Today's quick #malware analysis with #SecurityOnion: FAKEBAT, REDLINE STEALER, and GOZI/ISFB/URSNIF pcap from 2023-02-03!

Thanks to @malware_traffic for sharing this pcap!

More screenshots:
blog.securityonion.net/2023/02/quick-…

#infosec
#infosecurity
#ThreatHunting
#IncidentResponse
@malware_traffic Let's review some of the data that #SecurityOnion generates from this traffic!

When you import the pcap using so-import-pcap, it will generate a hyperlink that will take you to the Overview dashboard:
@malware_traffic Here are the NIDS alerts:
@malware_traffic Let's review some of the more interesting NIDS alerts. We'll start with the initial HTTP request and pivot to PCAP transcript:
@malware_traffic Next, let's take a look at the first EXE downloaded:
@malware_traffic Now let's look at the second EXE downloaded:
Let's also look at the RedLine Stealer alert and pivot to PCAP transcript:
There is also a Zeek Notice for the second EXE download since it triggered a Team Cymru Malware Hash Registry match:
Now let's review some of the protocol metadata. We'll start with HTTP:
Next let's look at files transferred:
Here are the SSL connections:
DNS lookups:
Finally, here is an overview of all external connections including GeoIP lookups:

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Security Onion

Security Onion Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @securityonion

Oct 17, 2022
#SecurityOnion 2.3.180 now available!

Featuring:
#Elastic 8.4.3
#Suricata 6.0.8
#Zeek 5.0.2
✅New and improved #sysmon dashboards!

Thanks to @markrussinovich and team for #sysmon!

Need a #sysmon config? Check out @SwiftOnSecurity's!

Blog post:
blog.securityonion.net/2022/10/securi… ImageImageImageImage
@markrussinovich @SwiftOnSecurity Our updated #Sysmon Overview dashboard gives you a nice overview of all of the different types of #Sysmon data you are collecting: Image
@markrussinovich @SwiftOnSecurity Our new #Sysmon Registry dashboard allows you to drill into registry events like registry_value_set and registry_create_delete: Image
Read 8 tweets
Aug 19, 2021
If you want the quickest and easiest way to try out #SecurityOnion, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM! ImageImageImage
Start Setup and choose Import node: ImageImageImageImage
Read 17 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(