Mo' Memory No' Problem - Speaker Deck

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL $ whoami $ more Glenn – @hiddenillusion – hiddenillusion.blogspot.com 2014 $ more Ian – 1aN0rmus – I’m around… • @TekDefense • TekDefense.com

Slide 3

Slide 3 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL Agenda • Why/How we use it • Haters • Issues/Limitations/Odd use cases • War stories • Ninja foo • Splunking • Triage walk through 2014

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Why aren’t others utilizing it? • Harder on large scale engagements, especially geographically dispersed networks • Not applicable to engagement • No tool/process • Limited knowledge in this area • Privacy concerns • No easy button

Slide 6

Slide 6 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Why do we use it? One artifact to rule them all! – Network – Processes – Registry – Event Logs – Files – Timelines – Information not stored on disk – Harder to hide …bang for buck

Slide 7

Slide 7 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 So what do we do? • Treat it like having a live system in front of you • Answer questions that otherwise couldn’t be answered without memory • Targeted approach (pivot vs. automated) • Looking for anomalies • Timelining • Ability to answer specific questions based solely on this one artifact • Feed that intelligence gained back into the cycle

Slide 8

Slide 8 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 What kind of questions? – Infection Vector – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs

Slide 9

Slide 9 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Plugin/Tool Explanation connections Displays TCP connections that were active at the time of the memory acquisition. connscan Pool scans for _TCPT_OBJECT structures to find both active and terminated connections. sockets Displays sockets that were active at the time of the memory acquisition. sockscan Pool scans for _ADDRESS_OBJECT structures to find both active and terminated sockets. netscan Pool scans for TcpE, TcpL and UdpA structures (Vista+) to find both active and terminated connections/sockets. pslist Walks the doubly-linked list pointed to by PsActiveProcessHead and displays processes that were active at the time of the memory acquisition. psscan Pool scans for _EPROCESS structures to find both active and terminated processes. psxview Displays a cross-view table indicating whether or not a particular process was found in a certain table/list/pool scan.

Slide 10

Slide 10 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 What do those names mean? With regards to Volatility plugins, a general rule is any *scan plugin: • Might find terminated data (e.g. network connections) in addition to data that was active during the acquisition • Relies on pool tag scanning instead of walking lists so may find something hidden/unlinked

Slide 11

Slide 11 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 ...but how? – Infection Vector (propagation too) – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs Sequence of events? mftparser, shimcache, timeliner, usn_parser Attack script used? yarascan, mftparser, vaddump/memdump, strings, bulk_extractor Any C2? connections, connscan, netscan, sockets, sockscan Who/Where? evtlogs, filescan/dumpfiles/EVTXtract, getsids, pslist, psscan, psxview

Slide 12

Slide 12 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Plugin/Tool Explanation consoles Searches the memory of csrss.exe/conhost.exe for the CONSOLE_INFORMATION structure and displays the entire screen buffer (Input & Output). cmdscan Searches the memory of csrss.exe/conhost.exe for the COMMAND_HISTORY structure but only displays the Input contents. It can also find commands from both active and closed consoles.

Slide 13

Slide 13 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 ...man, they tunnel fast... – Infection Vector – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs What’d they type? consoles, cmdscan Any C2? connections, connscan, netscan, sockets, sockscan Tasks used? Logins/Accounts compromised? evtlogs, filescan/dumpfiles/EVTXtract Any shares accessed? handles, symlinkscan

Slide 14

Slide 14 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 ...do we need to call the lawyers? – Infection Vector – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs Data transferred? consoles, cmdscan, ethscan, connections, connscan, netscan, sockets, sockscan Files executed? mftparser, evtlogs/filescan/dumpfiles/EVTXtract, ShimCache, UserAssist, printkey

Slide 15

Slide 15 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 ...do we need to make a public disclosure? – Infection Vector – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs Where is it? yarascan, mftparser, filescan, handles What was accessed? iehistory, notepad, clipboard How is it stored? yarascan, strings, procdump, dlldump Can I recover it? filescan/dumpfiles

Slide 16

Slide 16 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 ...how is it still generating alerts? – Infection Vector – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs Where is it? printkey/hivedump, mftparser, mbrparser, svcscan, hashdump

Slide 17

Slide 17 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 ...what can we sweep our environment for? – Propagation – Infection Vector – Lateral Movement – Data Exfiltration – Keylogging Data – Persistence Mechanism – IOCs • Registry keys • File names/locations • C2 IPs/domains • Malware’s commands/capabilities/uniqueness (exports etc.) • Persistence mechanism(s) • Mutexes

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 • The system is a critical server • There’s no way you can get everything you need by solely analyzing a memory dump • It takes too long to acquire memory • Over the network acquisitions are difficult …haters gon’ hate

Slide 20

Slide 20 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Memory can be manipulated with tools like ADD. – Yes, but it is very apparent when these types of tools are used. – Multiple ways to view similar data to find inconsistencies – e.g. - pslist vs. psscan – @JACKCR: http://blog.handlerdiaries.com/?p=363 Keep hat1n

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 • VM’s • Corrupt dumps? • Possibly missing data from artifacts (paged?) • That thing called Unicode (U+1F4A9) • The person creating the dump • Your toolkit hm, that's odd… what went wrong?

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 • DarkComet • PIVY • XtremeRAT • Find the Malz • Unknown variants • POS scrapers • “Advanced Attackers” …we’ve been through some stuff

Slide 25

Slide 25 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Scenario: Customer said their host had ‘malware’ so uploaded a memory dump and some triage. Goal was to confirm infection and look for evidence of “Advanced” activity. Steps: 1. Reviewed processes 2. Dumped suspicious processes and stringed through them 3. Found DC config 4. Viewed open file handles and found keylogs 5. Reviewed keylogs to find what data was captured 6. Timeline to figure out date of infection and potential vectors 7. Watering hole attack 8. No further attacker activity DarkComet

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Scenario: Customer had a ‘Backdoor.APT.Xtremerat’ alert trigger on their appliance so they uploaded a memory dump and some triage data of the responsible host for analysis. Steps: 1. Searched for C2 that was provided from the alert 2. Dumped the process found associated with the C2 3. Found a suspicious mutex 4. Suspicious filenames in $MFT found 5. Dumped suspicious files (that we could) 6. Dynamic analysis of files confirmed suspicions & provided other IOCs 7. Visually determined one to be XOR’ed, decrypting resulted in keylogged data & were able to use that knowledge to decrypt logfiles on other endpoints. XtremeRAT

Slide 28

Slide 28 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Scenario: User sees traffic going to the “wrong IP” when attempting to go to an internal resource and thinks malware is redirecting traffic. Sent a memory dump for analysis. Steps: 1. Spent hours looking for signs of malware via the normal methods 2. Found no malware 3. What else could have caused such a thing 4. Let’s check the hosts file … 5. Wait where is that in memory? 6. For this host, sitting in LSASS.exe 7. Stringed it out, admin found a host entry redirecting the traffic 8. Not malicious … Admin did it for “testing”. Find the Malz

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text

Slide 41

Slide 41 text

Slide 42

Slide 42 text

Slide 43

Slide 43 text

Slide 44

Slide 44 text

Slide 45

Slide 45 text

Slide 46

Slide 46 text

Slide 47

Slide 47 text

Slide 48

Slide 48 text

Slide 49

Slide 49 text

Slide 50

Slide 50 text

Slide 51

Slide 51 text

Slide 52

Slide 52 text

Slide 53

Slide 53 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Any persistence? hashdump • No registry persistence • No search order hijacking • No BHO’s • No trojanized/replaced binaries • No services created • New account added (recall previous slide)

Slide 54

Slide 54 text

Copyright © 2013, FireEye, Inc. All rights reserved. | CONFIDENTIAL 2014 Attackers Script • Exploit – exploit/windows/browser/ms10_046_shortcut_icon_dllloader • Escalate – getsystem -1 • Pillage – hashdump • Persist – post/windows/manage/enable_rdp – execute -f cmd.exe -i -H – net user Tony /add – run persistence -A -S -i 3600 – execute -f cmd.exe -i -H – sc start – migrate • Clear up – clearev – timestomp c:\\ -r

Slide 55

Slide 55 text