Analyze a suspicious executable using VirusTotal and MalwareBazaar to extract IOCs, identify C2 infrastructure, MITRE ATT&CK techniques, and privilege escalation mechanisms.
You are part of the Threat Intelligence team in the SOC (Security Operations Center). An executable file has been discovered on a colleague's computer, and it's suspected to be linked to a Command and Control (C2) server, indicating a potential malware infection.Your task is to investigate this executable by analyzing its hash. The goal is to gather and analyze data beneficial to other SOC members, including the Incident Response team, to respond to this suspicious behavior efficiently.
Easy - Threat Intel | Completion Achievement
The provided hash is 248FCC901AFF4E4B4C48C91E4D78A939BF681C9A1BC24ADDC3551B32768F907B.
- Categorizing malware enables a quicker and clearer understanding of its unique behaviors and attack vectors. What category has Microsoft identified for that malware in VirusTotal?
By visiting the VirusTotal report and scrolling down on the main page, we can see the verdicts of multiple security vendors regarding this file. The Microsoft verdict will contain our answer:
- Clearly identifying the name of the malware file improves communication among the SOC team. What is the file name associated with this malware? Note: Don't include the file extension in the name.
We can find names associated with this file by navigating to Details > Names. Our answer does not contain a file extension:
- Knowing the exact timestamp of when the malware was first observed can help prioritize response actions. Newly detected malware may require urgent containment and eradication compared to older, well-documented threats. What is the UTC timestamp of the malware's first submission to VirusTotal?
The First Submission field is available in the Details > History pane.
- Understanding the techniques used by malware helps in strategic security planning. What is the MITRE ATT&CK technique ID for the malware's data collection from the system before exfiltration?
We can find the MITRE ATT&CH techniques associated with the malware by navigating to Behavior > MITRE ATT&CK Tactics and Techniques. Focusing on the Collection tactics, we can find a technique that fits our description:
- Following execution, which social media-related domain names did the malware resolve via DNS queries?
We can find information related to DNS queries by going to Behavior > Network Communication > DNS resolution. To find our answer, we need to observe domains associated with popular social media sites:
- Once the malicious IP addresses are identified, network security devices such as firewalls can be configured to block traffic to and from these addresses. Can you provide the IP address and destination port the malware communicates with?
There is plenty of information regarding network communications done by the malware. Let's try looking for something that explicitly mentions an IP address and a port number together. By navigating to Behavior > Network Communication > IP Traffic, we can find our answer:
- YARA rules are designed to identify specific malware patterns and behaviors. Using MalwareBazaar, what's the name of the YARA rule created by "
Varp0s" that detects the identified malware?
Let's navigate to MalwareBazaar and lookup our malware hash to find more information: sha256:248FCC901AFF4E4B4C48C91E4D78A939BF681C9A1BC24ADDC3551B32768F907B. Once we enter the database entry, we can navigate to the YARA signatures section and find the rule created with Varp0s.
- Understanding which malware families are targeting the organization helps in strategic security planning for the future and prioritizing resources based on the threat. Can you provide the different malware alias associated with the malicious IP address according to ThreatFox?
We can do a similar process to do some research on the malicious IP address and port found in Q6. Using the appropriate search query (ioc:77.91.124.55:19071) on ThreatFox, we will be met with a report containing the alternative malware alias related to this malicious address.
- By identifying the malware's imported DLLs, we can configure security tools to monitor for the loading or unusual usage of these specific DLLs. Can you provide the DLL utilized by the malware for privilege escalation?
After spending some time in the other threat intel sites, I returned to the VirusTotal report to find anything interesting. In the Details > Portable Executable Info > Imports, we can see a list of imported DLLs. One of them has enough capabilities to escalate privileges:
