null0x4d5a

This post explains how to use scdbg  to analyse one type of shellcode generated by Metasploit framework or CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike).  The previous post Decoding Metasploit and CobaltStrike shells explains how to leverage CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg emulator to get the IP address of C2 or an adversary scdbg is a shellcode analysis application built around the libemu emulation library. When run it will display to the user all of the windows APIs the shellcode attempts to call  Finally, there are other ways to analyse shellcode in various platforms. This is just an explanatory post to...

Introduction  This post covers how to identify and extract shellcode manually from hancitor phishing office document. Refer  Part-1  and  Part-2  to get an understanding of  tools and approach to analyse phishing documents.  Tools  Didier Stevens Suite    sudo pip install oletools  Analysis   SHA256:  5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d   This sample contains encoded shellcode that starts a new (suspended) explorer.exe process, injects its own code (an embedded, encoded exe) and executes it.  This maldoc leverages  VBA macros  to execute its payload  and t he encoded shellcode is a property in stream 17.  T he shellcode uses WIN32 API functions like CreateProcess, ZwUnmapViewOfSection, GetThreadContext, ResumeThread etc. to inject code into the newly created process (explorer.exe) and execute it. This method is called process hollowing or proc...

Introduction This post covers how to identify and extract potential malicious content like embedded executable and payloads from Macro forms in office documents. Refer Part-1 and Part-2 to get an understanding of  tools and approach to analyse phishing documents. Tools  Didier Stevens Suite    sudo pip install oletools  Analysis  All document samples are pulled from  Hybrid Analysis  - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology.  Hash:  345b804a9416595840516674caaa65e65be57591d300beab2b6190298a9eac78 Download above mentioned sample and check the integrity Check the file properties using native Linux  file  command which gives quick idea about sample Ran o ledump.py  to check the embedded macros and macro related forms It was found that stream 14 and 15 look like macro forms.  Dump them...

Introduction  This post explains how to use PowerForensics ( https://github.com/Invoke-IR/PowerForensics ) to extract ZeroAccess infected system's NTFS extended attributes content. ZeroAccess used NTFS extended attributes to maintain persistent mechanism on infected system. "If installed on Windows Vista or higher ZeroAccess will attempt to patch the Windows file services.exe. A subroutine inside services.exe is overwritten with shellcode that is carried inside the ZeroAccess dropper. A large amount of binary data is also written to the NTFS Extended Attributes of services.exe. Extended Attributes are a feature of NTFS similar in nature to Alternate Data Streams where extra information about the file can be stored on the file system. ZeroAccess uses this feature to hide a whole PE file as well as shellcode that loads the PE file. The overwritten subroutine in services.exe reads in all the data from the Extended Attributes and executes it. The shellcode then loads and e...