Analyze memory images and event logs using MemProcFS, EvtxECmd, and Timeline Explorer to identify Andromeda bot IOCs, reconstruct its infection timeline, and attribute it to an APT group.
As a member of the DFIR team at SecuTech, you're tasked with investigating a security breach affecting multiple endpoints across the organization. Alerts from different systems suggest the breach may have spread via removable devices. You’ve been provided with a memory image from one of the compromised machines. Your objective is to analyze the memory for signs of malware propagation, trace the infection’s source, and identify suspicious activity to assess the full extent of the breach and inform the response strategy.
Medium - Endpoint Forensics | Completion Achievement
- Tracking the serial number of the USB device is essential for identifying potentially unauthorized devices used in the incident, helping to trace their origin and narrow down your investigation. What is the serial number of the inserted USB device?
Let's use MemProcFS to read data about the memdump inside Windows. Using the following command, we wil be able to navigate the memdump through File Explorer:
Once the banner appears, you should be able to open the memdump in the mounted M drive. Inside the registry, we should be able to find USB-related information in the HKLM\SYSTEM\ControlSet001\Enum\USBSTOR key, which is located in M:\registry\HKLM\SYSTEM\ControlSet001\Enum\USBSTOR. Inside, there is a single folder containing another directory named after the serial number of the USB device:
- Tracking USB device activity is essential for building an incident timeline, providing a starting point for your analysis. When was the last recorded time the USB was inserted into the system?
The Event Logs generated by Windows should contain information related to USB devices. Inside the M drive, we can find many evtx files inside the M:\misc\eventlog folder:
As mentioned in the Before You Start file at the beginning, we should use Evtxcmd to parse all of these files.
.\EvtxECmd.exe -d "M:\misc\eventlog" --csv "C:\Users\Administrator\Desktop\" --csvf evtx-output.csv
Now, let's open the evtx-output.csv on Timeline Explorer. Let's start with searching for usb strings to find any interesting events:
We are definitely looking for a USB Connection event, let's filter for that Map Description by typing that value into the text box under the header.
Now, we need to filter based on the previously found serial number value. The Payload Data3 field contains the serial IDs from the connected USBs, let's filter our logs with the number we found on Q1:
With these filters in place, we can find the last time when the USB was connected.
- Identifying the full path of the executable provides crucial evidence for tracing the attack's origin and understanding how the malware was deployed. What is the full path of the executable that was run after the PowerShell commands disabled Windows Defender protections?
The Set-MpPreference PowerShell cmdlet can be used to disable Windows Defender protections. Let's look in our processed logs for any instances of Set-MpPreference:
We can indeed observe that PowerShell was used to disable Windows Defender monitoring, let's look for the executable responsible for this under the Executable Info column:
- Identifying the bot malware’s C&C infrastructure is key for detecting IOCs. According to threat intelligence reports, what URL does the bot use to download its C&C file?
Looking deeper into the log that contained the Executable Info, we can find the hash of the image by reading the cell contents of the Payload field:
The SHA256 hash is 9535A9BB1AE8F620D7CBD7D9F5C20336B0FD2C78D1A7D892D76E4652DD8B2BE7. Let's research that hash on VirusTotal to find any information about contacted domains, which can be found by navigating to Behavior > Network Communication > HTTP Requests:
This ìn.php looks interesting, let's verify if its the C2 file we are looking for.
- Understanding the IOCs for files dropped by malware is essential for gaining insights into the various stages of the malware and its execution flow. What is the MD5 hash of the dropped .exe file?
Inside the VirusTotal report for the Trusted Installer file, we can find many exe files being mentioned:
Let's try searching for these filenames inside for Timeline Viewer to confirm if any of them were dropped into the victim's machine. Starting with Sahofivizu.exe, we can just look it up on Timeline Viewer to find any related logs:
This file must be our dropped EXE file, considered its creation was logged by Event Viewer. Let's read the associated hashes inside the Process creation log after the FileCreate log to find the MD5 hash:
- Having the full file paths allows for a more complete cleanup, ensuring that all malicious components are identified and removed from the impacted locations. What is the full path of the first DLL dropped by the malware sample?
Inside Timeline Viewer, we can filter the dropped DLL files by using the Payload Data3 field to filter for events coming from Image: E:\hidden\Trusted Installer.exe and the Payload Data4 field to filter for any values containing the dll string. By sorting the remaining logs based on the Line field, we can find which DLL file was dropped first. Using the Time Created timestamps would be the usual way to sort our data, but they all have the same value.
- Connecting malware to APT groups is crucial for uncovering an attack's broader strategy, motivations, and long-term goals. Based on IOCs and threat intelligence reports, which APT group reactivated this malware for use in its campaigns?
The VirusTotal page about the C2 file coming from anam0rph[.]su also mentions a threat intel poret that looks interesting: Turla: A Galaxy of Opportunity. Looking this title online, we can find a Mandiant/Google Cloud report discussing about a specific APT reactivating domains related to the malware we just analyzed:
