~/elow

PhishStrike

This is a retired lab from CyberDefenders.

5 min read

$ cat info.txt

platform
CyberDefenders
track
Threat Intel
os
N/A
table of contents

Scenario

As a cybersecurity analyst for an educational institution, you receive an alert about a phishing email targeting faculty members. The email, appearing from a trusted contact, claims a $625,000 purchase and provides a link to download an invoice. Your task is to investigate the email using Threat Intel tools. Analyze the email headers and inspect the link for malicious content. Identify any Indicators of Compromise (IOCs) and document your findings to prevent potential fraud and educate faculty on phishing recognition.

Preface

For this lab, we are given the original .eml file to analyse instead of a lab environment. It is recommended to always analyse lab files (even if it’s for practice!) in a VM environment.

Problem(Question 1)

Identifying the sender’s IP address with specific SPF and DKIM values helps trace the source of the phishing email. What is the sender’s IP address that has an SPF value of softfail and a DKIM value of fail?

Solution

Let’s start by inspecting the email header. A quick way to do this is to open the .eml file in a text editor. Though there are automated email analysis tools online (such as PhishTool) that are much more efficient, we’ll go down the traditional route to better understand email structures.

The question already hints that the sender IP address we are looking for will have specific SPF and DKIM values.

A brief intro to SPF and DKIM:

  • SPF - verifies that an email appearing to be from a domain was sent from the servers of the actual domain owner.
  • DKIM - signs outgoing mail with a cryptographic signature, and the recipient’s email server uses the published public key to verify its integrity.

In short, both SPF and DKIM should never have a value other than “pass” if the email were legitimate.

Answerclick to reveal
18.208.22.104
Problem(Question 2)

Understanding the return path of the email helps in tracing its origin. What is the return path specified in this email?

Solution

The Return-Path header will provide us the answer to this question. This header is used when emails are undelivered or bounce back to the sender. However, threat actors may set this field to their own email address.

Answerclick to reveal
erikajohana.lopez@uptc.edu.co
Problem(Question 3)

Identifying the source of malware is critical for effective threat mitigation and response. What is the IP address hosting the malicious file associated with malware distribution?

Solution

Looking at the email body, we can see that it is masquerading as an invoice to get the recipient to download malware hosted on an external IP address.

Answerclick to reveal
107.175.247.199
Problem(Question 4)

Determining which malware exploits system resources to mine cryptocurrencies helps prioritize threat response. The malicious URL distributes multiple types of malware. What is the malware family used for cryptocurrency mining?

Solution

As we have the IP address where the malware is hosted, we can check open source intelligence tools such as VirusTotal and URLhaus. For example, searching the IP on VirusTotal, we can look at the “RELATIONS” tab for the communicating files.

In this scenario, it appears that the IP address has hosted multiple versions of install.exe. Let’s take a look at URLhaus for the IP IOC instead. From URLhaus, we can see that there were 3 different payload signatures, one of which is associated with crypto mining.

Answerclick to reveal
CoinMiner
Problem(Question 5)

Understanding the registry entries added to the auto-run key by malware is crucial for identifying its persistence mechanisms. According to the analysis of BitRAT, what is the executable name in the first value added to the registry auto-run key?

Solution

From Question 4, we were able to locate different hashes served by the malicious IP address, and one of them has the payload signature “BitRAT”. Let’s pivot back to VirusTotal and search for the associated hash: bf7628695c2df7a3020034a065397592a1f8850e59f9a448b555bc1c8c639539

When reviewing the “Registry Keys Set” section, we’ll notice the following run key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Jzwvix

Answerclick to reveal
Jzwvix.exe
Problem(Question 6)

Introducing a delay in malware execution can help evade detection mechanisms. What is the delay (in seconds) caused by the PowerShell command according to the BitRAT analysis?

Solution

Looking through the process tree for the binary, we’ll notice a Base64-encoded PowerShell command.

Terminal window
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==

Once we put that through CyberChef to decode it and remove the null bytes, we get our answer of 50 seconds.

Answerclick to reveal
50
Problem(Question 7)

Analyzing the HTTP requests made by malware helps in identifying its communication patterns. What is the HTTP request used by the loader to retrieve the BitRAT malware?

Solution

This answer can be found in the HTTP requests made by the binary.

Answerclick to reveal
hxxp[://]107.175.247[.]199/LOADER/SERVER.EXE
Problem(Question 8)

Identifying the SHA-256 hash of files downloaded by a malicious URL aids in tracking and analyzing malware activities. According to the BitRAT analysis, what is the SHA-256 hash of the second file downloaded and added to autorun keys?

Solution

This question is a bit tricky and the wording is confusing, but keep in mind the first file downloaded after clicking the link in the phishing email would be install.exe. The second file downloaded would be Jzwvix.exe, which was added to the run key mentioned in Question 5. The hash can be found under the “Files Dropped” section on VirusTotal.

In my opinion, though, the second file downloaded should actually be server.exe, which has a different hash. This question took some trial and error to get “right”.

Answerclick to reveal
BF7628695C2DF7A3020034A065397592A1F8850E59F9A448B555BC1C8C639539
Problem(Question 9)

Tracking the command and control (C2) domains used by malware is essential for detecting and blocking malicious activities. What is the C2 domain used by the BitRAT malware?

Solution

As the URL IOC we found was associated with three different malware signatures, let’s hop back to URLhaus and look specifically at the sample tagged BitRAT.

BitRAT hash: bf7628695c2df7a3020034a065397592a1f8850e59f9a448b555bc1c8c639539

Looking at the comments on the sample in VirusTotal, we can find published reports with the C2 address.

Answerclick to reveal
gh9st.mywire[.]org
Problem(Question 10)

Understanding the methods malware uses for exfiltrating data is crucial for detecting and preventing data breaches. According to the AsyncRAT analysis, what is the Telegram Bot ID used by the malware to exfiltrate stolen data?

Solution

Similar to the previous question, we’ll analyse the sample tagged AsyncRAT specifically.

AsyncRAT hash: 5ca468704e7ccb8e1b37c0f7595c54df4e2f4035345b6e442e8bd4e11c58f791

Pivoting from VirusTotal, we can look into other reports related to this binary. It takes some digging, but we can find the GET request in this tria.ge report.

Answerclick to reveal
bot5610920260
Problem(Question 11)

Understanding the specific URLs requested by malware is essential for disrupting its communication channels and mitigating its activities. According to the CoinMiner analysis, what is the URL requested by the CoinMiner malware sample?

Solution

Now let’s go to the CoinMiner-tagged sample on VirusTotal. There we can find the subsequent HTTP requests that download further payloads.

CoinMiner hash: 453fb1c4b3b48361fa8a67dcedf1eaec39449cb5a146a7770c63d1dc0d7562f0

Answerclick to reveal
hxxp[://]ripley[.]studio/loader/uploads/Qanjttrbv.jpeg