Analyze malware artifacts using threat intelligence platforms like VirusTotal to identify IOCs, C2 servers, and understand adversary tactics.
During a regular IT security check at GlobalTech Industries, abnormal network traffic was detected from multiple workstations. Upon initial investigation, it was discovered that certain employees' search queries were being redirected to unfamiliar websites. This discovery raised concerns and prompted a more thorough investigation. Your task is to investigate this incident and gather as much information as possible.
Easy - Threat Intel | Completion Achievement
The provided file was a single hash:
malware hash: 30E527E45F50D2BA82865C5679A6FA998EE0A1755361AB01673950810D071C85
Use this hash on online threat intel platforms (e.g., VirusTotal, Hybrid Analysis) to complete the lab analysis.- Understanding the adversary helps defend against attacks. What is the name of the malware family that causes abnormal network traffic?
We are going to use the Graph view on VirusTotal to find more information. You will need to sign it to VirusTotal to access this convenient view. On VirusTotal, enter the provided hash, navigate to Relations, and select the Graph view. One name stands out:
Upon entering this collection, we will find that our hash appears in the Files section, which proves that it belongs to this malware family.
- As part of our incident response, knowing common filenames the malware uses can help scan other workstations for potential infection. What is the common filename associated with the malware discovered on our workstations?
Returning back to the VirusTotal report, we can find our answer in the Details > Names section. The first name is usually the most common name, which is our answer.
- Determining the compilation timestamp of malware can reveal insights into its development and deployment timeline. What is the compilation timestamp of the malware that infected our network?
The Compilation Timestamp value can be found in the Details > Portable Executable Info.
- Understanding when the broader cybersecurity community first identified the malware could help determine how long the malware might have been in the environment before detection. When was the malware first submitted to VirusTotal?
We need to return the first time this malware was submitted to VirusTotal. This bit of data can be found in the Details > History section.
- To completely eradicate the threat from Industries' systems, we need to identify all components dropped by the malware. What is the name of the .dat file that the malware dropped in the AppData folder?
I tried looking at the Dropped files section on VirusTotal but I found nothing. I decided to do some research online and went to Google to find a more detailed report. Using the yellow cockatoo rat dropped files query on Google, I found this site which led me to this more detailed report by Red Canary. After looking for the string AppData, I found that the .dat file mentioned in the question refers to a file created as a shortcut script:
- It is crucial to identify the C2 servers with which the malware communicates to block its communication and prevent further data exfiltration. What is the C2 server that the malware is communicating with?
The answer to this question is also shown in the above screenshot as the domain name that the malware uses to communicate back to the attacker.