1760174263f1728167115d17fe8\t4\r\n172.104.227.98\t51c64c77e60f3980eea90869b68c58a8\tec74a5c51106f0419184d0dd08fb05bc\t3\r\n163.172.50.82\t51c64c77e60f3980eea90869b68c58a8\tfd4bc6cea4877646ccd62f0792ec0b62\t3\r\n204.79.197.200\t6271f898ce5be7dd52b0fc260d0662b3\tfbe594b39bb5d9c53aa4f6caf8d2950c\t3\r\n80.67.29.4\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t3\r\n64.233.177.16\t37cdab6ff1bd1c195bacb776c5213bf2\t2b341b88c742e940cfb485ce7d93dde7\t3\r\n118.69.221.62\t37cdab6ff1bd1c195bacb776c5213bf2\tae4edc6faf64d08308082ad26be60767\t3\r\n163.172.50.82\t51c64c77e60f3980eea90869b68c58a8\tec74a5c51106f0419184d0dd08fb05bc\t3\r\n74.208.5.15\t37cdab6ff1bd1c195bacb776c5213bf2\t265fb1760174263f1728167115d17fe8\t3\r\n212.227.17.168\t37cdab6ff1bd1c195bacb776c5213bf2\t265fb1760174263f1728167115d17fe8\t2\r\n108.167.153.167\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t2\r\n199.79.63.117\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t2\r\n194.25.134.46\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t2\r\n192.185.169.164\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t2\r\n195.4.92.213\t37cdab6ff1bd1c195bacb776c5213bf2\t7c77dc02a42c4259b2f00e282bf3f89d\t2\r\n91.207.181.106\t51c64c77e60f3980eea90869b68c58a8\tec74a5c51106f0419184d0dd08fb05bc\t2\r\n74.220.199.65\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t2\r\n184.168.200.246\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t2\r\n213.46.255.64\t37cdab6ff1bd1c195bacb776c5213bf2\t76c691f46143bf86e2d1bb73c6187767\t2\r\n2.207.150.234\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t2\r\n213.165.67.124\t37cdab6ff1bd1c195bacb776c5213bf2\t265fb1760174263f1728167115d17fe8\t2\r\n208.91.199.15\t37cdab6ff1bd1c195bacb776c5213bf2\t649d6810e8392f63dc311eecb6b7098b\t1\r\n118.23.155.30\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n194.150.248.156\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n74.220.206.23\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n171.25.222.37\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n86.111.37.33\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n173.201.192.229\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n94.73.163.242\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n204.79.197.203\t37f463bf4616ecd445d4a1937da06e19\t1ae6020839f37465cc81f5f37480fd1e\t1\r\n106.187.245.203\t37cdab6ff1bd1c195bacb776c5213bf2\tadc06261ef82c2e4688b3cf08c1b2f24\t1\r\n103.138.88.100\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n77.55.141.119\t37cdab6ff1bd1c195bacb776c5213bf2\t1af33e1657631357c73119488045302c\t1\r\n195.186.120.54\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n212.77.101.1\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n20.72.205.209\t28a2c9bd18a11de089ef85a160da29e4\t3ffaa1393a2bf5ecfc7b6b2323452f2d\t1\r\n52.109.12.23\t28a2c9bd18a11de089ef85a160da29e4\t67bfe5d15ae567fb35fd7837f0116eec\t1\r\n194.177.200.158\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n199.168.117.91\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n211.13.204.5\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n203.211.136.199\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n186.202.161.96\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n23.3.6.28\t3b5074b1b5d032e5620f69f9f700ff0e\t4b7d5f58af981be54baeda917533e5d8\t1\r\n103.20.190.24\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n192.185.121.134\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n52.109.8.24\ta0e9f5d64349fb13191bc781f81f42e1\t986571066668055ae9481cb84fda634a\t1\r\n59.157.128.3\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n186.64.117.195\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n193.70.98.8\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n149.126.6.109\t37cdab6ff1bd1c195bacb776c5213bf2\t303951d4c50efb2e991652225a6f02b1\t1\r\n65.99.225.177\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n64.136.52.50\t37cdab6ff1bd1c195bacb776c5213bf2\t7b6819ed58e8d8415604b7dfcef92d55\t1\r\n52.109.12.19\ta0e9f5d64349fb13191bc781f81f42e1\t986571066668055ae9481cb84fda634a\t1\r\n151.80.93.33\t37cdab6ff1bd1c195bacb776c5213bf2\tb8d072db1f2e5be0acbae44d5808eca0\t1\r\n68.178.252.229\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n65.87.230.25\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n77.244.243.66\t37cdab6ff1bd1c195bacb776c5213bf2\te54965894d6b45ecb4323c7ea3d6c115\t1\r\n93.157.100.35\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n89.161.196.12\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n192.254.250.163\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n34.68.202.102\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n108.179.194.17\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n184.168.200.22\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n89.216.47.170\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n51.81.229.171\t37cdab6ff1bd1c195bacb776c5213bf2\t853a40879f82a9da4ed2e19c590c05ea\t1\r\n206.188.198.65\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n95.110.223.11\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n213.191.128.76\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n89.161.250.151\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n108.167.189.110\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n212.227.17.190\t37cdab6ff1bd1c195bacb776c5213bf2\t265fb1760174263f1728167115d17fe8\t1\r\n185.151.28.85\t37cdab6ff1bd1c195bacb776c5213bf2\t\t                                1\r\n203.219.165.58\t37cdab6ff1bd1c195bacb776c5213bf2\tfaa88e75a7471aaa07850841e28f87f1\t1\r\n20.50.201.200\t28a2c9bd18a11de089ef85a160da29e4\t678aeaf909676262acfb913ccb78a126\t1\r\n40.83.240.146\t3b5074b1b5d032e5620f69f9f700ff0e\tae4edc6faf64d08308082ad26be60767\t1\r\n96.114.157.81\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n194.25.134.110\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n80.249.167.173\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n216.172.184.136\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n166.78.79.129\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n162.241.252.143\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n192.252.149.15\t37cdab6ff1bd1c195bacb776c5213bf2\tec74a5c51106f0419184d0dd08fb05bc\t1\r\n208.84.244.140\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n66.111.4.52\t37cdab6ff1bd1c195bacb776c5213bf2\t1af33e1657631357c73119488045302c\t1\r\n202.137.236.12\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n207.8.183.5\t37cdab6ff1bd1c195bacb776c5213bf2\t9706b574e4b03c78a957ef707abe134f\t1\r\n200.63.98.23\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n205.178.146.249\t37cdab6ff1bd1c195bacb776c5213bf2\t5af4c2c17ac0918c8ce8379db04e21f9\t1\r\n52.109.8.24\t28a2c9bd18a11de089ef85a160da29e4\t67bfe5d15ae567fb35fd7837f0116eec\t1\r\n68.178.252.101\t37cdab6ff1bd1c195bacb776c5213bf2\te35df3e00ca4ef31d42b34bebaa2f86e\t1\r\n192.64.117.195\t37cdab6ff1bd1c195bacb776c5213bf2\t0debd3853f330c574b05e0b6d882dc27\t1\r\n52.153.255.201\t6271f898ce5be7dd52b0fc260d0662b3\tae4edc6faf64d08308082ad26be60767\t1\r\n80.237.132.157\t37cdab6ff1bd1c195bacb776c5213bf2\t7c77dc02a42c4259b2f00e282bf3f89d\t1\r\n<\/pre>\n
Seeing how much data was there, I scaled this back to only give me the hashes that were unique via the the following query:<\/p>\n
_path==\"ssl\" | cut  | sort | uniq<\/code><\/strong><\/p>\n
Note that I had to use ja3 OR ja3s individually in the above query which was then piped into sort since it would group all the same hashes together which would then be normalized via the “uniq” command.<\/p>\n
\r\nja3\r\n28a2c9bd18a11de089ef85a160da29e4\r\n37cdab6ff1bd1c195bacb776c5213bf2\r\n37f463bf4616ecd445d4a1937da06e19\r\n3b5074b1b5d032e5620f69f9f700ff0e\r\n51c64c77e60f3980eea90869b68c58a8\r\n6271f898ce5be7dd52b0fc260d0662b3\r\na0e9f5d64349fb13191bc781f81f42e1\r\n\r\nja3s\r\n0debd3853f330c574b05e0b6d882dc27\r\n187380bdca925da6fbafacf0d356d2fe\r\n1ae6020839f37465cc81f5f37480fd1e\r\n1af33e1657631357c73119488045302c\r\n265fb1760174263f1728167115d17fe8\r\n2b341b88c742e940cfb485ce7d93dde7\r\n303951d4c50efb2e991652225a6f02b1\r\n3ffaa1393a2bf5ecfc7b6b2323452f2d\r\n4b7d5f58af981be54baeda917533e5d8\r\n5af4c2c17ac0918c8ce8379db04e21f9\r\n649d6810e8392f63dc311eecb6b7098b\r\n678aeaf909676262acfb913ccb78a126\r\n67bfe5d15ae567fb35fd7837f0116eec\r\n76c691f46143bf86e2d1bb73c6187767\r\n7b6819ed58e8d8415604b7dfcef92d55\r\n7c77dc02a42c4259b2f00e282bf3f89d\r\n853a40879f82a9da4ed2e19c590c05ea\r\n9706b574e4b03c78a957ef707abe134f\r\n986571066668055ae9481cb84fda634a\r\nadc06261ef82c2e4688b3cf08c1b2f24\r\nae4edc6faf64d08308082ad26be60767\r\nb8d072db1f2e5be0acbae44d5808eca0\r\ne35df3e00ca4ef31d42b34bebaa2f86e\r\ne54965894d6b45ecb4323c7ea3d6c115\r\nec74a5c51106f0419184d0dd08fb05bc\r\nfaa88e75a7471aaa07850841e28f87f1\r\nfbe594b39bb5d9c53aa4f6caf8d2950c\r\nfd4bc6cea4877646ccd62f0792ec0b62\r\n<\/pre>\n
The only one that was found over on SSLBL Abuse<\/a> was 51c64c77e60f3980eea90869b68c58a8<\/a> which has been seen as early as December 25th and also classified as “Dridex”.<\/p>\n
So now knowing the timeframe of the infection, the IP address of the compromised system, and the malware used here in this compromise, the only thing that is left to check are 1) did the compromised system talk to any other systems on the network, 2) what were the HTTP requests like and 3) what are the SMTP messages about. So checking to see what kind of communications happened between this system and any others on the internal network I used this query looking for anything that was more then 4 packets from the source or destination:<\/p>\n
id.orig_h==10.12.3.0\/24 and id.resp_h==10.12.3.0\/24 | cut ts,uid,id.orig_h,id.orig_p,id.resp_h,id.resp_p,proto,service,duration,orig_bytes,resp_bytes,conn_state,history,orig_pkts,orig_ip_bytes,resp_pkts,resp_ip_bytes | orig_pkts >= 4 and resp_pkts >= 4 | sort -r duration<\/code><\/strong><\/p>\n
I didn’t see anything that stood out as being malicious and no other systems outside of the DC were found.<\/p>\n
\"\"<\/a><\/p>\n
For any HTTP communications, I really didn’t see much there outside of what was found already as seen below.<\/p>\n
\"\"<\/a><\/p>\n
I also remembered that there were other files seen in the PCAP that I forgot about. Using the following query I was able to take a quick look at them. Based on those results, there were some image files, some Excel macro-spreadsheets, and some zip files. Once again knowing that this is related to Emotet, I am pretty sure that this is related to malspam and the SMTP messages that I saw earlier.<\/p>\n
_path==\"files\" filename!=null | cut _path, ts, tx_hosts, rx_hosts, conn_uids, mime_type, filename, md5, sha1<\/code><\/strong><\/p>\n
\"\"<\/a><\/p>\n
Exporting out the hashes and performing a “uniq” like above, I was able to get the following information.<\/p>\n
_path==\"files\" filename!=null | cut filename, md5, sha1 | sort | uniq<\/code><\/strong><\/p>\n
\r\nfilename\tmd5\tsha1\r\nIE7MnYfF4c.dll\t2f93cb3701205b257b8ef5e76545923b\tc53d45e900d52a0a4802f858ac94a10bdbff3d15\r\nPO261171204827.xlsm\tf1f0d756f2a033f3c0e3ba93e9d7700e\t1ae741607fa5ce9601ffdd9bd3aba50f1c9373e2\r\nSCAN_1006384431078587279.zip\t8685f97ae99114fa480ab5076c30b8da\tcfbf2e08d4fbc1d82774e05738273acd374d0d10\r\nXLSM22952905865844.xlsm\t8827e861b25e27768d02dd12c1aa855b\t86659503579263c2fe9b292a3ccae2ff3a51ad5f\r\nimage001.jpg\t5aeee5d27cd8a8a66d6d28a6302d766c\t2ab7206b021f365354e9a869935da4aa2ab8b0e3\r\nimage001.png\t4fb1e0a0346c90848f20345e45ecb93f\tf3d0497aefd0defe7d869d59961b18fe01c44f9b\r\nimage001.png\tfa156a85cb085820775a39bafc66dfce\ted5973a6b2965db690308510435e48958d44c7c6\r\nimage002.png\taa5fd7385d934ac88301466e88f14d92\t672c5dd1636dcce3dad8cd716d475fd01f100804\r\n<\/pre>\n
Looking those hashes up with Machinae gave me back the following hits:<\/p>\n
2f93cb3701205b257b8ef5e76545923b
\nc53d45e900d52a0a4802f858ac94a10bdbff3d15
\nf1f0d756f2a033f3c0e3ba93e9d7700e
\n1ae741607fa5ce9601ffdd9bd3aba50f1c9373e2
\n8827e861b25e27768d02dd12c1aa855b
\n86659503579263c2fe9b292a3ccae2ff3a51ad5f<\/code><\/p>\n
\r\n********************************************************************************\r\n* Information for 2f93cb3701205b257b8ef5e76545923b\r\n* Observable type: hash (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[-] No Malc0de Results\r\n[+] VirusTotal File Report Results\r\n    [-] Date submitted: 2021-12-20 08:06:09\r\n    [-] Detected engines: 51\r\n    [-] Total engines: 67\r\n    [-] Scans: ('Lionic', 'Trojan[.]Win32[.]Emotet.L!c')\r\n    [-] Scans: ('MicroWorld-eScan', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('FireEye', 'Generic[.]mg.2f93cb3701205b25')\r\n    [-] Scans: ('CAT-QuickHeal', 'Trojan[.]IGENERIC')\r\n    [-] Scans: ('McAfee', 'Emotet-FSQ!2F93CB370120')\r\n    [-] Scans: ('Cylance', 'Unsafe')\r\n    [-] Scans: ('Zillya', 'Trojan[.]Emotet[.]Win32.62068')\r\n    [-] Scans: ('K7AntiVirus', 'Trojan ( 0058b4901 )')\r\n    [-] Scans: ('Alibaba', 'Trojan:Win32\/Emotet.8317975f')\r\n    [-] Scans: ('K7GW', 'Trojan ( 0058b4901 )')\r\n    [-] Scans: ('CrowdStrike', 'win\/malicious_confidence_100% (W)')\r\n    [-] Scans: ('VirIT', 'Trojan.Win32[.]Emotet[.]DDW')\r\n    [-] Scans: ('Cyren', 'W32\/Emotet[.]EDV[.]gen!Eldorado')\r\n    [-] Scans: ('Symantec', 'Trojan Horse')\r\n    [-] Scans: ('ESET-NOD32', 'a variant of Win32\/Kryptik[.]HNNQ')\r\n    [-] Scans: ('TrendMicro-HouseCall', 'TrojanSpy.Win32[.]EMOTET[.]YXBLCZ')\r\n    [-] Scans: ('Paloalto', 'generic[.]ml')\r\n    [-] Scans: ('ClamAV', 'Win[.]Malware[.]Generic-9909860-0')\r\n    [-] Scans: ('Kaspersky', 'Trojan-Banker.Win32[.]Emotet[.]ghji')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('Avast', 'Win32:CrypterX-gen [Trj]')\r\n    [-] Scans: ('Tencent', 'Malware[.]Win32[.]Gencirc.10cf91d4')\r\n    [-] Scans: ('Ad-Aware', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('Sophos', 'Mal\/Generic-R + Troj\/Emotet-CWR')\r\n    [-] Scans: ('Comodo', '.UnclassifiedMalware@0')\r\n    [-] Scans: ('DrWeb', 'Trojan[.]Emotet.1124')\r\n    [-] Scans: ('TrendMicro', 'TrojanSpy.Win32[.]EMOTET[.]YXBLCZ')\r\n    [-] Scans: ('McAfee-GW-Edition', 'Emotet-FSQ!2F93CB370120')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]Crypt (A)')\r\n    [-] Scans: ('GData', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('Jiangmin', 'Trojan.Banker[.]Emotet[.]qzt')\r\n    [-] Scans: ('Webroot', 'W32[.]Trojan[.]Emotet')\r\n    [-] Scans: ('Avira', 'TR\/AD[.]Nekark[.]avuwq')\r\n    [-] Scans: ('MAX', 'malware (ai score=81)')\r\n    [-] Scans: ('Antiy-AVL', 'Trojan\/Generic[.]ASMalwS.34E4DB1')\r\n    [-] Scans: ('Kingsoft', 'Win32[.]Troj[.]Generic_a.a.(kcloud)')\r\n    [-] Scans: ('Gridinsoft', 'Ransom.Win32[.]Sabsik[.]oa')\r\n    [-] Scans: ('Microsoft', 'Trojan:Win32\/Emotet[.]PAM!MTB')\r\n    [-] Scans: ('Cynet', 'Malicious (score: 100)')\r\n    [-] Scans: ('AhnLab-V3', 'Trojan\/Win[.]Emotet.R456215')\r\n    [-] Scans: ('VBA32', 'TrojanBanker[.]Emotet')\r\n    [-] Scans: ('ALYac', 'Trojan[.]Agent[.]Emotet')\r\n    [-] Scans: ('Malwarebytes', 'Trojan[.]Crypt')\r\n    [-] Scans: ('Ikarus', 'Trojan[.]Win32[.]Crypt')\r\n    [-] Scans: ('Rising', 'Trojan[.]Kryptik!1.DAEF (CLASSIC)')\r\n    [-] Scans: ('Yandex', 'Trojan[.]PWS[.]Emotet!kI3B40T2sck')\r\n    [-] Scans: ('SentinelOne', 'Static AI - Suspicious PE')\r\n    [-] Scans: ('MaxSecure', 'Trojan[.]Malware.133255221[.]susgen')\r\n    [-] Scans: ('Fortinet', 'W32\/Mikey.D205!tr')\r\n    [-] Scans: ('AVG', 'Win32:CrypterX-gen [Trj]')\r\n    [-] Scans: ('Panda', 'Trj\/GdSda.A')\r\n[!] Error from ThreatExpert: HTTPConnectionPool(host='www.threatexpert.com', port=80): Max retries exceeded with url: \/report.aspx?md5=2f93cb3701205b257b8ef5e76545923b (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[-] No VxVault Results\r\n[!] Error from Cymru MHR: HTTPSConnectionPool(host='hash.cymru.com', port=443): Max retries exceeded with url: \/cgi-bin\/bulkmhr.cgi (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[+] MetaDefender File Report Results\r\n    [-] Date submitted: 2021-12-06T05:35:38.444Z\r\n    [-] Detected engines: 12\r\n    [-] Total engines: 34\r\n    [-] Scans: ('Ahnlab', 'Trojan\/Win[.]Emotet')\r\n    [-] Scans: ('Avira', 'TR\/AD[.]Nekark[.]avuwq')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('ClamAV', 'Win[.]Malware[.]Generic-9909860-0')\r\n    [-] Scans: ('Cyren', 'W32\/Emotet[.]EDV[.]gen!Eldorado')\r\n    [-] Scans: ('ESET', 'a variant of Win32\/Kryptik[.]HNNQ trojan')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.47553818 (B)')\r\n    [-] Scans: ('Huorong', 'Trojan\/Emotet[.]ki')\r\n    [-] Scans: ('Ikarus', 'Trojan[.]Win32[.]Crypt')\r\n    [-] Scans: ('Jiangmin', 'Unavailable (production)')\r\n    [-] Scans: ('K7', 'Trojan ( 0058b4901 )')\r\n    [-] Scans: ('Kaspersky', 'Trojan-Banker.Win32[.]Emotet[.]ghji')\r\n    [-] Scans: ('Xvirus Personal Guard', 'Hacktool[.]Crypter.40')\r\n********************************************************************************\r\n* Information for c53d45e900d52a0a4802f858ac94a10bdbff3d15\r\n* Observable type: hash.sha1 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] VirusTotal File Report Results\r\n    [-] Date submitted: 2021-12-20 08:06:09\r\n    [-] Detected engines: 51\r\n    [-] Total engines: 67\r\n    [-] Scans: ('Lionic', 'Trojan[.]Win32[.]Emotet.L!c')\r\n    [-] Scans: ('MicroWorld-eScan', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('FireEye', 'Generic[.]mg.2f93cb3701205b25')\r\n    [-] Scans: ('CAT-QuickHeal', 'Trojan[.]IGENERIC')\r\n    [-] Scans: ('McAfee', 'Emotet-FSQ!2F93CB370120')\r\n    [-] Scans: ('Cylance', 'Unsafe')\r\n    [-] Scans: ('Zillya', 'Trojan[.]Emotet[.]Win32.62068')\r\n    [-] Scans: ('K7AntiVirus', 'Trojan ( 0058b4901 )')\r\n    [-] Scans: ('Alibaba', 'Trojan:Win32\/Emotet.8317975f')\r\n    [-] Scans: ('K7GW', 'Trojan ( 0058b4901 )')\r\n    [-] Scans: ('CrowdStrike', 'win\/malicious_confidence_100% (W)')\r\n    [-] Scans: ('VirIT', 'Trojan.Win32[.]Emotet[.]DDW')\r\n    [-] Scans: ('Cyren', 'W32\/Emotet[.]EDV[.]gen!Eldorado')\r\n    [-] Scans: ('Symantec', 'Trojan Horse')\r\n    [-] Scans: ('ESET-NOD32', 'a variant of Win32\/Kryptik[.]HNNQ')\r\n    [-] Scans: ('TrendMicro-HouseCall', 'TrojanSpy.Win32[.]EMOTET[.]YXBLCZ')\r\n    [-] Scans: ('Paloalto', 'generic[.]ml')\r\n    [-] Scans: ('ClamAV', 'Win[.]Malware[.]Generic-9909860-0')\r\n    [-] Scans: ('Kaspersky', 'Trojan-Banker.Win32[.]Emotet[.]ghji')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('Avast', 'Win32:CrypterX-gen [Trj]')\r\n    [-] Scans: ('Tencent', 'Malware[.]Win32[.]Gencirc.10cf91d4')\r\n    [-] Scans: ('Ad-Aware', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('Sophos', 'Mal\/Generic-R + Troj\/Emotet-CWR')\r\n    [-] Scans: ('Comodo', '.UnclassifiedMalware@0')\r\n    [-] Scans: ('DrWeb', 'Trojan[.]Emotet.1124')\r\n    [-] Scans: ('TrendMicro', 'TrojanSpy.Win32[.]EMOTET[.]YXBLCZ')\r\n    [-] Scans: ('McAfee-GW-Edition', 'Emotet-FSQ!2F93CB370120')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]Crypt (A)')\r\n    [-] Scans: ('GData', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('Jiangmin', 'Trojan.Banker[.]Emotet[.]qzt')\r\n    [-] Scans: ('Webroot', 'W32[.]Trojan[.]Emotet')\r\n    [-] Scans: ('Avira', 'TR\/AD[.]Nekark[.]avuwq')\r\n    [-] Scans: ('MAX', 'malware (ai score=81)')\r\n    [-] Scans: ('Antiy-AVL', 'Trojan\/Generic[.]ASMalwS.34E4DB1')\r\n    [-] Scans: ('Kingsoft', 'Win32[.]Troj[.]Generic_a.a.(kcloud)')\r\n    [-] Scans: ('Gridinsoft', 'Ransom.Win32[.]Sabsik[.]oa')\r\n    [-] Scans: ('Microsoft', 'Trojan:Win32\/Emotet[.]PAM!MTB')\r\n    [-] Scans: ('Cynet', 'Malicious (score: 100)')\r\n    [-] Scans: ('AhnLab-V3', 'Trojan\/Win[.]Emotet.R456215')\r\n    [-] Scans: ('VBA32', 'TrojanBanker[.]Emotet')\r\n    [-] Scans: ('ALYac', 'Trojan[.]Agent[.]Emotet')\r\n    [-] Scans: ('Malwarebytes', 'Trojan[.]Crypt')\r\n    [-] Scans: ('Ikarus', 'Trojan[.]Win32[.]Crypt')\r\n    [-] Scans: ('Rising', 'Trojan[.]Kryptik!1.DAEF (CLASSIC)')\r\n    [-] Scans: ('Yandex', 'Trojan[.]PWS[.]Emotet!kI3B40T2sck')\r\n    [-] Scans: ('SentinelOne', 'Static AI - Suspicious PE')\r\n    [-] Scans: ('MaxSecure', 'Trojan[.]Malware.133255221[.]susgen')\r\n    [-] Scans: ('Fortinet', 'W32\/Mikey.D205!tr')\r\n    [-] Scans: ('AVG', 'Win32:CrypterX-gen [Trj]')\r\n    [-] Scans: ('Panda', 'Trj\/GdSda.A')\r\n[!] Error from Cymru MHR: HTTPSConnectionPool(host='hash.cymru.com', port=443): Max retries exceeded with url: \/cgi-bin\/bulkmhr.cgi (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[+] MetaDefender File Report Results\r\n    [-] Date submitted: 2021-12-06T05:35:38.444Z\r\n    [-] Detected engines: 12\r\n    [-] Total engines: 34\r\n    [-] Scans: ('Ahnlab', 'Trojan\/Win[.]Emotet')\r\n    [-] Scans: ('Avira', 'TR\/AD[.]Nekark[.]avuwq')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47553818')\r\n    [-] Scans: ('ClamAV', 'Win[.]Malware[.]Generic-9909860-0')\r\n    [-] Scans: ('Cyren', 'W32\/Emotet[.]EDV[.]gen!Eldorado')\r\n    [-] Scans: ('ESET', 'a variant of Win32\/Kryptik[.]HNNQ trojan')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.47553818 (B)')\r\n    [-] Scans: ('Huorong', 'Trojan\/Emotet[.]ki')\r\n    [-] Scans: ('Ikarus', 'Trojan[.]Win32[.]Crypt')\r\n    [-] Scans: ('Jiangmin', 'Unavailable (production)')\r\n    [-] Scans: ('K7', 'Trojan ( 0058b4901 )')\r\n    [-] Scans: ('Kaspersky', 'Trojan-Banker.Win32[.]Emotet[.]ghji')\r\n    [-] Scans: ('Xvirus Personal Guard', 'Hacktool[.]Crypter.40')\r\n********************************************************************************\r\n* Information for f1f0d756f2a033f3c0e3ba93e9d7700e\r\n* Observable type: hash (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[-] No Malc0de Results\r\n[+] VirusTotal File Report Results\r\n    [-] Date submitted: 2021-12-10 16:28:17\r\n    [-] Detected engines: 29\r\n    [-] Total engines: 59\r\n    [-] Scans: ('Lionic', 'Trojan[.]MSOffice[.]Emotet.4!c')\r\n    [-] Scans: ('ClamAV', 'Xls[.]Downloader[.]EmotetExcel122100-9913103-0')\r\n    [-] Scans: ('McAfee', 'Downloader-FCHG!F4546CFAAF78')\r\n    [-] Scans: ('K7AntiVirus', 'Trojan ( 0058b5021 )')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('K7GW', 'Trojan ( 0058b5021 )')\r\n    [-] Scans: ('Arcabit', 'Trojan[.]Generic.D246B115')\r\n    [-] Scans: ('Cyren', 'XML\/Agent[.]KD')\r\n    [-] Scans: ('ESET-NOD32', 'DOC\/TrojanDownloader[.]Agent[.]DOH')\r\n    [-] Scans: ('Avast', 'VBS:Malware-gen')\r\n    [-] Scans: ('Cynet', 'Malicious (score: 99)')\r\n    [-] Scans: ('Kaspersky', 'HEUR:Trojan.MSOffice[.]Emotet[.]gen')\r\n    [-] Scans: ('Alibaba', 'TrojanDownloader:Office97\/Emotet.3e3309f5')\r\n    [-] Scans: ('MicroWorld-eScan', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Tencent', 'Trojan[.]MsOffice[.]XmlMacroSheet.11017772')\r\n    [-] Scans: ('Ad-Aware', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.38187285 (B)')\r\n    [-] Scans: ('DrWeb', 'W97M[.]DownLoader.5470')\r\n    [-] Scans: ('McAfee-GW-Edition', 'Artemis!Trojan')\r\n    [-] Scans: ('FireEye', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]XLM[.]Agent')\r\n    [-] Scans: ('GData', 'XML.Trojan[.]Agent[.]AOBTAI')\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]eltuf')\r\n    [-] Scans: ('MAX', 'malware (ai score=85)')\r\n    [-] Scans: ('Microsoft', 'TrojanDownloader:O97M\/Emotet!MTB')\r\n    [-] Scans: ('Zoner', 'Probably Heur.W97ShellN')\r\n    [-] Scans: ('Rising', 'Downloader[.]Agent\/XLM!1.DADA (CLASSIC)')\r\n    [-] Scans: ('Fortinet', 'XML\/Agent[.]AA!tr[.]dldr')\r\n    [-] Scans: ('AVG', 'VBS:Malware-gen')\r\n[!] Error from ThreatExpert: HTTPConnectionPool(host='www.threatexpert.com', port=80): Max retries exceeded with url: \/report.aspx?md5=f1f0d756f2a033f3c0e3ba93e9d7700e (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[-] No VxVault Results\r\n[!] Error from Cymru MHR: HTTPSConnectionPool(host='hash.cymru.com', port=443): Max retries exceeded with url: \/cgi-bin\/bulkmhr.cgi (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[+] MetaDefender File Report Results\r\n    [-] Date submitted: 2021-12-06T02:05:47.332Z\r\n    [-] Detected engines: 4\r\n    [-] Total engines: 34\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]eltuf')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.38187285 (B)')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]DOC[.]Agent')\r\n    [-] Scans: ('RocketCyber', '')\r\n    [-] Scans: ('Webroot SMD', '')\r\n********************************************************************************\r\n* Information for 1ae741607fa5ce9601ffdd9bd3aba50f1c9373e2\r\n* Observable type: hash.sha1 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] VirusTotal File Report Results\r\n    [-] Date submitted: 2021-12-10 16:28:17\r\n    [-] Detected engines: 29\r\n    [-] Total engines: 59\r\n    [-] Scans: ('Lionic', 'Trojan[.]MSOffice[.]Emotet.4!c')\r\n    [-] Scans: ('ClamAV', 'Xls[.]Downloader[.]EmotetExcel122100-9913103-0')\r\n    [-] Scans: ('McAfee', 'Downloader-FCHG!F4546CFAAF78')\r\n    [-] Scans: ('K7AntiVirus', 'Trojan ( 0058b5021 )')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('K7GW', 'Trojan ( 0058b5021 )')\r\n    [-] Scans: ('Arcabit', 'Trojan[.]Generic.D246B115')\r\n    [-] Scans: ('Cyren', 'XML\/Agent[.]KD')\r\n    [-] Scans: ('ESET-NOD32', 'DOC\/TrojanDownloader[.]Agent[.]DOH')\r\n    [-] Scans: ('Avast', 'VBS:Malware-gen')\r\n    [-] Scans: ('Cynet', 'Malicious (score: 99)')\r\n    [-] Scans: ('Kaspersky', 'HEUR:Trojan.MSOffice[.]Emotet[.]gen')\r\n    [-] Scans: ('Alibaba', 'TrojanDownloader:Office97\/Emotet.3e3309f5')\r\n    [-] Scans: ('MicroWorld-eScan', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Tencent', 'Trojan[.]MsOffice[.]XmlMacroSheet.11017772')\r\n    [-] Scans: ('Ad-Aware', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.38187285 (B)')\r\n    [-] Scans: ('DrWeb', 'W97M[.]DownLoader.5470')\r\n    [-] Scans: ('McAfee-GW-Edition', 'Artemis!Trojan')\r\n    [-] Scans: ('FireEye', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]XLM[.]Agent')\r\n    [-] Scans: ('GData', 'XML.Trojan[.]Agent[.]AOBTAI')\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]eltuf')\r\n    [-] Scans: ('MAX', 'malware (ai score=85)')\r\n    [-] Scans: ('Microsoft', 'TrojanDownloader:O97M\/Emotet!MTB')\r\n    [-] Scans: ('Zoner', 'Probably Heur.W97ShellN')\r\n    [-] Scans: ('Rising', 'Downloader[.]Agent\/XLM!1.DADA (CLASSIC)')\r\n    [-] Scans: ('Fortinet', 'XML\/Agent[.]AA!tr[.]dldr')\r\n    [-] Scans: ('AVG', 'VBS:Malware-gen')\r\n[!] Error from Cymru MHR: HTTPSConnectionPool(host='hash.cymru.com', port=443): Max retries exceeded with url: \/cgi-bin\/bulkmhr.cgi (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[+] MetaDefender File Report Results\r\n    [-] Date submitted: 2021-12-06T02:05:47.332Z\r\n    [-] Detected engines: 4\r\n    [-] Total engines: 34\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]eltuf')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.38187285')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.38187285 (B)')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]DOC[.]Agent')\r\n    [-] Scans: ('RocketCyber', '')\r\n    [-] Scans: ('Webroot SMD', '')\r\n********************************************************************************\r\n* Information for 8827e861b25e27768d02dd12c1aa855b\r\n* Observable type: hash (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[-] No Malc0de Results\r\n[!] Error from VirusTotal File Report: Expecting value: line 1 column 1 (char 0)\r\n[!] Error from ThreatExpert: HTTPConnectionPool(host='www.threatexpert.com', port=80): Max retries exceeded with url: \/report.aspx?md5=8827e861b25e27768d02dd12c1aa855b (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[-] No VxVault Results\r\n[!] Error from Cymru MHR: HTTPSConnectionPool(host='hash.cymru.com', port=443): Max retries exceeded with url: \/cgi-bin\/bulkmhr.cgi (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[+] MetaDefender File Report Results\r\n    [-] Date submitted: 2021-12-06T02:07:52.446Z\r\n    [-] Detected engines: 4\r\n    [-] Total engines: 34\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]ivjtn')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47562197')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.47562197 (B)')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]DOC[.]Agent')\r\n    [-] Scans: ('RocketCyber', '')\r\n    [-] Scans: ('Webroot SMD', '')\r\n********************************************************************************\r\n* Information for 86659503579263c2fe9b292a3ccae2ff3a51ad5f\r\n* Observable type: hash.sha1 (Auto-detected: True)\r\n********************************************************************************\r\nNot seeing what you expect? Likely not a valid site. Try running with --list-sites\r\n\r\n[+] VirusTotal File Report Results\r\n    [-] Date submitted: 2021-12-10 16:32:35\r\n    [-] Detected engines: 29\r\n    [-] Total engines: 59\r\n    [-] Scans: ('Lionic', 'Trojan[.]MSOffice[.]Emotet.4!c')\r\n    [-] Scans: ('ClamAV', 'Xls[.]Downloader[.]EmotetExcel122100-9913103-0')\r\n    [-] Scans: ('K7AntiVirus', 'Trojan ( 0058b5021 )')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47562197')\r\n    [-] Scans: ('K7GW', 'Trojan ( 0058b5021 )')\r\n    [-] Scans: ('Arcabit', 'Trojan[.]Generic.D2D5BDD5')\r\n    [-] Scans: ('Cyren', 'XML\/Agent[.]KD')\r\n    [-] Scans: ('ESET-NOD32', 'DOC\/TrojanDownloader[.]Agent[.]DOH')\r\n    [-] Scans: ('Avast', 'VBS:Malware-gen')\r\n    [-] Scans: ('Cynet', 'Malicious (score: 99)')\r\n    [-] Scans: ('Kaspersky', 'HEUR:Trojan.MSOffice[.]Emotet[.]gen')\r\n    [-] Scans: ('Alibaba', 'Trojan:Office\/Emotet[.]aeb515b2')\r\n    [-] Scans: ('MicroWorld-eScan', 'Trojan[.]GenericKD.47562197')\r\n    [-] Scans: ('Tencent', 'Trojan[.]MsOffice[.]XmlMacroSheet.11017772')\r\n    [-] Scans: ('Ad-Aware', 'Trojan[.]GenericKD.47562197')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.47562197 (B)')\r\n    [-] Scans: ('DrWeb', 'W97M[.]DownLoader.5470')\r\n    [-] Scans: ('McAfee-GW-Edition', 'Artemis!Trojan')\r\n    [-] Scans: ('FireEye', 'Trojan[.]GenericKD.47562197')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]XLM[.]Agent')\r\n    [-] Scans: ('GData', 'XML.Trojan[.]Agent[.]AOBTAI')\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]ivjtn')\r\n    [-] Scans: ('MAX', 'malware (ai score=83)')\r\n    [-] Scans: ('Microsoft', 'TrojanDownloader:O97M\/Emotet[.]ASQT!MTB')\r\n    [-] Scans: ('McAfee', 'Downloader-FCHG!F4546CFAAF78')\r\n    [-] Scans: ('Zoner', 'Probably Heur.W97ShellN')\r\n    [-] Scans: ('Rising', 'Downloader[.]Agent\/XLM!1.DADA (CLASSIC)')\r\n    [-] Scans: ('Fortinet', 'XML\/Agent[.]AA!tr[.]dldr')\r\n    [-] Scans: ('AVG', 'VBS:Malware-gen')\r\n[!] Error from Cymru MHR: HTTPSConnectionPool(host='hash.cymru.com', port=443): Max retries exceeded with url: \/cgi-bin\/bulkmhr.cgi (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known'))\r\n[+] MetaDefender File Report Results\r\n    [-] Date submitted: 2021-12-06T02:07:52.446Z\r\n    [-] Detected engines: 4\r\n    [-] Total engines: 34\r\n    [-] Scans: ('Avira', 'W2000M\/YAV[.]Minerva[.]ivjtn')\r\n    [-] Scans: ('BitDefender', 'Trojan[.]GenericKD.47562197')\r\n    [-] Scans: ('Emsisoft', 'Trojan[.]GenericKD.47562197 (B)')\r\n    [-] Scans: ('Ikarus', 'Trojan-Downloader[.]DOC[.]Agent')\r\n    [-] Scans: ('RocketCyber', '')\r\n    [-] Scans: ('Webroot SMD', '')\r\n<\/pre>\n
For the last part of this exercise, I needed to find what the name of the user was and the hostname as well. This was pretty straight forward in Brim since you can look at both “NTLM” and “Kerberos” at the same time and see the results.<\/p>\n
\"\"<\/a><\/p>\n
Now for the last part – what the heck is all the SMTP messages? Using the following query I was able to make short work of this.<\/p>\n
_path==\"smtp\" | mailfrom!=null<\/code><\/strong><\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
Looks like I was correct about the malspam aspect of this. The other interesting bit to this is when I dug into one of the rows and opened the log detail up. In the following example, I saw that there was the connection, but then a cascading view of three files, and a SMTP communication. This stems from the same connection being used to send several emails that range from two attachments up to four different attachments.<\/p>\n
\"\"<\/a><\/p>\n
So there we have it – a quick rundown of Brim and the different queries that I used to work on this exercise. As usual, please let me know if I have missed anything. Thanks for stopping by.<\/p>\n","protected":false},"excerpt":{"rendered":"
It has been a long while since I have done any blogging. Since it has been a hot minute since I have done a post I thought that I would take this opportunity to learn something new and expand my tool-belt. So this first step back into the blogging world is going to be about a tool called Brim using the latest malware exercise from Brad found over at his site here and the SANS site here. So let’s start with what Brim is – a tool that helps visualize PCAP data in a different way with WAY faster indexing…<\/p>\n
 Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[46,47],"class_list":["post-1437","post","type-post","status-publish","format-standard","hentry","category-packet-analysis","tag-brim","tag-tools"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1437"}],"version-history":[{"count":14,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1437\/revisions"}],"predecessor-version":[{"id":1467,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/1437\/revisions\/1467"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}