• Home

  • Documents

  • Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a...
24
Classification: //SecureWorks/Confidential - Limited External Distribution: Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU

Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

  • Upload
    others

  • View
    13

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Fileless malwarebeyond a cursory glance

Alin PUNCIOIU

Lucian SARARU

Page 2: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Agenda

Overview

Trends

Modus Operandi

Case Study

2

Page 3: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Overview

Security Landscape

3

Threat Actors in 2017

Reactive Cyber Security Operations

Page 4: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Overview

Enterprise Security

4

Page 5: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Fileless malware

Google trends

5

Page 6: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Fileless malware

Investigation

6

In-depth analysisDiscover IoCsFind signatures for intrusion

detection systems

Assess DamageHow to measure and

contain the damage

Identify vulnerabilitiesExactly what happened

Determine

sophistication levelEnsure you’ve located all

infected machines and files

Page 7: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Modus operandi

Scorecard

7

Capture

events/activity

Malware analysisEndpoint forensics

Binary extraction

Incident

Response and

Security

Analytics

Page 8: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Modus operandi

Aiming

8

Stealth Privilege

escalation

Information

gathering Persistence

Page 9: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Modus operandi

Persistence

9

Windows Management Instrumentation

%System%\wbem\ repository

Windows registry/ service

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\[ ]

RUNDLL32.EXE <dll name>,<entry point> <optional arguments>

Powershell

powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop

iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp

‘HKCU:\Software\Classes\HNKINZHBHZCOBE’).ZUEMAUZYQQBL)));

Page 10: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Case study

10

Page 11: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Preparation

Snort rule

11

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:“51234 VID51234

Cryptocurrency Stratum Mining Pool Login Detected";

flow:established,to_server; dsize:<300; content:"|7b 22|"; depth:2;

content:"|22|method|22|"; nocase; content:"|22|login|22|"; nocase;

distance:0; content:"|22|params|22|"; nocase; distance:0;

content:"|22|agent|22|"; distance:0; content:"|7d|"; distance:0;

pcre:"/^\x7b\x22.*\x7d$/"; metadata:ari-balanced drop, policy

balanced drop, ari-connectivity alert, policy connectivity alert,

ari-security drop, policy security drop, ruleset-release 316;

priority:3; rev:3; sid:1751654; classtype:unknown; )

Page 12: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Identification

Cryptocurrency Mining Pool Login Detected

12

XMRig is high performance

Monero (XMR) CPU miner,

with the official full

Windows support.

Page 13: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.

Technical investigation

1st glance

13

Page 14: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

1. Fetch the files:

NTUSER.DAT, USRCLASS.DAT, SECURITY,

SYSTEM, SOFTWARE.

2. Usage of the registry for persistence:

a) autorun;

b) PowerShell scripts;

c) DLL modules.

Technical investigation

In-depth analysis

Page 15: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:© SecureWorks, Inc.15

a) Autorun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -

WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop iex

([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp

'HKCU:\Software\Classes\HAZKSOSOTHSFA').VQGA)));

Technical investigation

In-depth analysis

Page 16: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

b. next stage script:

HKEY_CURRENT_USER\Software\Classes\[Random

String]

Key VQGA contains the base64 encoded script which has 35.456 characters.

Technical investigation

In-depth analysis

Page 17: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Technical investigation

In-depth analysis

BASE64

ENCODED

SCRIPT

Page 18: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

c) encrypted DLL module

HKEY_CURRENT_USER\Software\Classes\[Random String]

Technical investigation

In-depth analysis

Page 19: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Technical investigation

In-depth analysis

Page 20: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Technical investigation

In-depth analysis

Page 21: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Soplifan.[ru], Diplicano.[ru].

The traffic is repeated every 9 minutes.

Technical investigation

In-depth analysis

Page 22: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

oplifan [.]ru, soplifan [.]ru, fiplicano [.]ru, diplicano [.]ru, aiplicano [.]ru, adygeya [.]ru, altai [.]ru, amur [.]ru, amursk [.]ru, arkhangelsk [.]ru, astrakhan [.]ru,

baikal [.]ru, bashkiria [.]ru, belgorod [.]ru, bir [.]ru, bryansk [.]ru, buryatia [.]ru, cbg [.]ru, chel [.]ru, chelyabinsk [.]ru, chita [.]ru, chukotka [.]ru, chuvashia [.]ru,

cmw [.]ru, dagestan [.]ru, dudinka [.]ru, e-burg [.]ru, fareast [.]ru, grozny [.]ru, irkutsk [.]ru, ivanovo [.]ru, izhevsk [.]ru, jamal [.]ru, jar [.]ru, joshkar-ola [.]ru,

kalmykia [.]ru, kaluga [.]ru, kamchatka [.]ru, karelia [.]ru, kazan [.]ru, kchr [.]ru, kemerovo [.]ru, ghabarovsk [.]ru, khakassia [.]ru, khv [.]ru, kirov [.]ru, kms [.]ru,

koenig [.]ru, komi [.]ru, kostroma [.]ru, krasnoyarsk [.]ru, kuban [.]ru, k-uralsk [.]ru, kurgan [.]ru, kursk [.]ru, kustanai [.]ru, kuzbass [.]ru, lipetsk [.]ru, magadan

[.]ru, magnitka [.]ru, mari [.]ru, mari-el [.]ru, marine [.]ru, mordovia [.]ru, mosreg [.]ru, msk [.]ru, murmansk [.]ru, mytis [.]ru, nakhodka [.]ru, nalchik [.]ru, nkz

[.]ru, nnov [.]ru, norilsk [.]ru, nov [.]ru, novosibirsk [.]ru, nsk [.]ru, omsk [.]ru, orenburg [.]ru, oryol [.]ru, oskol [.]ru, palana [.]ru, penza [.]ru, perm [.]ru, pskov

[.]ru, ptz [.]ru, pyatigorsk [.]ru, rubtsovsk [.]ru, ryazan [.]ru, sakhalin [.]ru, samara [.]ru, saratov [.]ru, simbirsk [.]ru, smolensk [.]ru, snz [.]ru, spb [.]ru, stavropol

[.]ru, stv [.]ru, surgut [.]ru, syzran [.]ru, tambov [.]ru, tatarstan [.]ru, tom [.]ru, tomsk [.]ru, tsaritsyn [.]ru, tsk [.]ru, tula [.]ru, tuva [.]ru, tver [.]ru, tyumen [.]ru,

udm [.]ru, udmautia [.]ru, ulan-ude [.]ru, vdonsk [.]ru, vladikavkaz [.]ru, vladimir [.]ru, vladivostok [.]ru, volgograd [.]ru, vologda [.]ru, voronezh [.]ru, vyatka

[.]ru, yakutia [.]ru, yamal [.]ru, yaroslavl [.]ru, yekaterinburg [.]ru, yuzhno-sakhalinsk [.]ru, zgrad [.]ru

Technical investigation

In-depth analysis

Captured 126 domains!

Page 23: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Thank you!

Page 24: Fileless malware beyond a cursory glance - def.camp - Fileless... · Fileless malware beyond a cursory glance Alin PUNCIOIU Lucian SARARU. Title: Flowchart Example 04 Author: Secureworks

Classification: //SecureWorks/Confidential - Limited External Distribution:

Fileless malwarebeyond a cursory glance

Alin PUNCIOIU

Lucian SARARU


E. Ottewitte - Cursory First Look at the MCFR

E. Ottewitte - Cursory First Look at the MCFR

Documents
Beyond Whitelisting: Fileless Attacks Against Linux · 2019-03-05 · Fileless Malware - Definition “… a variant of computer related malicious software that exists exclusively

Beyond Whitelisting: Fileless Attacks Against Linux · 2019-03-05 · Fileless Malware - Definition “… a variant of computer related malicious software that exists exclusively

Documents
FILELESS MALWARE DETECTION · Fileless malware is a malicious script that gets loaded into a system’s memory (RAM) by a legitimate application resident on the end-user’s system

FILELESS MALWARE DETECTION · Fileless malware is a malicious script that gets loaded into a system’s memory (RAM) by a legitimate application resident on the end-user’s system

Documents
Comparative Study of Fileless Ransomware

Comparative Study of Fileless Ransomware

Education
Understanding Fileless (or Non-Malware) Attacks and How to Stop Them

Understanding Fileless (or Non-Malware) Attacks and How to Stop Them

Technology
Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Documents
[Cursory Translation] · [Cursory Translation] Investment Agreement under the framework of The Mainland and Hong Kong Closer Economic Partnership Arrangement Mediation Rules (“Rules”)

[Cursory Translation] · [Cursory Translation] Investment Agreement under the framework of The Mainland and Hong Kong Closer Economic Partnership Arrangement Mediation Rules (“Rules”)

Documents
Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Documents
The Cursory Gazette

The Cursory Gazette

Documents
Cursory Remarks on Corpulence

Cursory Remarks on Corpulence

Documents
Canada-a cursory glance on it

Canada-a cursory glance on it

Education
Hidden in plain sight? - Blackhoodie · 2020-05-29 · [Whitepaper] - Who needs malware, How advasaries use fileless attacks to evade your security [Blog] - Attack Mitre Process Hollowing

Hidden in plain sight? - Blackhoodie · 2020-05-29 · [Whitepaper] - Who needs malware, How advasaries use fileless attacks to evade your security [Blog] - Attack Mitre Process Hollowing

Documents
Attackers, Attacks and Security Strategies · Credentials. 11. 12. 13 •New breed of highly persistent and stealthy malware. •Rise in fileless malware and droppers. •Using highly

Attackers, Attacks and Security Strategies · Credentials. 11. 12. 13 •New breed of highly persistent and stealthy malware. •Rise in fileless malware and droppers. •Using highly

Documents
Osterman Research WHITE PAPER O...Fileless malware, e.g., rogue browser extensions 49% Accidental breaches of sensitive or confidential data by employees 49% Malware getting into your

Osterman Research WHITE PAPER O...Fileless malware, e.g., rogue browser extensions 49% Accidental breaches of sensitive or confidential data by employees 49% Malware getting into your

Documents
Reclamation’s Seepage Barrier Experience - A Cursory

Reclamation’s Seepage Barrier Experience - A Cursory

Documents
(160820) #fitalk fileless malware forensics

(160820) #fitalk fileless malware forensics

Technology
Under the Radar T h e Future of Unde tected Malware · Sorebrect has most of its detections in APAC, however there are a few countries in EMEA that have detected the fileless ransomware,

Under the Radar T h e Future of Unde tected Malware · Sorebrect has most of its detections in APAC, however there are a few countries in EMEA that have detected the fileless ransomware,

Documents
Cursory Remarks on Corpulence, Obesity. Wm Wadd, 1816

Cursory Remarks on Corpulence, Obesity. Wm Wadd, 1816

Documents
A Cursory Glance at the Theory of Wilayat al-Faqihijtihadnet.com/wp-content/uploads/2467.pdf · Home > A Cursory Glance at the Theory of Wilayat al-Faqih A Cursory Glance at the Theory

A Cursory Glance at the Theory of Wilayat al-Faqihijtihadnet.com/wp-content/uploads/2467.pdf · Home > A Cursory Glance at the Theory of Wilayat al-Faqih A Cursory Glance at the Theory

Documents
Understanding Fileless Attacks on Linux-based IoT Devices ...alfchen/fan_mobisys19.pdfUnderstanding Fileless Attacks on Linux-based IoT Devices with ... was under DDoS attack by Mirai,

Understanding Fileless Attacks on Linux-based IoT Devices ...alfchen/fan_mobisys19.pdfUnderstanding Fileless Attacks on Linux-based IoT Devices with ... was under DDoS attack by Mirai,

Documents
An emerging threat Fileless malware: a survey and research ...€¦ · Using these capabilities of WMI, an attacker can build a pure backdoor without even drop-ping the single file

An emerging threat Fileless malware: a survey and research ...€¦ · Using these capabilities of WMI, an attacker can build a pure backdoor without even drop-ping the single file

Documents
Fileless Malware Infections

Fileless Malware Infections

Software
SONICWALL CAPTURE SECURITY CENTER · 2018-08-21 · file-based and fileless malware, while delivering a 360-degree attack view with actionable intelligence relevant for investigations

SONICWALL CAPTURE SECURITY CENTER · 2018-08-21 · file-based and fileless malware, while delivering a 360-degree attack view with actionable intelligence relevant for investigations

Documents
One-Click Fileless Infection - Virus Bulletin · Notable Fileless Malwares (early) •Poweliks –Discovered in 2014, from Wowliks to Poweliks –Uses powershell to launch and injects

One-Click Fileless Infection - Virus Bulletin · Notable Fileless Malwares (early) •Poweliks –Discovered in 2014, from Wowliks to Poweliks –Uses powershell to launch and injects

Documents
Annex Product Specific Rules of Origin [Cursory Translation]

Annex Product Specific Rules of Origin [Cursory Translation]

Documents
Living off the land and fileless attack techniques

Living off the land and fileless attack techniques

Technology
Understanding Fileless Attacks on Linux-based IoT Devices ... · its VM instances’ IP ranges and some malware like Mirai does not infect (in fact intentionally bypasses) specific

Understanding Fileless Attacks on Linux-based IoT Devices ... · its VM instances’ IP ranges and some malware like Mirai does not infect (in fact intentionally bypasses) specific

Documents
Fileless attacks - Bitdefender · Fileless attacks Fileless Attacks - White Paper Hackers are increasingly turning to fileless attacks because they are 10 times more likely to succeed

Fileless attacks - Bitdefender · Fileless attacks Fileless Attacks - White Paper Hackers are increasingly turning to fileless attacks because they are 10 times more likely to succeed

Documents
MorphisecUnified Threat Prevention · Built to Defeat Fileless Attacks Fileless, in-memory attacks evade detection by co-opting legitimate system resources. They are 10x more likely

MorphisecUnified Threat Prevention · Built to Defeat Fileless Attacks Fileless, in-memory attacks evade detection by co-opting legitimate system resources. They are 10x more likely

Documents
An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

An emerging threat Fileless malware: a survey and research ... · detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and

Documents