BlackEnergy Malware

Scenario:

A multinational corporation has been hit by a cyber attack that has led to the theft of sensitive data. The attack was carried out using a variant of the BlackEnergy v2 malware that has never been seen before. The company’s security team has acquired a memory dump of the infected machine, and they want you, as a soc analyst, to analyze the dump to understand the attack scope and impact.

Questions:

• Q1: Which volatility profile would be best for this machine?

Getting general information about this memory:

vol.py -f CYBERDEF-567078-20230213-171333.raw imageinfo

From Windows VM:

Executing imageinfo to get the profile for this image with the assumption that the profile was the first suggestion WinXPSP2x86 with the use of kdbgscan:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 kdbgscan

- KdCopyDataBlock address is not here. We need that for `pslist` but I guess we can use pslist without it.

Answer:

WinXPSP2x86

• Q2: How many processes were running when the image was acquired?

Suspicious processes listed with pslist: Note that this uses the PsActiveProcessHead to list all of the process nodes in the linked list

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 pslist

- rootkit.exe
- cmd.exe
- notepad.exe (3x)
- DumpIt.exe
- Notice that there are 6 processes that does NOT have a threat. Meaning, they are inactive. Note that a process has to have atleast 1 thread for it to be considered active.

Checking process’ parent-child relationships:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 pstree

- It says, there should be more than 25 processs in here. But with SIFT idk why it only shows this much.

Answer:

19

• Q3: What is the process ID of cmd.exe?

-> Look above.

Answer:

1960

• Q4: What is the name of the most suspicious process?

Using verbose mode for more information:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 pstree -v

- Attacker's path: explorer.exe -> rootkit.exe -> cmd.exe
- Another process that stood out is 'alg.exe'

Answer:

rootkit.exe

• Q5: Which process shows the highest likelihood of code injection?

Let’s check any hidden process as hinted by the rootkit.exe:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 psxiew -v

All of the process listed from pslist was shown to us:

Digging into the suspicious/malicious process: (rootkit.exe , cmd.exe and alg.exe inside System32)

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 psinfo

rootkit.exe:

- There's no suspected memory regions either

cmd.exe:

- Notice that there are no memory information for both cmd.exe and rootkit.exe while all other process has one.

- There's no suspected memory regions either

alg.exe:

Answer: Look for the process that is active. svchost.exe is used by services so its very likely

svchost.exe

• Q6: There is an odd file referenced in the recent process. Provide the full path of that file.

Enumerating files for each svchost.exe:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP3x86 handles -p 968 -t file

PID: 880

PID: 968

PID: 1060

PID: 1108

PID: 1156

Answer:

\Device\HarddiskVolume1\WINDOWS\system32\drivers\str.sys

which is

C:\Windows\system32\drivers\str.sys

• Q7: What is the name of the injected dll file loaded from the recent process?

Using ldrmodules, not only shows the DLL linked, but also the DLL that got removed from the process as typical Process Injection technique:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP3x86 -p 880 ldrmodules

This highlighted dll shows that it was once in the process but was unlinked. This is very suspicious especially for an active process:

Answer:

msxml3r.dll

• Q8: What is the base address of the injected dll?

Command:

vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP3x86 -p 880 malfind

- Malfind shows the memory address where the injected code will start

Answer:

0x980000