1 1 00:00:00,450 --> 00:00:02,190 Conduct packet analysis. 2 2 00:00:02,190 --> 00:00:03,900 In this lesson I'm going to show you how to do 3 3 00:00:03,900 --> 00:00:06,780 some basic packet analysis using Wireshark. 4 4 00:00:06,780 --> 00:00:09,810 To do this, I'm going to launch a piece of malware on my system 5 5 00:00:09,810 --> 00:00:12,300 and we're going to see how it beacons out over time. 6 6 00:00:12,300 --> 00:00:14,550 Now to do this, I'm going to use two pieces of software. 7 7 00:00:14,550 --> 00:00:16,890 I'm going to use Proc Man to look at the processes 8 8 00:00:16,890 --> 00:00:18,690 and make sure the malware's actually launching. 9 9 00:00:18,690 --> 00:00:20,790 And then I'm really going to dig into the packet analysis 10 10 00:00:20,790 --> 00:00:23,490 using Wireshark so we can look at how those packets 11 11 00:00:23,490 --> 00:00:25,410 are going out, to what IPS they are, 12 12 00:00:25,410 --> 00:00:27,480 so we could develop indicators of compromise. 13 13 00:00:27,480 --> 00:00:29,400 Let's go ahead and jump into the environment. 14 14 00:00:29,400 --> 00:00:31,110 And next I want to open up Wireshark. 15 15 00:00:31,110 --> 00:00:33,270 So I'm going to click on the Windows icon 16 16 00:00:33,270 --> 00:00:36,573 and type in the word Wireshark and open that program. 17 17 00:00:38,340 --> 00:00:40,620 Now Wireshark is a great program. 18 18 00:00:40,620 --> 00:00:43,950 It's one that is used heavily in network analysis 19 19 00:00:43,950 --> 00:00:45,180 and what we're going to use it for 20 20 00:00:45,180 --> 00:00:47,580 is to capture our network traffic 21 21 00:00:47,580 --> 00:00:49,140 when the malware launches. 22 22 00:00:49,140 --> 00:00:51,060 And that way we can see those beacons 23 23 00:00:51,060 --> 00:00:53,070 that happen every three minutes 24 24 00:00:53,070 --> 00:00:55,200 and see what data is being sent 25 25 00:00:55,200 --> 00:00:57,390 or see who it's calling out to. 26 26 00:00:57,390 --> 00:00:59,250 And so I'm going to go ahead and hit the start button 27 27 00:00:59,250 --> 00:01:01,170 which is this little shark fin 28 28 00:01:01,170 --> 00:01:02,970 and it's going to start capturing data 29 29 00:01:02,970 --> 00:01:05,850 going into or out of our network. 30 30 00:01:05,850 --> 00:01:08,850 So now I'm going to go ahead and right click on Trickster 31 31 00:01:08,850 --> 00:01:12,183 and run it as administrator and go ahead and hit yes. 32 32 00:01:15,390 --> 00:01:17,280 So now Trickster is running. 33 33 00:01:17,280 --> 00:01:19,350 This should be copying u.exe 34 34 00:01:19,350 --> 00:01:21,660 into that directory and running it. 35 35 00:01:21,660 --> 00:01:22,860 And I did and you can see 36 36 00:01:22,860 --> 00:01:25,200 that it's now showing up as a process. 37 37 00:01:25,200 --> 00:01:27,000 So I'm going to go ahead and move this over 38 38 00:01:27,000 --> 00:01:28,533 just a tad so we can see it. 39 39 00:01:29,370 --> 00:01:32,190 And we're going to go ahead and open up Wireshark 40 40 00:01:32,190 --> 00:01:34,800 a little bit better so we can see it a little more. 41 41 00:01:34,800 --> 00:01:36,570 Now notice the time is different. 42 42 00:01:36,570 --> 00:01:37,883 On Wireshark, they do it as 43 43 00:01:37,883 --> 00:01:41,700 a T plus whatever time is being used 44 44 00:01:41,700 --> 00:01:45,150 whereas Process Mon is doing it as the time of day. 45 45 00:01:45,150 --> 00:01:46,740 Now if I want to correlate these two 46 46 00:01:46,740 --> 00:01:48,360 I need to make them look the same. 47 47 00:01:48,360 --> 00:01:51,390 And so to do that I'm going to go over here to Wireshark 48 48 00:01:51,390 --> 00:01:53,490 and I'm going to change the way the time is displayed 49 49 00:01:53,490 --> 00:01:56,250 by going to view time, display format 50 50 00:01:56,250 --> 00:01:59,010 and then choosing time of day. 51 51 00:01:59,010 --> 00:02:01,290 This will allow us to correlate between the two. 52 52 00:02:01,290 --> 00:02:02,310 So in the example here 53 53 00:02:02,310 --> 00:02:07,310 we have the process starting at 1:43 and 29 seconds. 54 54 00:02:07,620 --> 00:02:09,300 So I'm going to go ahead and let this run 55 55 00:02:09,300 --> 00:02:10,650 just for a couple of minutes 56 56 00:02:10,650 --> 00:02:13,770 and we're going to come back at 1:47. 57 57 00:02:13,770 --> 00:02:17,010 When I come back, we are going to see what traffic 58 58 00:02:17,010 --> 00:02:20,190 and if we can capture and see those three beacons 59 59 00:02:20,190 --> 00:02:22,290 and see if we can figure out what IP addresses 60 60 00:02:22,290 --> 00:02:25,023 they're calling out to from these processes. 61 61 00:02:26,280 --> 00:02:28,860 Okay, we're going to go ahead and stop the capture here. 62 62 00:02:28,860 --> 00:02:30,720 So now that we've stopped the capture, 63 63 00:02:30,720 --> 00:02:32,910 let's go ahead and clear up this mess a little bit 64 64 00:02:32,910 --> 00:02:35,520 so we can see a little bit clearer what we're dealing with. 65 65 00:02:35,520 --> 00:02:37,290 Let's go ahead and first turn off 66 66 00:02:37,290 --> 00:02:39,450 our registry activity changes 67 67 00:02:39,450 --> 00:02:42,180 and our file system activity changes. 68 68 00:02:42,180 --> 00:02:43,230 This is going to leave us 69 69 00:02:43,230 --> 00:02:46,950 with just the network activity and just the processes. 70 70 00:02:46,950 --> 00:02:48,930 Now the first process you can see here, 71 71 00:02:48,930 --> 00:02:52,380 it started up at 1:43:29 72 72 00:02:52,380 --> 00:02:56,310 and it finished right here at 1:43:29 73 73 00:02:56,310 --> 00:02:58,800 and the next one starts at 1:44:28. 74 74 00:02:58,800 --> 00:03:01,200 So let's see if we can find these events. 75 75 00:03:01,200 --> 00:03:02,970 So as we start looking through this, 76 76 00:03:02,970 --> 00:03:06,720 we see at 1:43 there was a Windows update call out 77 77 00:03:06,720 --> 00:03:10,470 and then we saw this source going back to our machine 78 78 00:03:10,470 --> 00:03:13,800 over port 443 that is most likely connected to that. 79 79 00:03:13,800 --> 00:03:15,750 So we can skip that one. 80 80 00:03:15,750 --> 00:03:18,360 We'll go ahead and keep going a little bit further. 81 81 00:03:18,360 --> 00:03:19,290 And if we scroll down 82 82 00:03:19,290 --> 00:03:23,460 we see 1:44:28 was the next process start. 83 83 00:03:23,460 --> 00:03:26,100 So 1:44:28, 29, somewhere around there 84 84 00:03:26,100 --> 00:03:27,420 would be what we're looking for. 85 85 00:03:27,420 --> 00:03:31,020 And right here we see 1:44:29 86 86 00:03:31,020 --> 00:03:33,360 and we had a standard query over DNS 87 87 00:03:33,360 --> 00:03:36,423 for an API dot iPifive.org. 88 88 00:03:37,500 --> 00:03:39,510 This callout is going from our machine 89 89 00:03:39,510 --> 00:03:41,280 to the Google DNS server. 90 90 00:03:41,280 --> 00:03:43,860 Once it finds out what that IP address is 91 91 00:03:43,860 --> 00:03:46,649 it starts making that call out from our computer 92 92 00:03:46,649 --> 00:03:51,649 over TCP over port 80 to this remote IP address. 93 93 00:03:52,320 --> 00:03:54,270 So we're going to note that in our notes 94 94 00:03:54,270 --> 00:03:57,300 that this is a possible issue for us. 95 95 00:03:57,300 --> 00:03:59,520 This may be one of those IP addresses 96 96 00:03:59,520 --> 00:04:03,240 and this IP (indistinct) might be part of our malware. 97 97 00:04:03,240 --> 00:04:05,640 And so we'll keep looking as we go down. 98 98 00:04:05,640 --> 00:04:06,780 So the next one we have 99 99 00:04:06,780 --> 00:04:10,920 if we go down here on the right is 1:45. 100 100 00:04:10,920 --> 00:04:14,130 It tries it again about a minute later. 101 101 00:04:14,130 --> 00:04:17,970 Now this 1:45 timeframe, we're going to scroll down here 102 102 00:04:17,970 --> 00:04:19,590 and see what we can see. 103 103 00:04:19,590 --> 00:04:24,420 At 1:45:28, which will be right around here, 104 104 00:04:24,420 --> 00:04:27,450 it again tries to make a connection 105 105 00:04:27,450 --> 00:04:32,450 this time from 54.254.136.64 to our machine. 106 106 00:04:34,980 --> 00:04:36,480 And from there we see 107 107 00:04:36,480 --> 00:04:38,940 that it now makes this two-way connection 108 108 00:04:38,940 --> 00:04:42,270 with an acknowledgement and finishing up that handshake. 109 109 00:04:42,270 --> 00:04:44,790 So that is a communication between our machine 110 110 00:04:44,790 --> 00:04:48,270 and our remote server that we're going to want to look into. 111 111 00:04:48,270 --> 00:04:51,282 Now if we do this, we can go follow TCP stream 112 112 00:04:51,282 --> 00:04:53,220 and see what was sent. 113 113 00:04:53,220 --> 00:04:55,290 In this case, there's not much to it. 114 114 00:04:55,290 --> 00:04:57,150 It's just a keep a live connection. 115 115 00:04:57,150 --> 00:05:00,750 There was a standard request for basically a webpage 116 116 00:05:00,750 --> 00:05:03,030 and to get an IP address back. 117 117 00:05:03,030 --> 00:05:05,760 Now the reason why is this particular piece of malware 118 118 00:05:05,760 --> 00:05:07,680 is a piece of training malware. 119 119 00:05:07,680 --> 00:05:09,630 And so what we're seeing here is that 120 120 00:05:09,630 --> 00:05:12,037 it's going to this website and saying, 121 121 00:05:12,037 --> 00:05:13,830 "Hey, what's my IP address?" 122 122 00:05:13,830 --> 00:05:15,330 This local IP address. 123 123 00:05:15,330 --> 00:05:18,780 And that's the local IP address that you're finding here 124 124 00:05:18,780 --> 00:05:20,733 from this machine during this session. 125 125 00:05:21,720 --> 00:05:24,150 So as you can see, we can see those call outs 126 126 00:05:24,150 --> 00:05:27,270 and we can start making a list of IP addresses it calls to. 127 127 00:05:27,270 --> 00:05:30,150 If I left this running for a long period of time, 128 128 00:05:30,150 --> 00:05:32,130 like 10 or 15 or 20 minutes, 129 129 00:05:32,130 --> 00:05:33,570 you would see that it actually calls out 130 130 00:05:33,570 --> 00:05:35,760 over several different IP addresses 131 131 00:05:35,760 --> 00:05:38,460 as it tries to make its way to some command 132 132 00:05:38,460 --> 00:05:40,770 and control server because maybe we are blocking this one 133 133 00:05:40,770 --> 00:05:42,360 because we already knew it was bad 134 134 00:05:42,360 --> 00:05:44,070 but it can then move to the next one. 135 135 00:05:44,070 --> 00:05:47,010 That's the idea here, and what we're trying to figure out 136 136 00:05:47,010 --> 00:05:49,980 is where these TCP connections are going to 137 137 00:05:49,980 --> 00:05:52,290 so we can develop these indicators of compromise 138 138 00:05:52,290 --> 00:05:53,850 and block them in our firewall. 139 139 00:05:53,850 --> 00:05:57,090 So even if we are infected with this stage one dropper, 140 140 00:05:57,090 --> 00:05:59,250 it can't go and get the stage two malware 141 141 00:05:59,250 --> 00:06:00,483 and start installing it.