Network Analysis - Malware Compromise

https://blueteamlabs.online/home/challenge/network-analysis-malware-compromise-e882f32908

Scenario

A SOC Analyst at Umbrella Corporation is going through SIEM alerts and sees the alert for connections to a known malicious domain. The traffic is coming from Sara’s computer, an Accountant who receives a large volume of emails from customers daily. Looking at the email gateway logs for Sara’s mailbox there is nothing immediately suspicious, with emails coming from customers. Sara is contacted via her phone and she states a customer sent her an invoice that had a document with a macro, she opened the email and the program crashed. The SOC Team retrieved a PCAP for further analysis.A SOC Analyst at Umbrella Corporation is going through SIEM alerts and sees the alert for connections to a known malicious domain.

Challenge Questions

What’s the private IP of the infected host?

The infected host's internal IP address is 10.11.27.101. Initial PCAP analysis shows an outbound DNS query from this IP attempting to resolve klychenogg.com. Threat intelligence queries on VirusTotal confirm both the domain and its resolved IP address are malicious indicators.

Figure 1: DNS request and response packets.

Figure 2: VirusTotal malicious domain confirmation.

What’s the malware binary that the macro document is trying to retrieve?

Inspecting the HTTP request stream initiated after the macro execution reveals an outbound request targeting the executable payload spet10.spr.

Figure 3: The HTTP stream showing the filename request as spet10.spr.

From what domain HTTP requests with GET /images/ are coming from?

Filtering the PCAP using http.request.method == GET and isolating requests targeting the /images/ path exposes the Host header value cochrimato.com.

Figure 4: Host header in /images/ request.

The SOC Team found Dridex, a follow-up malware from Ursnif infection, to be the culprit. The customer who sent her the macro file is compromised. What’s the full URL ending in .rar where Ursnif retrieves the follow-up malware from?

Filtering for HTTP GET requests originating from the infected host (10.11.27.101) reveals the retrieval of the secondary payload stage at http://95.181.198.231/oiioiashdqbwe.rar.

Figure 5: The follow-up request to download the .rar malware.

What is the Dridex post-infection traffic IP addresses beginning with 185.?

Following the completion of the .rar payload download, the host establishes a new TCP three-way handshake with the external IP address 185.244.150.230.

Figure 6: 185.244.150.230 connection after follow-up malware download.