《25-ThomasChopiteaMalcon》.pdf

WHEN T HE HUNT ER BECOMES T HE HUNT ED HUNT ING DOWN BOT NETS USING NETWORK T RA FFIC A NA LYSIS /ABOUT/ ME Thomas Chopitea - Incident handler @CertSG Digital forensics incident response (#DFIR), malware analysis, recent member of the Honeynet Project Twitter: @tomchop_ Blog: http://tomchop.me/ Also: were hiring ! /joinusnow !.html /ABOUT/T HETALK Common IR problems What is Malcom and how it leverages network traffic analysis and OSINT to solve them Malcom vs. botnets (demos, yay !) How you can use Malcom to deal with these problems How you can help Malcom grow stronger I HAV E A LOT OF PROBLEMS PPRROOBBLLEEMM ##11 KKIILLLL TTHHEE MMAALLWWAARREE PROBLEM #1: KILL T HE MALWARE I need to: Enumerate domain names / IP addresses Identify resources (gates, dropzones, configs, etc.) Gather exchanged data (Configuration files? Stolen data?) PROBLEM #1: KILL T HE MALWARE So I can: Alert the owners of stolen info send takedown requests Build threat intelligence (so that I can refer to it later) Start incident remediation NNOOTT SSUURREE IIFF CCRRIITTIICCAALL PPRROOBBLLEEMM ##22 OORR JJUUSSTT AANNOOTTHHEERR SSTTRRAAIINN OOFF ZZEEUUSS PROBLEM #2: WT F IS T HIS? Sure, I could: Do an antivirus scan on it and get Troj/Gen Suspicious Reverse engineer it (3 samples a day? yeah right) Obvs: run it in a sandbox and do some behavioral analysis x-ref network artifacts against public blacklists PROBLEM #3 I NEED T O DO IT FAST (cause incidents keep popping up) PROBLEM #3: GOGOGO Dont want : start Wireshark, text editor, snort, tcpflow, foremost, etc. Want : Drop my malware in a VM, and quickly know: