[{"content":"Scenario A multinational corporation has suffered a cyber attack resulting in the theft of sensitive data. The attack used a previously unseen variant of the BlackEnergy v2 malware. The security team obtained a memory dump from the infected machine and needs a SOC analyst to analyse it to understand the scope and impact of the attack.\nTool used: Volatility 3.\nInvestigation Q1. Which Volatility profile is best for this machine? Starting with windows.info to fingerprint the OS:\nCombining the fields gives the profile:\nNtMajorVersion 5 -\u0026gt; Windows XP NTBuildLab 2600.xpsp -\u0026gt; build 2600 CSDVersion 3 -\u0026gt; Service Pack 3 Is64Bit False -\u0026gt; x86 (32-bit) So: Win + XP + SP3 + x86.\nAnswer: WinXPSP3x86\nQ2. How many processes were running when the image was acquired? Running pslist:\nThe list shows 25 entries, but 6 of them are already terminated (taskmgr.exe, rootkit.exe, cmd.exe, and three notepad.exe). Counting only the active ones leaves 19.\nAnswer: 19\nQ3. What is the process ID of cmd.exe? From the same pslist output, the PID of cmd.exe is 1960.\nAnswer: 1960\nQ4. What is the name of the most suspicious process? pslist already surfaces a process named rootkit.exe, which is suspicious by its name alone. Confirming with pstree:\nIt is a child of explorer.exe and itself spawns cmd.exe, which is not normal behaviour.\nAnswer: rootkit.exe\nQ5. Which process shows the highest likelihood of code injection? Using malfind to look for suspicious memory regions:\nsvchost.exe shows clear signs of injection: the region starts with the 4D 5A bytes (MZ in ASCII), the header of a PE file, sitting in memory that should not contain an executable image.\nAnswer: svchost.exe\nQ6. There is an odd file referenced in the suspicious process. Provide its full path. Listing the file handles of the injected process (PID 880) with the handles plugin, filtered on type File:\nOne entry stands out: str.sys, which is not a standard name for a system driver and points to the rootkit\u0026rsquo;s kernel component.\nAnswer: C:\\WINDOWS\\system32\\drivers\\str.sys\nQ7. What is the name of the injected DLL loaded from the process? The ldrmodules plugin compares a process\u0026rsquo;s three module lists (InLoad, InInit, InMem). A DLL missing from one or more of these lists is a classic sign of stealthy injection:\nOne module stands out: msxml3r.dll is marked False across the lists, meaning it is hidden from the normal load order.\nAnswer: msxml3r.dll\nQ8. What is the base address of the injected DLL? Going back to the malfind output, the base address of the injected region is shown:\nAnswer: 0x980000\nIndicators of compromise (IOC) Type Value Suspicious process rootkit.exe Injected process svchost.exe (PID 880) Malicious driver str.sys Injected / hidden DLL msxml3r.dll (base 0x980000) OS profile WinXPSP3x86 MITRE ATT\u0026amp;CK mapping Tactic Technique ID Defense Evasion Process Injection T1055 Defense Evasion Rootkit T1014 Execution Command and Scripting Interpreter T1059 References CyberDefenders — BlackEnergy challenge Volatility Foundation — malfind, handles, ldrmodules plugin documentation MITRE ATT\u0026amp;CK — T1055 (Process Injection), T1014 (Rootkit) ","permalink":"https://zviarcyber.github.io/posts/blackenergy-cyberdefenders/","summary":"\u003ch2 id=\"scenario\"\u003eScenario\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003eA multinational corporation has suffered a cyber attack resulting in the theft of sensitive data.\nThe attack used a previously unseen variant of the BlackEnergy v2 malware. The security team\nobtained a memory dump from the infected machine and needs a SOC analyst to analyse it to\nunderstand the scope and impact of the attack.\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eTool used:\u003c/strong\u003e Volatility 3.\u003c/p\u003e\n\u003ch2 id=\"investigation\"\u003eInvestigation\u003c/h2\u003e\n\u003ch3 id=\"q1-which-volatility-profile-is-best-for-this-machine\"\u003eQ1. Which Volatility profile is best for this machine?\u003c/h3\u003e\n\u003cp\u003eStarting with \u003ccode\u003ewindows.info\u003c/code\u003e to fingerprint the OS:\u003c/p\u003e","title":"BlackEnergy v2 — Memory Forensics of a Rootkit with Volatility"},{"content":"Abstract A network forensics walkthrough of the CyberDefenders OpenWire challenge. Starting from a single PCAP and a tier-1 escalation about a public-facing server beaconing to suspicious IPs, I trace an Apache ActiveMQ compromise via CVE-2023-46604: from the initial remote code execution on the OpenWire port, through a malicious Spring XML payload that abuses java.lang.ProcessBuilder, down to a dropped reverse shell talking to two separate C2 servers.\nScenario During your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst about a public-facing server. The server has been flagged for outbound connections to multiple suspicious IPs. Following the incident response process, the host is isolated from the network and a packet capture is pulled from the NSM sensor. Your task is to analyse the PCAP and assess for signs of malicious activity.\nTool used: Wireshark.\nInvestigation Q1. What is the IP of the C2 server that communicated with our server? Opening the PCAP, the OpenWire protocol immediately stands out, with traffic involving 146.190.21.92. Following its TCP stream out of curiosity:\nThe stream shows a Spring ClassPathXmlApplicationContext being used to pull an invoice.xml from that same IP. That makes it the C2 server.\nAnswer: 146.190.21.92\nQ2. What is the port number of the exploited service? Inspecting the OpenWire frames, the recurring port is 61616, the ActiveMQ OpenWire default.\nAnswer: 61616\nQ3. What is the name of the vulnerable service? Looking up what runs on port 61616 confirms it is Apache ActiveMQ.\nAnswer: Apache ActiveMQ\nQ4. What is the IP of the second C2 server? Going to Statistics \u0026gt; Endpoints to list every host in the capture:\nThe victim (public server) is 134.209.197.3 and the first C2 is 146.190.21.92. That leaves two unknown addresses to check. Following their TCP streams and reading the content of the malicious payload reveals the second C2:\nAnswer: 128.199.52.72\nQ5. What is the name of the reverse shell executable dropped on the server? The reverse shell surfaced in the previous step: the dropped binary is named docker (masquerading as the legitimate Docker binary).\nAnswer: docker\nQ6. What Java class was invoked by the XML file to run the exploit? Reading the XML payload that was served, the bean definition at the top invokes java.lang.ProcessBuilder to execute commands on the host.\nAnswer: java.lang.ProcessBuilder\nQ7. What CVE identifier is associated with this vulnerability? Searching the behaviour (ActiveMQ OpenWire, remote class instantiation, RCE) points to a single, exact match.\nAnswer: CVE-2023-46604\nQ8. In which Java class and method was the validation step added by the vendor? The vendor fixed the flaw by adding a validation step so that only valid Throwable classes can be instantiated. Per the vendor patch and TrendMicro\u0026rsquo;s analysis, the check was added in:\nAnswer: BaseDataStreamMarshaller.createThrowable\nIndicators of compromise (IOC) Type Value C2 server #1 146.190.21.92 C2 server #2 128.199.52.72 Exploited service / port Apache ActiveMQ / 61616 (OpenWire) Malicious payload invoice.xml (remote Spring XML) Dropped reverse shell docker (masqueraded binary) Vulnerability CVE-2023-46604 MITRE ATT\u0026amp;CK mapping Tactic Technique ID Initial Access Exploit Public-Facing Application T1190 Execution Command and Scripting Interpreter T1059 Defense Evasion Masquerading (binary named docker) T1036 Command and Control Application Layer Protocol T1071 Command and Control Ingress Tool Transfer T1105 References CyberDefenders — OpenWire challenge NVD — CVE-2023-46604 Apache ActiveMQ security advisory and patch (BaseDataStreamMarshaller.createThrowable) TrendMicro — analysis of CVE-2023-46604 exploitation ","permalink":"https://zviarcyber.github.io/posts/openwire-cyberdefenders/","summary":"\u003ch2 id=\"abstract\"\u003eAbstract\u003c/h2\u003e\n\u003cp\u003eA network forensics walkthrough of the CyberDefenders \u003cstrong\u003eOpenWire\u003c/strong\u003e challenge. Starting from a\nsingle PCAP and a tier-1 escalation about a public-facing server beaconing to suspicious IPs, I\ntrace an Apache ActiveMQ compromise via \u003cstrong\u003eCVE-2023-46604\u003c/strong\u003e: from the initial remote code\nexecution on the OpenWire port, through a malicious Spring XML payload that abuses\n\u003ccode\u003ejava.lang.ProcessBuilder\u003c/code\u003e, down to a dropped reverse shell talking to two separate C2 servers.\u003c/p\u003e\n\u003ch2 id=\"scenario\"\u003eScenario\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003eDuring your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst about\na public-facing server. The server has been flagged for outbound connections to multiple\nsuspicious IPs. Following the incident response process, the host is isolated from the network\nand a packet capture is pulled from the NSM sensor. Your task is to analyse the PCAP and assess\nfor signs of malicious activity.\u003c/p\u003e","title":"OpenWire — Investigating an Apache ActiveMQ RCE (CVE-2023-46604)"},{"content":"Abstract A walkthrough of the LetsDefend Learn Sigma lab. The goal isn\u0026rsquo;t to run a tool, but to read a real Sigma rule — proc_creation_win_bitsadmin_download.yml — and understand how its sections (logsource, selection, condition, fields, tags) work together to detect an attacker abusing the legitimate Windows utility bitsadmin.exe to download malicious payloads. Understanding how a detection rule is built is what lets a SOC analyst know why an alert fired, judge false positives, and eventually write rules of their own.\nScenario A ransomware infection has been detected on a critical system. The malware encrypts sensitive documents and configuration files. The investigation suggests the attacker used the Windows BITS utility bitsadmin.exe to download additional payloads and to reach its command-and-control (C2) server.\nThe task is to review the provided Sigma rule and answer questions about how it detects this behaviour.\nRule file: C:\\Users\\LetsDefend\\Desktop\\ChallengeFile\\proc_creation_win_bitsadmin_download.yml\nQ1. Which executable file does this rule target? Opening the file, the selection_img block matches on the image name. The rule targets bitsadmin.exe.\nQ2. Which command-line option indicates a file transfer? Among the command-line selections, three options appear, but only one corresponds to an actual transfer: the /transfer option.\nQ3. Which logical expression in the condition field combines the criteria? The condition line ties the image match and the command-line match together:\ncondition: selection_img and (selection_cmd or all of selection_cli_*) the process must be bitsadmin.exe and either /transfer is present or all of the selection_cli_* groups match.\nQ4. Which field does the rule capture to show the command being executed? Just above the condition, the captured field is CommandLine — that\u0026rsquo;s what shows the analyst the exact command the attacker ran.\nQ5. Which single ATT\u0026amp;CK tactic tag is listed first? In the tags section, the first tactic listed is attack.defense_evasion (Defense Evasion). Bitsadmin/BITS abuse maps to T1197 — BITS Jobs, used for both defense evasion and persistence, which is why both tactics appear in the tags.\nQ6. What is the primary category of events this rule monitors? The logsource block defines this. The category is process_creation on Windows — the rule inspects newly created processes.\nQ7. Which command-line argument identifies HTTP-based downloads? selection_cli_2 targets the command line used for the download. To catch HTTP/HTTPS downloads it looks for http in the command line.\nQ8. Which command-line option must be present to create a new transfer? Back to Q2 — among the options not yet used, the one that creates a new BITS transfer is /create.\n","permalink":"https://zviarcyber.github.io/posts/learn-sigma-letsdefend/","summary":"\u003ch2 id=\"abstract\"\u003eAbstract\u003c/h2\u003e\n\u003cp\u003eA walkthrough of the LetsDefend \u003cstrong\u003eLearn Sigma\u003c/strong\u003e lab. The goal isn\u0026rsquo;t to run a tool, but to\n\u003cem\u003eread\u003c/em\u003e a real Sigma rule — \u003ccode\u003eproc_creation_win_bitsadmin_download.yml\u003c/code\u003e — and understand how its\nsections (\u003ccode\u003elogsource\u003c/code\u003e, \u003ccode\u003eselection\u003c/code\u003e, \u003ccode\u003econdition\u003c/code\u003e, \u003ccode\u003efields\u003c/code\u003e, \u003ccode\u003etags\u003c/code\u003e) work together to detect an\nattacker abusing the legitimate Windows utility \u003ccode\u003ebitsadmin.exe\u003c/code\u003e to download malicious payloads.\nUnderstanding how a detection rule is built is what lets a SOC analyst know \u003cem\u003ewhy\u003c/em\u003e an alert\nfired, judge false positives, and eventually write rules of their own.\u003c/p\u003e","title":"Learn Sigma — Reading a Detection Rule for Bitsadmin Abuse"},{"content":"Scenario As a cybersecurity analyst at TechSecure Corp, you are alerted to unusual activity in the company\u0026rsquo;s Active Directory environment. Initial reports suggest unauthorized access and possible privilege escalation. Your task is to analyse the provided logs to uncover the extent of the attack and identify the malicious actions taken by the attacker.\nTools used: Splunk, Event Log Explorer.\nInvestigation Q1. What is the malicious file used for initial access? Hunting for process-creation events (Sysmon Event ID 1) on the most likely target (the Office workstation), filtering for cmd/powershell images:\nindex=shadowroast AND \u0026#34;event.code\u0026#34;=1 AND \u0026#34;winlog.computer_name\u0026#34;=\u0026#34;Office-PC.CORPNET.local\u0026#34; AND (\u0026#34;winlog.event_data.Image\u0026#34;=\u0026#34;*cmd*\u0026#34; OR \u0026#34;winlog.event_data.Image\u0026#34;=\u0026#34;*powershell*\u0026#34;) A suspicious process stands out: AdobeUpdater.exe, run by user sanderson, with PowerShell spawned underneath it.\nAnswer: AdobeUpdater.exe\nQ2. What is the registry Run key name created for persistence? Pivoting to registry-modification events (Sysmon Event ID 13) and filtering for Run paths:\nindex=shadowroast AND \u0026#34;event.code\u0026#34;=13 AND \u0026#34;winlog.computer_name\u0026#34;=\u0026#34;Office-PC.CORPNET.local\u0026#34; AND winlog.event_data.TargetObject=*Run* A single entry comes back, tied to the malicious file, with the key name visible.\nAnswer: wyW5PZyF\nQ3. What is the full path of the directory used to store dropped tools? Going back to Q1, the PowerShell process tied to AdobeUpdater.exe has process ID 4780. Hunting on that PID (as process or parent):\nindex=\u0026#34;shadowroast\u0026#34; AND event.code=1 AND winlog.computer_name=Office-PC.CORPNET.local AND (winlog.event_data.ProcessId=4780 OR winlog.event_data.ParentProcessId=4780) Two entries return; one is irrelevant, the other shows Mimikatz being run from the staging directory, revealing where the attacker keeps their tooling.\nAnswer: C:\\Users\\Default\\AppData\\Local\\Temp\\\nQ4. What tool was used for privilege escalation and credential harvesting? Everything tied to the staging directory is worth hunting:\nindex=\u0026#34;shadowroast\u0026#34; AND event.code=1 AND winlog.computer_name=Office-PC.CORPNET.local AND \u0026#34;winlog.event_data.CurrentDirectory\u0026#34;=\u0026#34;C:\\\\Users\\\\Default\\\\AppData\\\\Local\\\\Temp\\\\\u0026#34; (The path is double-escaped because of the SPL syntax.)\nTwo tools show up: Mimikatz, and Rubeus hiding under the name BackupUtility.exe. Rubeus was used for an AS-REP Roasting attack, targeting accounts with Kerberos pre-authentication disabled to extract crackable hashes. The attacker then ran Mimikatz (as DefragTool.exe) under a different parent user, confirming a second compromised account, CORPNET\\tcooper, in addition to the earlier CORPNET\\sanderson.\nAnswer: Rubeus\nQ5. Was credential harvesting successful? If so, which domain account was compromised? As seen in Q4, the second compromised account is tcooper.\nAnswer: tcooper\nQ6. What tool registered a rogue Domain Controller to manipulate AD data? Registering a rogue DC is the DCShadow technique (a Mimikatz capability). AD schema/object changes are logged under Event ID 4929:\nindex=\u0026#34;shadowroast\u0026#34; AND event.code=4929 The log confirms Mimikatz behind the rogue DC registration.\nAnswer: mimikatz\nQ7. What is the first command used to enable RDP for lateral movement? Enabling RDP means setting the registry value fDenyTSConnections to 0. Hunting command lines for it:\nindex=\u0026#34;shadowroast\u0026#34; AND event.code=1 AND winlog.event_data.CommandLine=*fDenyTSConnections* It was executed on DC01 and the file server, consistent with lateral movement.\nAnswer:\nr e g a d d \" h k l m \\ s y s t e m \\ c u r r e n t c o n t r o l s e t \\ c o n t r o l \\ t e r m i n a l s e r v e r \" / f f D e n y T S C o n n e c t i o n s / t R E G _ D W O R D / d 0 Q8. What is the name of the archive created after compressing confidential files? Searching the file server for file-creation events (Sysmon Event ID 11) with archive extensions:\nindex=\u0026#34;shadowroast\u0026#34; AND winlog.computer_name=FileServer.CORPNET.local AND event.code=11 AND (winlog.event_data.TargetFilename=*.zip OR winlog.event_data.TargetFilename=*.7z OR winlog.event_data.TargetFilename=*.rar) The log shows the archive name.\nAnswer: CrashDump.zip\nIndicators of compromise (IOC) Type Value Initial access binary AdobeUpdater.exe Persistence Run key wyW5PZyF Tool staging directory C:\\Users\\Default\\AppData\\Local\\Temp\\ Rubeus (masqueraded) BackupUtility.exe Mimikatz (masqueraded) DefragTool.exe Compromised accounts sanderson, tcooper Exfil archive CrashDump.zip MITRE ATT\u0026amp;CK mapping Tactic Technique ID Execution User Execution: Malicious File T1204.002 Persistence Registry Run Keys / Startup Folder T1547.001 Defense Evasion Masquerading: Rename System Utilities T1036.005 Credential Access Steal or Forge Kerberos Tickets: AS-REP Roasting T1558.004 Credential Access OS Credential Dumping: LSASS Memory T1003.001 Defense Evasion Rogue Domain Controller (DCShadow) T1207 Lateral Movement Remote Services: RDP T1021.001 Collection Archive Collected Data T1560.001 References CyberDefenders — ShadowRoast challenge MITRE ATT\u0026amp;CK — T1558.004 (AS-REP Roasting), T1207 (Rogue Domain Controller), T1560.001 (Archive Collected Data) ","permalink":"https://zviarcyber.github.io/posts/shadowroast-cyberdefenders/","summary":"\u003ch2 id=\"scenario\"\u003eScenario\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003eAs a cybersecurity analyst at TechSecure Corp, you are alerted to unusual activity in the company\u0026rsquo;s\nActive Directory environment. Initial reports suggest unauthorized access and possible privilege\nescalation. Your task is to analyse the provided logs to uncover the extent of the attack and\nidentify the malicious actions taken by the attacker.\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eTools used:\u003c/strong\u003e Splunk, Event Log Explorer.\u003c/p\u003e\n\u003ch2 id=\"investigation\"\u003eInvestigation\u003c/h2\u003e\n\u003ch3 id=\"q1-what-is-the-malicious-file-used-for-initial-access\"\u003eQ1. What is the malicious file used for initial access?\u003c/h3\u003e\n\u003cp\u003eHunting for process-creation events (Sysmon Event ID 1) on the most likely target (the Office\nworkstation), filtering for \u003ccode\u003ecmd\u003c/code\u003e/\u003ccode\u003epowershell\u003c/code\u003e images:\u003c/p\u003e","title":"ShadowRoast — Threat Hunting an Active Directory Attack with Splunk"},{"content":"Scenario You are a cybersecurity analyst at Globex Corp. An employee opened an email attachment claiming to be an order specification, which actually carried a JavaScript file designed to deploy AsyncRAT. The malware evades detection efficiently. To secure the network, you must analyse the attachment, reverse-engineer AsyncRAT\u0026rsquo;s obfuscation techniques, and determine the scope of the infiltration.\nTools used: obf-io.deobfuscate.io, CyberChef, DnSpy, the browser console, and PowerShell Get-FileHash.\nInvestigation Q1. What is the name of the variable that conceals the obfuscated code? Opening the script, the malicious logic is buried under heavy obfuscation:\nRunning it through obf-io to make it readable:\nUsing the browser console with console.log(script) (skipping the last variable, which throws an error) prints the deobfuscated command and exposes the variable holding the payload:\nAnswer: Codigo\nQ2. What URL is used to download the second stage? Taking the content of Codigo into CyberChef and substituting the placeholder words (\u0026ldquo;queen\u0026rdquo; and \u0026ldquo;king\u0026rdquo;) back to their real characters before decoding reveals the stage-two URL:\nAnswer: https://gcdnb.pbrd.co/images/rYspxkzT3K6k.png\nQ3. What marker indicates the start of the encoded code? On the same decoded output, the string that signals where the embedded payload begins is clearly visible.\nAnswer: \u0026lt;\u0026lt;BASE64_START\u0026gt;\u0026gt;\nQ4. What is the MD5 hash of the extracted second-stage PE? Opening the downloaded PNG in a text editor, the data after the \u0026lt;\u0026lt;BASE64_START\u0026gt;\u0026gt; marker is the base64 of a PE. Decoding it in CyberChef confirms a Portable Executable, which can be saved and analysed:\nA quick PowerShell Get-FileHash -Algorithm MD5 gives the hash:\nAnswer: C1AA076CA869A7520CA2E003B7C02AB3\nQ5. What is the full registry key used for persistence? Loading the payload into DnSpy and examining ClassLibrary3 / Run(), the registry path is present but stored in reverse. Running it back through CyberChef\u0026rsquo;s reverse function reveals it:\nAnswer: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\nQ6. What URL downloads the third stage? Scrolling further in the decompiled code, a StrReverse string stands out, an https written backwards is the giveaway. Reversing it gives the stage-three URL:\nAnswer: https://web.archive.org/web/20240701132151if_/https://gcdnb.pbrd.co/images/L3GM1EngRrYs.png\nQ7. What is the MD5 hash of the extracted third-stage PE? Same technique as stage two: download the image, take the data between the base64 start and end markers, reverse it first, then decode in CyberChef to recover the PE, then Get-FileHash for the MD5:\nAnswer: 3C63488040BB51090F2287418B3D157D\nIndicators of compromise (IOC) Type Value Obfuscation variable Codigo Base64 marker \u0026lt;\u0026lt;BASE64_START\u0026gt;\u0026gt; Stage-two URL https://gcdnb.pbrd.co/images/rYspxkzT3K6k.png Stage-two PE (MD5) C1AA076CA869A7520CA2E003B7C02AB3 Persistence key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run Stage-three URL https://web.archive.org/web/20240701132151if_/https://gcdnb.pbrd.co/images/L3GM1EngRrYs.png Stage-three PE (MD5) 3C63488040BB51090F2287418B3D157D MITRE ATT\u0026amp;CK mapping Tactic Technique ID Initial Access Phishing: Spearphishing Attachment T1566.001 Execution Command and Scripting Interpreter: JavaScript T1059.007 Execution Command and Scripting Interpreter: PowerShell T1059.001 Defense Evasion Obfuscated Files or Information T1027 Defense Evasion Steganography (PE hidden in PNG) T1027.003 Persistence Registry Run Keys / Startup Folder T1547.001 Command and Control Ingress Tool Transfer T1105 References CyberDefenders — AsyncRAT challenge obf-io deobfuscator, CyberChef, DnSpy MITRE ATT\u0026amp;CK — T1566.001, T1027.003, T1547.001 ","permalink":"https://zviarcyber.github.io/posts/asyncrat-cyberdefenders/","summary":"\u003ch2 id=\"scenario\"\u003eScenario\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003eYou are a cybersecurity analyst at Globex Corp. An employee opened an email attachment claiming\nto be an order specification, which actually carried a JavaScript file designed to deploy\nAsyncRAT. The malware evades detection efficiently. To secure the network, you must analyse the\nattachment, reverse-engineer AsyncRAT\u0026rsquo;s obfuscation techniques, and determine the scope of the\ninfiltration.\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003e\u003cimg alt=\"Scenario\" loading=\"lazy\" src=\"/img/asyncrat/01-scenario.png\"\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eTools used:\u003c/strong\u003e \u003ca href=\"https://obf-io.deobfuscate.io/\"\u003eobf-io.deobfuscate.io\u003c/a\u003e, \u003ca href=\"https://gchq.github.io/CyberChef/\"\u003eCyberChef\u003c/a\u003e, DnSpy, the browser console, and PowerShell \u003ccode\u003eGet-FileHash\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"investigation\"\u003eInvestigation\u003c/h2\u003e\n\u003ch3 id=\"q1-what-is-the-name-of-the-variable-that-conceals-the-obfuscated-code\"\u003eQ1. What is the name of the variable that conceals the obfuscated code?\u003c/h3\u003e\n\u003cp\u003eOpening the script, the malicious logic is buried under heavy obfuscation:\u003c/p\u003e","title":"AsyncRAT — Unpacking a Multi-Stage Loader (CyberDefenders)"},{"content":"Scenario During a routine IT security check at GlobalTech Industries, abnormal network traffic was detected from multiple workstations. Employees\u0026rsquo; search queries were being redirected to unfamiliar websites. Your task is to investigate the incident and gather as much information as possible.\nTool used: VirusTotal (plus open-source threat intel).\nInvestigation Q1. What is the name of the malware family causing the abnormal traffic? The challenge provides a file hash, so the starting point is a VirusTotal lookup. The file is flagged by most vendors, with a popular threat label of trojan.msil/polazert and YARA matches for Windows_Trojan_Jupyter and Jupyter_Infostealer_DLL. That label does not match the expected answer format, so I checked the Community tab:\nA community comment names the family directly and links to Red Canary\u0026rsquo;s report:\nAnswer: Yellow Cockatoo (also tracked as Jupyter / SolarMarker)\nQ2. What is the common filename associated with the malware? On VirusTotal, the file name for the sample is shown next to the hash.\nAnswer: 111bc461-1ca8-43c6-97ed-911e0e69fdf8.dll\nQ3. What is the compilation timestamp of the malware? Under Details \u0026gt; Portable Executable Info \u0026gt; Header, the compilation timestamp is listed.\nAnswer: 2020-09-24 18:26:47 UTC\nQ4. When was the malware first submitted to VirusTotal? Still under Details, the History section shows the first submission date.\nAnswer: 2020-10-15 02:47:37 UTC\nQ5. What is the name of the .dat file dropped in the AppData folder? Red Canary\u0026rsquo;s report on Yellow Cockatoo documents a randomly generated string written to a .dat file in the AppData\\Roaming folder, used as a unique host identifier.\nAnswer: solarmarker.dat (full path %USERPROFILE%\\AppData\\Roaming\\solarmarker.dat)\nQ6. What is the C2 server the malware communicates with? The same Red Canary report lists the C2 the malware contacts to share host information and retrieve commands.\nAnswer: gogohid[.]com\nIndicators of compromise (IOC) Type Value Family Yellow Cockatoo / Jupyter / SolarMarker SHA-256 30e527e45f50d2ba82865c5679a6fa998ee0a1755361ab01673950810d071c85 Filename 111bc461-1ca8-43c6-97ed-911e0e69fdf8.dll Dropped file %USERPROFILE%\\AppData\\Roaming\\solarmarker.dat C2 domain gogohid[.]com C2 IP (subnet) 45.146.165[.]X (e.g. 45.146.165[.]221) MITRE ATT\u0026amp;CK mapping Tactic Technique ID Initial Access Drive-by Compromise (SEO / search redirects) T1189 Execution User Execution: Malicious File T1204.002 Defense Evasion Masquerading T1036 Command and Control Application Layer Protocol: Web Protocols T1071.001 References CyberDefenders — YellowRAT challenge Red Canary — Yellow Cockatoo analysis VirusTotal ","permalink":"https://zviarcyber.github.io/posts/yellow-cyberdefenders/","summary":"\u003ch2 id=\"scenario\"\u003eScenario\u003c/h2\u003e\n\u003cblockquote\u003e\n\u003cp\u003eDuring a routine IT security check at GlobalTech Industries, abnormal network traffic was detected\nfrom multiple workstations. Employees\u0026rsquo; search queries were being redirected to unfamiliar\nwebsites. Your task is to investigate the incident and gather as much information as possible.\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eTool used:\u003c/strong\u003e VirusTotal (plus open-source threat intel).\u003c/p\u003e\n\u003ch2 id=\"investigation\"\u003eInvestigation\u003c/h2\u003e\n\u003ch3 id=\"q1-what-is-the-name-of-the-malware-family-causing-the-abnormal-traffic\"\u003eQ1. What is the name of the malware family causing the abnormal traffic?\u003c/h3\u003e\n\u003cp\u003eThe challenge provides a file hash, so the starting point is a VirusTotal lookup. The file is\nflagged by most vendors, with a popular threat label of \u003ccode\u003etrojan.msil/polazert\u003c/code\u003e and YARA matches for\n\u003ccode\u003eWindows_Trojan_Jupyter\u003c/code\u003e and \u003ccode\u003eJupyter_Infostealer_DLL\u003c/code\u003e. That label does not match the expected\nanswer format, so I checked the \u003cstrong\u003eCommunity\u003c/strong\u003e tab:\u003c/p\u003e","title":"YellowRAT — Threat Intelligence on Yellow Cockatoo with VirusTotal"}]