Network Attack Investigations and Malware Analysis

Course Administration and Schedule Updates

• Administrative Delays and Review Processes:

  • An expedited review process regarding the 725 zones / 1725 zones declaration experienced significant delays, stretching to $2\,\text{months}$ despite two requested modifications being submitted over a week prior.

  • Declarations require official approval on institutional lists before final sign-off can be completed.

• Lecture Schedule Reshuffling:

  • Unfinished group exercises from the previous week necessitated a schedule adjustment.

  • Two planned lectures were condensed into a single comprehensive session scheduled for Thursday.

  • The current session is entirely dedicated to two practical, hands-on activity demonstrations focusing on network attack investigations and Security Information and Event Management (SIEM) data correlation.

Activity 1: Malware Traffic Analysis and Email Forensics

• Overview of Investigation Setup:

  • Source material is derived from real-world attack data captured via a honeypot deployment hosted on malwaretrafficanalysis.net.

  • Scenario workflow: A malicious email with a compressed attachment was downloaded and executed inside the target honeypot environment, resulting in a host infection while recording network packet captures (PCAP).

  • Available investigative artifacts: Malicious email file (.eml format) containing headers and raw payload, alongside a Wireshark packet capture (.pcap) file.

  • Missing data source: Endpoint Detection and Response (EDR) telemetry is unavailable for this artifact set, requiring Network Detection and Response (NDR) methodologies.

Email Header Diagnostic and Domain Reputation Analysis

• Raw Email Characteristics:

  • The raw email content and body payload spans approximately $6000$ lines of code, containing raw binary streams and encoded message headers.

• Header Diagnostic via MX Toolbox:

  • Sender Policy Framework (SPF) validation passed successfully.

  • DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC) alignment checks failed due to unenabled or missing security policies.

  • Mail server IP address was extracted from the Received routing headers.

• VirusTotal and IP Intelligence Query:

  • Querying the extracted mail server IP address across VirusTotal returned detections from $3$ security vendors flagging the IP for spam and malware distribution.

  • The malicious attack originated in February.

  • Autonomous System (AS) geographical tracing maps the mail server IP to Vietnam.

  • Registration details indicate the IP address was assigned directly to an individual person, suggesting either a compromised user system or a rogue mail server setup.

Attachment Payload and Hash Analysis

• Archive Artifact Extraction:

  • The email payload delivered a compressed RAR archive file (.rar).

  • Inside the RAR archive resides an executable batch file script (.bat).

• Hash Verification and Threat Intelligence:

  • Cryptographic hash values calculated for both the outer RAR archive and the inner batch file were queried on VirusTotal.

  • Detections positively identified the payload hashes as belonging to a malicious Trojan family.

• Automated Sandbox Behavior Profiling:

  • Hybrid Analysis (hybrid-analysis.com) is utilized for analyzing dynamic file behavior, static search strings, and report archives.

  • Note on platform updates: Specific file collection features and retired modules were phased out $2\,\text{to}\,4\,\text{days}$ prior to the analysis session.

Network Packet Capture Analysis in Wireshark

• Wireshark Traffic Triage Strategy:

  • Domain Name System (DNS) and HTTP/FTP protocols serve as primary baseline filters to establish initial Indicators of Compromise (IOCs).

• DNS Filtering and Destination Resolution:

  • Initial DNS queries revealed distinct connections established to Google Drive IP endpoints, ipapi.com, and a remote FTP server at corrodeegos.com.

• Google Drive Traffic Analysis:

  • First Google Drive IP Destination ($142.250.x.138$):

  • Standard TCP three-way handshake initiated.

  • Followed by application data transfer totaling $9\,\text{KB}$ downloaded to the host.

  • Second Google Drive IP Destination ($142.251.186.132$):

  • TCP handshake initiated.

  • Substantial HTTP application data transfer executed, retrieving a total of $280\,\text{KB}$ of data from Google Drive down to the victim host machine.

• Environment Check and Evasion via ipapi.com:

  • Connection established to IP address $289.51.121$ (associated with ipapi.com).

  • HTTP Request Path: GET /?fields=hosting.

  • Service Mechanism: ipapi.com evaluates whether the caller's IP address belongs to a commercial data center or Virtual Private Server (VPS) provider.

  • Evasion Purpose: Serves as an anti-analysis / sandbox detection check implemented by malware to determine if it is executing inside a research honeypot/analysis machine versus an authentic user endpoint.

  • Following the TCP/HTTP stream reveals the server response string: {"hosting": false}.

• Data Exfiltration via Unencrypted FTP (corrodeegos.com):

  • Unencrypted FTP data channels were leveraged for data exfiltration and C2 operations.

  • Extracted FTP Streams (Exfiltrated Data Contents):

  • Host Metadata: Exfiltrated system parameters including system boot time, current username, hostname, operating system release details, CPU configuration, and total RAM capacity.

  • Email Client Credentials: Targeted Mozilla Thunderbird stored session data. Plaintext credentials extracted for victim account Jane Roberts (including Gmail account username, IMAP password, and SSMTP password).

  • Session Tokens: Active session OAuth authentication tokens retrieved from the Thunderbird application profile.

  • Contact Records: Plaintext file exfiltrated under the filename contacts_thunderbird.txt, containing harvested address book contacts intended for secondary malware propagation.

GooLoader and Agent Tesla Malware Deep Dive

• Delivery Mechanism (GooLoader):

  • GooLoader acts as the primary downloader vector, utilizing legitimate cloud hosting services (Google Drive) to host, retrieve, and execute secondary payloads while bypassing traditional perimeter controls.

• Execution Payload (Agent Tesla):

  • The secondary executable payload deployed via the batch script is classified as Agent Tesla.

  • Operational History: Agent Tesla is an established Remote Access Trojan (RAT) and credential stealer active since $2014$ (operating for over $12\,\text{years}$).

  • Core Functionality: Designed to harvest system information, extract saved browser and email credentials, hijack active OAuth tokens, and exfiltrate stolen data over protocols such as FTP, SMTP, or HTTP.

Activity 2: SIEM Security Operations Center Analysis in Splunk

• Scenario Setup:

  • Incident Response investigation centered on the Gotham City Police Department web infrastructure.

  • Incident trigger: Threat actors posted a public taunt on Pastebin stating "We see you Bruce Wayne", claiming complete compromise of the target organization's public website domain.

• Ingested SIEM Data Sources:

  • FortiGate: Perimeter network firewall log streams.

  • IIS: Microsoft Internet Information Services web server access logs.

  • Suricata: Network Intrusion Detection System (NIDS) alert streams.

Suricata NIDS Alert Analysis and Threat Identification

• Querying Alert Distributions:

  • Initial domain string search generated $47$ distinct Suricata alert signatures across the dataset.

  • Default display limits view to $10$ top entries; query adjusted to display top $50$ signatures.

• Scanner Activity Identification:

  • High-volume Suricata alerts (including SFTP/FTP password exposure and web application probe signatures) were mapped to automated vulnerability scanning software (e.g., ZoePAT / OWASP Zap).

  • Automated scanning tools generate high log noise by systematically probing target web applications for misconfigurations.

Web Server Log Correlation and Backdoor Discovery

• Threat Actor IP Profiling:

  • Correlating IIS web server logs identified the specific remote public IP address driving automated scanning probes over a continuous $2\,\text{hour}$ attack window.

  • Cross-referencing traffic identified two external public IP addresses interacting with the server, alongside local internal network IP communication.

• Joomla CMS Target Exploitation:

  • The targeted web application was running the Joomla Content Management System (CMS).

  • Threat actor executed hundreds of HTTP POST requests across two primary URI endpoints:

  • /administrator/index.php: Targeting the Joomla admin management interface.

  • /agent.php: Interrogated $194$ distinct times.

• Malicious Web Shell Deployment:

  • Analysis of HTTP payload streams confirms the threat actor leveraged an exploit within a Joomla installer module to successfully upload an obfuscated PHP script named agent.php onto the server.

  • Subsequent HTTP POST interactions with agent.php contained obfuscated, encoded command strings designed to execute arbitrary system code on the host web server.

Interactive Q&A and Incident Response Discussions

• Question: What are the primary Indicators of Compromise (IOCs) to extract immediately from a suspicious phishing email?

  • Response: Key IOCs include origin IP addresses, file hash values (MD5/SHA256) of attachments, domain names, and embedded payload URLs.

• Question: How do malware authors leverage services like ipapi.com during execution?

  • Response: Malware issues API queries to check if its current public IP belongs to a hosting provider or data center ("hosting": true). If true, it assumes execution within an analyst's virtual sandbox or honeypot and halts execution to evade detection.

• Question: What is the significance of seeing HTTP POST requests to agent.php inside the IIS logs?

  • Response: It indicates that an attacker successfully placed an obfuscated PHP web shell backdoor onto the server (using Joomla installer functionality) and is actively transmitting commands via HTTP request body fields.

• Discussion on Incident Response (IR) Containment Strategy:

  • Student Comment (Pascal): If all automated scanning probes returned standard error status codes like HTTP 403 Forbidden or HTTP 404 Not Found, system isolation is unnecessary because no breach occurred.

  • Counter-Analysis / Resolution: Detailed log reconstruction proved the attacker successfully dropped the agent.php web shell payload. Once active command execution via a backdoor is confirmed, immediate host network isolation is mandatory to contain lateral movement.