SlideShare a Scribd company logo

Banker Trojans from a forensic perspective

•
•
J
J Hartig

CSIS gennemgang af Forensics

Internet
1 of 56
REST ASSURED Banker Trojans from a forensics perspective ATEA ERFA, MARTS 2017 www.csis.dk
Glossary Banker Trojan C2, CnC, C&C, C2C server Drop server Drive-by website Exploit kit Configuration file Web inject Dropper Sinkhole DGA Money Mule Rogue DNS Sandbox Cryptor Payload Hybrid attacks PPI Banker Trojans from a forensics perspective
08080808 ******* 08080808 ******* 1234 How does a banker Trojan work?
REST ASSURED www.csis.dk
REST ASSURED www.csis.dk
Agenda 1.00 What? 2.00 How? 3.00 When? 4.00 Tools (free) 5.00 Case example: Carbanak & Dridex 6.00 CIRK (Commercial tool) 7.00 Real life examples Banker Trojans from a forensics perspective
1.00 What? – Let’s find the malware, it is most likely persistent Banker Trojans from a forensics perspective
8 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency
9 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Carbanak
10 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Sality
11 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Rovnix (Gozi2)
12 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Carbanak
Title of the presentation 2.00 How? – Let’s see how the malware was installed Banker Trojans from a forensics perspective
14 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: APT
15 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: CryptoWall 3.0
16 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: Dyreza
17 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: Dridex
18 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: Dridex
3.00 When? – Let’s see when the malware was installed Banker Trojans from a forensics perspective
20 When? Create a master timeline: • Files • Registry • Browser history • Event log • Scheduled task • PF files • Etc. File timestamps are easily manipulated, but registry entries seldom Malware: Carbanak Timestamp Artifact source Data 2015-08- 26T13:05:48 +00:00 FILE Mactime Bodyfile C:/ProgramData/Mozilla/sv chost.exe (deleted)
21 When? Create a master timeline: • Files • Registry • Browser history • Event log • Scheduled task • PF files • Etc. File timestamps are easily manipulated, but registry entries seldom Malware: Dridex Timestamp Artifact source Data 2015-08-25 T14:00:08.39 6076+00:00 Registry hive [HKEY_CURRENT_USERSoftwareMicros oftOffice15.0WordReading LocationsDocument 6] C:UsersmoragAppData LocalMicrosoftWindows Temporary Internet FilesContent.OutlookZOZ N2DEXInv_26949_from_I __SPI_Ltd_7888.doc
4.00 Tools (free) Banker Trojans from a forensics perspective
23 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) CIRK collector GUI
24 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) CIRK collector command line with silent switches
25 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Log2timeline // Create plaso DB = structured DB #> log2timeline.py -z [TZ] db.plaso [ FOLDER | IMAGE | FILE ] // Sort and output timeline in a TEXT file #> psort.py -z [TZ] db.plaso "select datetime,timestamp_desc,message" -w master.timeline // Look for last 1024 executed files #> grep AppCompatCache master.timeline | grep svchost | cut -d " " -f 1,10 2009-07-14T01:14:41.954000+00:00,File ??C:Windowssystem32svchost.exe 2009-07-14T01:14:41.954000+00:00,File ??C:WindowsSysWOW64svchost.exe 2009-07-14T01:14:41.954000+00:00,File ??C:WindowsSysWOW64svchost.exe 2009-07-14T01:14:41.954000+00:00,File ??C:Windowssystem32svchost.exe 2009-07-14T01:39:46.503000+00:00,File ??C:WindowsSystem32svchost.exe 2009-07-14T01:39:46.503000+00:00,File ??C:WindowsSystem32svchost.exe 2015-08-26T14:30:10.977531+00:00,File ??C:ProgramDataMozillasvchost.exe 2015-08-26T14:30:10.977531+00:00,File ??C:ProgramDataMozillasvchost.exe //Look for malware droppers #> grep UserAssist master.timeline
26 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) rip.pl // Extract ”interesting keys” from registry #> rip.pl –r [REG_HIVE] –f [TEMPLATE] // Example #> rip.pl –r ntuser.dat –f ntuser > ntuser_interesting_keys.txt // Look out for ”suspicious” autorun keys SoftwareMicrosoftWindowsCurrentVersionRun LastWrite Time Thu May 7 10:31:18 2015 (UTC) Sidebar: C:Program FilesWindows Sidebarsidebar.exe /autoRun aaaaaaaa: C:Usersallisonraaaaaaaa.exe RESTART_STICKY_NOTES: C:WindowsSystem32StikyNot.exe
27 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) regdump.pl // Dump registry #> regdump.pl [REG_HIVE] –v [KEY] // Example #> regdump.pl morag_ntuser.bin SoftwareMicrosoftWindowsCurrentVersion ExplorerCLSID{49A4A2C4-5E41-262E-A4E5-BF116F5A3FF4} ShellFolder morag_ntuser.bin –v | hexdump -C
28 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) regdump.pl // Dump registry #> regdump.pl [REG_HIVE] –v [KEY] // Example #> regdump.pl morag_ntuser.bin SoftwareMicrosoftWindowsCurrentVersion ExplorerCLSID{49A4A2C4-5E41-262E-A4E5-BF116F5A3FF4} ShellFolder morag_ntuser.bin –v | hexdump -C
29 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) regdump.pl // Dump registry #> regdump.pl [REG_HIVE] –v [KEY] // Example #> regdump.pl morag_ntuser.bin SoftwareMicrosoftWindowsCurrentVersion ExplorerCLSID{49A4A2C4-5E41-262E-A4E5-BF116F5A3FF4} ShellFolder morag_ntuser.bin –v | hexdump -C
30 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Maltego // Lots of possibility, it depends on the transforms. // Example #1: toLocationCountry
31 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Maltego // Lots of possibility, it depends on the transforms. // Example #1: CSISCampaignNameFromIP
32 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Maltego // Lots of possibility, it depends on the transforms. // Example #1: CSISCampaignNameFromPhrase
33 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Virustotal // Check hashes and/or URLs // Example: Revoked certificate (hash: 682f39be218a29818b27a4a7753fffa9)
34 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Google // Google knows everything // Example: ”Inv_26949_from_I__SPI_Ltd_7888.doc”
5.00 Case: Carbanak & Dridex (4235432-20150828-GVZ66) Banker Trojans from a forensics perspective
6.00 CIRK (Commercial tool) Banker Trojans from a forensics perspective
37 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Collector (GUI / CLI) – Standalone executable
38 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Collector (GUI / CLI) – Silent switches / remote execution
39 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Known Bad Hashes
40 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Possible Malware Droppers
41 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Suspicious Files
42 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Remote Administration Tools
43 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit AutoRun keys
44 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit NetStat Connections
45 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Quality assurance (OPTIONAL)
46 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting
47 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting
48 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting (Open IOC standard)
49 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting (Open IOC standard)
50 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Data sharing LE (J-CAT)
51 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Data sharing LE (J-CAT)
52 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Dashboard
7.00 Examples: Case: Smokebot & Mimikatz (2242474-20170120-0T5SX) Case: Trickbot & Pony (2242474-20161104-P22DA) Case: Ramnit (4235827-20170106-PMMNZ) Case: Cryptolocker (4235918-20170119-PCWEB) Banker Trojans from a forensics perspective
54 CIRK Benefits Find out • What happened? • When did it happen? • How did it happen? Unique forensic tool • Works with both: “Malicious employees” - & malware forensic • Collect & analyze evidence fast and secure • Comply with legal authorities & regulations • J-CAT integration Managed cloud service • Managed by specialists • Analysis performed out-of-band • Remote execution & no installation required • SaaS: No hardware & software costs
55 Learn more? CSIS Academy: Fraud Analyst Module 1: Threat assessment & landscape • Full Circle Crime Model • PC Malware • Mobile Malware • Introduction to Linux Module 2: Fraud techniques & attacks • Gathering intelligence • “Lie to me” • Hands-on exercises Module 3: Fraud detection & prevention • Spoofing techniques • Fraud detection • Forensics analysis • Hands-on exercises • Fraud prevention
Thank you For more information, please contact jka@csis.dk www.csis.dk REST ASSURED

Recommended

(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threatINSIGHT FORENSIC
 
"A rootkits writer’s guide to defense" - Michal Purzynski
"A rootkits writer’s guide to defense" - Michal Purzynski"A rootkits writer’s guide to defense" - Michal Purzynski
"A rootkits writer’s guide to defense" - Michal PurzynskiPROIDEA
 
Two-For-One Talk: Malware Analysis for Everyone
Two-For-One Talk: Malware Analysis for EveryoneTwo-For-One Talk: Malware Analysis for Everyone
Two-For-One Talk: Malware Analysis for EveryonePaul Melson
 
Fast Detection of New Malicious Domains using DNS
Fast Detection of New Malicious Domains using DNSFast Detection of New Malicious Domains using DNS
Fast Detection of New Malicious Domains using DNSOpenDNS
 
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)Jared Atkinson
 
"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) Shen
"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) Shen"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) Shen
"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) ShenPROIDEA
 
(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)INSIGHT FORENSIC
 
44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell
44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell
44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell44CON
 

Recommended

(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threatINSIGHT FORENSIC
 
"A rootkits writer’s guide to defense" - Michal Purzynski
"A rootkits writer’s guide to defense" - Michal Purzynski"A rootkits writer’s guide to defense" - Michal Purzynski
"A rootkits writer’s guide to defense" - Michal PurzynskiPROIDEA
 
Two-For-One Talk: Malware Analysis for Everyone
Two-For-One Talk: Malware Analysis for EveryoneTwo-For-One Talk: Malware Analysis for Everyone
Two-For-One Talk: Malware Analysis for EveryonePaul Melson
 
Fast Detection of New Malicious Domains using DNS
Fast Detection of New Malicious Domains using DNSFast Detection of New Malicious Domains using DNS
Fast Detection of New Malicious Domains using DNSOpenDNS
 
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)
BSidesDC - **** it, Do It Live (PowerShell Digital Forensics)Jared Atkinson
 
"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) Shen
"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) Shen"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) Shen
"Into the Fog The Return of ICEFOG APT" - Chi en (Ashley) ShenPROIDEA
 
(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)(130105) #fitalk trends in d forensics (dec, 2012)
(130105) #fitalk trends in d forensics (dec, 2012)INSIGHT FORENSIC
 
44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell
44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell
44CON London 2015 - Old Dog, New Tricks: Forensics With PowerShell44CON
 
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documentsREMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documentsRhydham Joshi
 
44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensics44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensicsJared Atkinson
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacksBalaji Rajasekaran
 
REMnux tutorial-2: Extraction and decoding of Artifacts
REMnux tutorial-2: Extraction and decoding of ArtifactsREMnux tutorial-2: Extraction and decoding of Artifacts
REMnux tutorial-2: Extraction and decoding of ArtifactsRhydham Joshi
 
Remnux tutorial-1 Statically Analyse Portable Executable(PE) Files
Remnux tutorial-1 Statically Analyse Portable Executable(PE) FilesRemnux tutorial-1 Statically Analyse Portable Executable(PE) Files
Remnux tutorial-1 Statically Analyse Portable Executable(PE) FilesRhydham Joshi
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersTazdrumm3r
 
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...Paladion Networks
 
The day I ruled the world (RootedCON 2020)
The day I ruled the world (RootedCON 2020)The day I ruled the world (RootedCON 2020)
The day I ruled the world (RootedCON 2020)Javier Junquera
 
Hitbkl 2012
Hitbkl 2012Hitbkl 2012
Hitbkl 2012F _
 
End-to-End Analysis of a Domain Generating Algorithm Malware Family
End-to-End Analysis of a Domain Generating Algorithm Malware FamilyEnd-to-End Analysis of a Domain Generating Algorithm Malware Family
End-to-End Analysis of a Domain Generating Algorithm Malware FamilyCrowdStrike
 
Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Rhydham Joshi
 
Defcon
DefconDefcon
DefconOpenDNS
 
DoH, DoT and ESNI
DoH, DoT and ESNIDoH, DoT and ESNI
DoH, DoT and ESNIJisc
 
My Bro The ELK
My Bro The ELKMy Bro The ELK
My Bro The ELKTripwire
 
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...JosephTesta9
 
Encrypted DNS - DNS over TLS / DNS over HTTPS
Encrypted DNS - DNS over TLS / DNS over HTTPSEncrypted DNS - DNS over TLS / DNS over HTTPS
Encrypted DNS - DNS over TLS / DNS over HTTPSAlex Mayrhofer
 
Minieri CS6262 Project Poster
Minieri CS6262 Project PosterMinieri CS6262 Project Poster
Minieri CS6262 Project PosterJoe Minieri
 
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShellJared Atkinson
 
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...Felipe Prado
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]RootedCON
 
Social enginering Erfa-møde Marts 2017
Social enginering Erfa-møde Marts 2017Social enginering Erfa-møde Marts 2017
Social enginering Erfa-møde Marts 2017J Hartig
 
How to Become a Thought Leader in Your Niche
How to Become a Thought Leader in Your NicheHow to Become a Thought Leader in Your Niche
How to Become a Thought Leader in Your NicheLeslie Samuel
 

More Related Content

What's hot

REMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documentsREMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documentsRhydham Joshi
 
44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensics44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensicsJared Atkinson
 
REMnux tutorial-2: Extraction and decoding of Artifacts
REMnux tutorial-2: Extraction and decoding of ArtifactsREMnux tutorial-2: Extraction and decoding of Artifacts
REMnux tutorial-2: Extraction and decoding of ArtifactsRhydham Joshi
 
Remnux tutorial-1 Statically Analyse Portable Executable(PE) Files
Remnux tutorial-1 Statically Analyse Portable Executable(PE) FilesRemnux tutorial-1 Statically Analyse Portable Executable(PE) Files
Remnux tutorial-1 Statically Analyse Portable Executable(PE) FilesRhydham Joshi
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersTazdrumm3r
 
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...Paladion Networks
 
The day I ruled the world (RootedCON 2020)
The day I ruled the world (RootedCON 2020)The day I ruled the world (RootedCON 2020)
The day I ruled the world (RootedCON 2020)Javier Junquera
 
Hitbkl 2012
Hitbkl 2012Hitbkl 2012
Hitbkl 2012F _
 
End-to-End Analysis of a Domain Generating Algorithm Malware Family
End-to-End Analysis of a Domain Generating Algorithm Malware FamilyEnd-to-End Analysis of a Domain Generating Algorithm Malware Family
End-to-End Analysis of a Domain Generating Algorithm Malware FamilyCrowdStrike
 
Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Rhydham Joshi
 
DoH, DoT and ESNI
DoH, DoT and ESNIDoH, DoT and ESNI
DoH, DoT and ESNIJisc
 
My Bro The ELK
My Bro The ELKMy Bro The ELK
My Bro The ELKTripwire
 
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...JosephTesta9
 
Encrypted DNS - DNS over TLS / DNS over HTTPS
Encrypted DNS - DNS over TLS / DNS over HTTPSEncrypted DNS - DNS over TLS / DNS over HTTPS
Encrypted DNS - DNS over TLS / DNS over HTTPSAlex Mayrhofer
 
Minieri CS6262 Project Poster
Minieri CS6262 Project PosterMinieri CS6262 Project Poster
Minieri CS6262 Project PosterJoe Minieri
 
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShellJared Atkinson
 
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...Felipe Prado
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]RootedCON
 

What's hot (20)

REMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documentsREMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
REMnux Tutorial-3: Investigation of Malicious PDF & Doc documents
 
44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensics44CON London 2015: NTFS Analysis with PowerForensics
44CON London 2015: NTFS Analysis with PowerForensics
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
 
REMnux tutorial-2: Extraction and decoding of Artifacts
REMnux tutorial-2: Extraction and decoding of ArtifactsREMnux tutorial-2: Extraction and decoding of Artifacts
REMnux tutorial-2: Extraction and decoding of Artifacts
 
Remnux tutorial-1 Statically Analyse Portable Executable(PE) Files
Remnux tutorial-1 Statically Analyse Portable Executable(PE) FilesRemnux tutorial-1 Statically Analyse Portable Executable(PE) Files
Remnux tutorial-1 Statically Analyse Portable Executable(PE) Files
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invaders
 
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
Early Detection of Malicious Flux Networks via Large Scale Passive DNS Traffi...
 
The day I ruled the world (RootedCON 2020)
The day I ruled the world (RootedCON 2020)The day I ruled the world (RootedCON 2020)
The day I ruled the world (RootedCON 2020)
 
Hitbkl 2012
Hitbkl 2012Hitbkl 2012
Hitbkl 2012
 
End-to-End Analysis of a Domain Generating Algorithm Malware Family
End-to-End Analysis of a Domain Generating Algorithm Malware FamilyEnd-to-End Analysis of a Domain Generating Algorithm Malware Family
End-to-End Analysis of a Domain Generating Algorithm Malware Family
 
Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1
 
Defcon
DefconDefcon
Defcon
 
DoH, DoT and ESNI
DoH, DoT and ESNIDoH, DoT and ESNI
DoH, DoT and ESNI
 
My Bro The ELK
My Bro The ELKMy Bro The ELK
My Bro The ELK
 
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
BSides Rochester 2018: Chris Partridge: Turning Domain Data Into Domain Intel...
 
Encrypted DNS - DNS over TLS / DNS over HTTPS
Encrypted DNS - DNS over TLS / DNS over HTTPSEncrypted DNS - DNS over TLS / DNS over HTTPS
Encrypted DNS - DNS over TLS / DNS over HTTPS
 
Minieri CS6262 Project Poster
Minieri CS6262 Project PosterMinieri CS6262 Project Poster
Minieri CS6262 Project Poster
 
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
44CON London 2015: Old Dog, New Tricks: Forensics with PowerShell
 
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]
 

Viewers also liked

Social enginering Erfa-møde Marts 2017
Social enginering Erfa-møde Marts 2017Social enginering Erfa-møde Marts 2017
Social enginering Erfa-møde Marts 2017J Hartig
 
How to Become a Thought Leader in Your Niche
How to Become a Thought Leader in Your NicheHow to Become a Thought Leader in Your Niche
How to Become a Thought Leader in Your NicheLeslie Samuel
 
3 Things Every Sales Team Needs to Be Thinking About in 2017
3 Things Every Sales Team Needs to Be Thinking About in 20173 Things Every Sales Team Needs to Be Thinking About in 2017
3 Things Every Sales Team Needs to Be Thinking About in 2017Drift
 
A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...
A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...
A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...SlideShare
 
What Makes Great Infographics
What Makes Great InfographicsWhat Makes Great Infographics
What Makes Great InfographicsSlideShare
 
Masters of SlideShare
Masters of SlideShareMasters of SlideShare
Masters of SlideShareKapost
 
STOP! VIEW THIS! 10-Step Checklist When Uploading to Slideshare
STOP! VIEW THIS! 10-Step Checklist When Uploading to SlideshareSTOP! VIEW THIS! 10-Step Checklist When Uploading to Slideshare
STOP! VIEW THIS! 10-Step Checklist When Uploading to SlideshareEmpowered Presentations
 
10 Ways to Win at SlideShare SEO & Presentation Optimization
10 Ways to Win at SlideShare SEO & Presentation Optimization10 Ways to Win at SlideShare SEO & Presentation Optimization
10 Ways to Win at SlideShare SEO & Presentation OptimizationOneupweb
 
How To Get More From SlideShare - Super-Simple Tips For Content Marketing
How To Get More From SlideShare - Super-Simple Tips For Content MarketingHow To Get More From SlideShare - Super-Simple Tips For Content Marketing
How To Get More From SlideShare - Super-Simple Tips For Content MarketingContent Marketing Institute
 
How to Make Awesome SlideShares: Tips & Tricks
How to Make Awesome SlideShares: Tips & TricksHow to Make Awesome SlideShares: Tips & Tricks
How to Make Awesome SlideShares: Tips & TricksSlideShare
 
Getting Started With SlideShare
Getting Started With SlideShareGetting Started With SlideShare
Getting Started With SlideShareSlideShare
 

Viewers also liked (12)

Social enginering Erfa-møde Marts 2017
Social enginering Erfa-møde Marts 2017Social enginering Erfa-møde Marts 2017
Social enginering Erfa-møde Marts 2017
 
How to Become a Thought Leader in Your Niche
How to Become a Thought Leader in Your NicheHow to Become a Thought Leader in Your Niche
How to Become a Thought Leader in Your Niche
 
3 Things Every Sales Team Needs to Be Thinking About in 2017
3 Things Every Sales Team Needs to Be Thinking About in 20173 Things Every Sales Team Needs to Be Thinking About in 2017
3 Things Every Sales Team Needs to Be Thinking About in 2017
 
A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...
A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...
A Guide to SlideShare Analytics - Excerpts from Hubspot's Step by Step Guide ...
 
What Makes Great Infographics
What Makes Great InfographicsWhat Makes Great Infographics
What Makes Great Infographics
 
Masters of SlideShare
Masters of SlideShareMasters of SlideShare
Masters of SlideShare
 
STOP! VIEW THIS! 10-Step Checklist When Uploading to Slideshare
STOP! VIEW THIS! 10-Step Checklist When Uploading to SlideshareSTOP! VIEW THIS! 10-Step Checklist When Uploading to Slideshare
STOP! VIEW THIS! 10-Step Checklist When Uploading to Slideshare
 
You Suck At PowerPoint!
You Suck At PowerPoint!You Suck At PowerPoint!
You Suck At PowerPoint!
 
10 Ways to Win at SlideShare SEO & Presentation Optimization
10 Ways to Win at SlideShare SEO & Presentation Optimization10 Ways to Win at SlideShare SEO & Presentation Optimization
10 Ways to Win at SlideShare SEO & Presentation Optimization
 
How To Get More From SlideShare - Super-Simple Tips For Content Marketing
How To Get More From SlideShare - Super-Simple Tips For Content MarketingHow To Get More From SlideShare - Super-Simple Tips For Content Marketing
How To Get More From SlideShare - Super-Simple Tips For Content Marketing
 
How to Make Awesome SlideShares: Tips & Tricks
How to Make Awesome SlideShares: Tips & TricksHow to Make Awesome SlideShares: Tips & Tricks
How to Make Awesome SlideShares: Tips & Tricks
 
Getting Started With SlideShare
Getting Started With SlideShareGetting Started With SlideShare
Getting Started With SlideShare
 

Similar to Banker Trojans from a forensic perspective

You need a PROcess to catch running processes and their modules_v2.0
You need a PROcess to catch running processes and their modules_v2.0You need a PROcess to catch running processes and their modules_v2.0
You need a PROcess to catch running processes and their modules_v2.0Michael Gough
 
Anton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin
 
Logs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefLogs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefMichael Gough
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
 
Let's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and DetectionLet's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and DetectionJames Haughom Jr
 
Malware collection and analysis
Malware collection and analysisMalware collection and analysis
Malware collection and analysisChong-Kuan Chen
 
CNIT 152 12 Investigating Windows Systems (Part 2)
CNIT 152 12 Investigating Windows Systems (Part 2)CNIT 152 12 Investigating Windows Systems (Part 2)
CNIT 152 12 Investigating Windows Systems (Part 2)Sam Bowne
 
Modern Reconnaissance Phase on APT - protection layer
Modern Reconnaissance Phase on APT - protection layerModern Reconnaissance Phase on APT - protection layer
Modern Reconnaissance Phase on APT - protection layerShakacon
 
Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Rhydham Joshi
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware AnalysisAndrew McNicol
 
CNIT 152: 12b Windows Registry
CNIT 152: 12b Windows RegistryCNIT 152: 12b Windows Registry
CNIT 152: 12b Windows RegistrySam Bowne
 
12 Investigating Windows Systems (Part 2 of 3)
12 Investigating Windows Systems (Part 2 of 3)12 Investigating Windows Systems (Part 2 of 3)
12 Investigating Windows Systems (Part 2 of 3)Sam Bowne
 
Is Troy Burning: an overview of targeted trojan attacks
Is Troy Burning: an overview of targeted trojan attacksIs Troy Burning: an overview of targeted trojan attacks
Is Troy Burning: an overview of targeted trojan attacksMaarten Van Horenbeeck
 

Similar to Banker Trojans from a forensic perspective (20)

You need a PROcess to catch running processes and their modules_v2.0
You need a PROcess to catch running processes and their modules_v2.0You need a PROcess to catch running processes and their modules_v2.0
You need a PROcess to catch running processes and their modules_v2.0
 
Anton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is Hacked
 
Logs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefLogs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thief
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
 
A Threat Hunter Himself
A Threat Hunter HimselfA Threat Hunter Himself
A Threat Hunter Himself
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
DR FAT
DR FATDR FAT
DR FAT
 
Let's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and DetectionLet's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and Detection
 
Malware collection and analysis
Malware collection and analysisMalware collection and analysis
Malware collection and analysis
 
Romulus OWASP
Romulus OWASPRomulus OWASP
Romulus OWASP
 
CNIT 152 12 Investigating Windows Systems (Part 2)
CNIT 152 12 Investigating Windows Systems (Part 2)CNIT 152 12 Investigating Windows Systems (Part 2)
CNIT 152 12 Investigating Windows Systems (Part 2)
 
Modern Reconnaissance Phase on APT - protection layer
Modern Reconnaissance Phase on APT - protection layerModern Reconnaissance Phase on APT - protection layer
Modern Reconnaissance Phase on APT - protection layer
 
Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1Anomalies Detection: Windows OS - Part 1
Anomalies Detection: Windows OS - Part 1
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
CNIT 152: 12b Windows Registry
CNIT 152: 12b Windows RegistryCNIT 152: 12b Windows Registry
CNIT 152: 12b Windows Registry
 
12 Investigating Windows Systems (Part 2 of 3)
12 Investigating Windows Systems (Part 2 of 3)12 Investigating Windows Systems (Part 2 of 3)
12 Investigating Windows Systems (Part 2 of 3)
 
Is Troy Burning: an overview of targeted trojan attacks
Is Troy Burning: an overview of targeted trojan attacksIs Troy Burning: an overview of targeted trojan attacks
Is Troy Burning: an overview of targeted trojan attacks
 
Spo2 t19 spo2-t19
Spo2 t19 spo2-t19Spo2 t19 spo2-t19
Spo2 t19 spo2-t19
 
File000125
File000125File000125
File000125
 
Defending Your "Gold"
Defending Your "Gold"Defending Your "Gold"
Defending Your "Gold"
 

Recently uploaded

Russian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls KolkataRussian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls Kolkataanamikaraghav4
 
Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24Paul Calvano
 
Complet Documnetation for Smart Assistant Application for Disabled Person
Complet Documnetation for Smart Assistant Application for Disabled PersonComplet Documnetation for Smart Assistant Application for Disabled Person
Complet Documnetation for Smart Assistant Application for Disabled Personfurqan222004
 
Magic exist by Marta Loveguard - presentation.pptx
Magic exist by Marta Loveguard - presentation.pptxMagic exist by Marta Loveguard - presentation.pptx
Magic exist by Marta Loveguard - presentation.pptxMartaLoveguard
 
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts serviceChennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts servicesonalikaur4
 
Contact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New DelhiContact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New Delhimiss dipika
 
Chennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts serviceChennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts servicevipmodelshub1
 
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)Dana Luther
 
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012rehmti665
 
VIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With Room
VIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With RoomVIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With Room
VIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With Roomishabajaj13
 
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on DeliveryCall Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Deliverybabeytanya
 
Russian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls KolkataRussian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls Kolkataanamikaraghav4
 
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一Fs
 
Denver Web Design brochure for public viewing
Denver Web Design brochure for public viewingDenver Web Design brochure for public viewing
Denver Web Design brochure for public viewingbigorange77
 
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With RoomVIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Roomdivyansh0kumar0
 
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With RoomVIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Roomdivyansh0kumar0
 
AlbaniaDreamin24 - How to easily use an API with Flows
AlbaniaDreamin24 - How to easily use an API with FlowsAlbaniaDreamin24 - How to easily use an API with Flows
AlbaniaDreamin24 - How to easily use an API with FlowsThierry TROUIN ☁
 
定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一
定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一
定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一3sw2qly1
 

Recently uploaded (20)

young call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Service
young call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Serviceyoung call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Service
young call girls in Uttam Nagar🔝 9953056974 🔝 Delhi escort Service
 
Russian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls KolkataRussian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Samaira 🤌 8250192130 🚀 Vip Call Girls Kolkata
 
Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24Font Performance - NYC WebPerf Meetup April '24
Font Performance - NYC WebPerf Meetup April '24
 
Complet Documnetation for Smart Assistant Application for Disabled Person
Complet Documnetation for Smart Assistant Application for Disabled PersonComplet Documnetation for Smart Assistant Application for Disabled Person
Complet Documnetation for Smart Assistant Application for Disabled Person
 
Magic exist by Marta Loveguard - presentation.pptx
Magic exist by Marta Loveguard - presentation.pptxMagic exist by Marta Loveguard - presentation.pptx
Magic exist by Marta Loveguard - presentation.pptx
 
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts serviceChennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
 
Contact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New DelhiContact Rya Baby for Call Girls New Delhi
Contact Rya Baby for Call Girls New Delhi
 
Chennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts serviceChennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Alwarpet Phone 🍆 8250192130 👅 celebrity escorts service
 
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
 
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
 
VIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With Room
VIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With RoomVIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With Room
VIP Kolkata Call Girl Salt Lake 👉 8250192130 Available With Room
 
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on DeliveryCall Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
 
Russian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls KolkataRussian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls Kolkata
Russian Call Girls in Kolkata Ishita 🤌 8250192130 🚀 Vip Call Girls Kolkata
 
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
定制(Lincoln毕业证书)新西兰林肯大学毕业证成绩单原版一比一
 
Denver Web Design brochure for public viewing
Denver Web Design brochure for public viewingDenver Web Design brochure for public viewing
Denver Web Design brochure for public viewing
 
Hot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort Service
Hot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort ServiceHot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort Service
Hot Sexy call girls in Rk Puram 🔝 9953056974 🔝 Delhi escort Service
 
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With RoomVIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
 
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With RoomVIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
 
AlbaniaDreamin24 - How to easily use an API with Flows
AlbaniaDreamin24 - How to easily use an API with FlowsAlbaniaDreamin24 - How to easily use an API with Flows
AlbaniaDreamin24 - How to easily use an API with Flows
 
定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一
定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一
定制(CC毕业证书)美国美国社区大学毕业证成绩单原版一比一
 

Banker Trojans from a forensic perspective

  • 1. REST ASSURED Banker Trojans from a forensics perspective ATEA ERFA, MARTS 2017 www.csis.dk
  • 2. Glossary Banker Trojan C2, CnC, C&C, C2C server Drop server Drive-by website Exploit kit Configuration file Web inject Dropper Sinkhole DGA Money Mule Rogue DNS Sandbox Cryptor Payload Hybrid attacks PPI Banker Trojans from a forensics perspective
  • 6. Agenda 1.00 What? 2.00 How? 3.00 When? 4.00 Tools (free) 5.00 Case example: Carbanak & Dridex 6.00 CIRK (Commercial tool) 7.00 Real life examples Banker Trojans from a forensics perspective
  • 7. 1.00 What? – Let’s find the malware, it is most likely persistent Banker Trojans from a forensics perspective
  • 8. 8 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency
  • 9. 9 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Carbanak
  • 10. 10 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Sality
  • 11. 11 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Rovnix (Gozi2)
  • 12. 12 What? • Service creation • Binary replacement • Scheduled task • Auto-start Registry keys • Startup folders • DLL search order hijacking • Trojaned legitimate system libraries • More advanced – local group policy, MS office add-in, or BIOS flashing Most malware has some kind of persistency Malware: Carbanak
  • 13. Title of the presentation 2.00 How? – Let’s see how the malware was installed Banker Trojans from a forensics perspective
  • 14. 14 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: APT
  • 15. 15 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: CryptoWall 3.0
  • 16. 16 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: Dyreza
  • 17. 17 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: Dridex
  • 18. 18 How? Drive-by: • Temp files (jar, swf, exe, dll, tmp, etc.) • Browser history Spear phishing e-mail: • Known e-mail extensions (msg, eml, etc.) • Known e-mail attachments (pdf, js, src, zip, etc.) • Known e-mail file path (Content.Outlook) Let’s go find that malware dropper Malware: Dridex
  • 19. 3.00 When? – Let’s see when the malware was installed Banker Trojans from a forensics perspective
  • 20. 20 When? Create a master timeline: • Files • Registry • Browser history • Event log • Scheduled task • PF files • Etc. File timestamps are easily manipulated, but registry entries seldom Malware: Carbanak Timestamp Artifact source Data 2015-08- 26T13:05:48 +00:00 FILE Mactime Bodyfile C:/ProgramData/Mozilla/sv chost.exe (deleted)
  • 21. 21 When? Create a master timeline: • Files • Registry • Browser history • Event log • Scheduled task • PF files • Etc. File timestamps are easily manipulated, but registry entries seldom Malware: Dridex Timestamp Artifact source Data 2015-08-25 T14:00:08.39 6076+00:00 Registry hive [HKEY_CURRENT_USERSoftwareMicros oftOffice15.0WordReading LocationsDocument 6] C:UsersmoragAppData LocalMicrosoftWindows Temporary Internet FilesContent.OutlookZOZ N2DEXInv_26949_from_I __SPI_Ltd_7888.doc
  • 22. 4.00 Tools (free) Banker Trojans from a forensics perspective
  • 23. 23 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) CIRK collector GUI
  • 24. 24 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) CIRK collector command line with silent switches
  • 25. 25 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Log2timeline // Create plaso DB = structured DB #> log2timeline.py -z [TZ] db.plaso [ FOLDER | IMAGE | FILE ] // Sort and output timeline in a TEXT file #> psort.py -z [TZ] db.plaso "select datetime,timestamp_desc,message" -w master.timeline // Look for last 1024 executed files #> grep AppCompatCache master.timeline | grep svchost | cut -d " " -f 1,10 2009-07-14T01:14:41.954000+00:00,File ??C:Windowssystem32svchost.exe 2009-07-14T01:14:41.954000+00:00,File ??C:WindowsSysWOW64svchost.exe 2009-07-14T01:14:41.954000+00:00,File ??C:WindowsSysWOW64svchost.exe 2009-07-14T01:14:41.954000+00:00,File ??C:Windowssystem32svchost.exe 2009-07-14T01:39:46.503000+00:00,File ??C:WindowsSystem32svchost.exe 2009-07-14T01:39:46.503000+00:00,File ??C:WindowsSystem32svchost.exe 2015-08-26T14:30:10.977531+00:00,File ??C:ProgramDataMozillasvchost.exe 2015-08-26T14:30:10.977531+00:00,File ??C:ProgramDataMozillasvchost.exe //Look for malware droppers #> grep UserAssist master.timeline
  • 26. 26 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) rip.pl // Extract ”interesting keys” from registry #> rip.pl –r [REG_HIVE] –f [TEMPLATE] // Example #> rip.pl –r ntuser.dat –f ntuser > ntuser_interesting_keys.txt // Look out for ”suspicious” autorun keys SoftwareMicrosoftWindowsCurrentVersionRun LastWrite Time Thu May 7 10:31:18 2015 (UTC) Sidebar: C:Program FilesWindows Sidebarsidebar.exe /autoRun aaaaaaaa: C:Usersallisonraaaaaaaa.exe RESTART_STICKY_NOTES: C:WindowsSystem32StikyNot.exe
  • 27. 27 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) regdump.pl // Dump registry #> regdump.pl [REG_HIVE] –v [KEY] // Example #> regdump.pl morag_ntuser.bin SoftwareMicrosoftWindowsCurrentVersion ExplorerCLSID{49A4A2C4-5E41-262E-A4E5-BF116F5A3FF4} ShellFolder morag_ntuser.bin –v | hexdump -C
  • 28. 28 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) regdump.pl // Dump registry #> regdump.pl [REG_HIVE] –v [KEY] // Example #> regdump.pl morag_ntuser.bin SoftwareMicrosoftWindowsCurrentVersion ExplorerCLSID{49A4A2C4-5E41-262E-A4E5-BF116F5A3FF4} ShellFolder morag_ntuser.bin –v | hexdump -C
  • 29. 29 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) regdump.pl // Dump registry #> regdump.pl [REG_HIVE] –v [KEY] // Example #> regdump.pl morag_ntuser.bin SoftwareMicrosoftWindowsCurrentVersion ExplorerCLSID{49A4A2C4-5E41-262E-A4E5-BF116F5A3FF4} ShellFolder morag_ntuser.bin –v | hexdump -C
  • 30. 30 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Maltego // Lots of possibility, it depends on the transforms. // Example #1: toLocationCountry
  • 31. 31 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Maltego // Lots of possibility, it depends on the transforms. // Example #1: CSISCampaignNameFromIP
  • 32. 32 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Maltego // Lots of possibility, it depends on the transforms. // Example #1: CSISCampaignNameFromPhrase
  • 33. 33 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Virustotal // Check hashes and/or URLs // Example: Revoked certificate (hash: 682f39be218a29818b27a4a7753fffa9)
  • 34. 34 Tools • Data collector • log2timeline • rip.pl • regdump.pl • Maltego • Virustotal • Google • Etc. Tools (free) Google // Google knows everything // Example: ”Inv_26949_from_I__SPI_Ltd_7888.doc”
  • 35. 5.00 Case: Carbanak & Dridex (4235432-20150828-GVZ66) Banker Trojans from a forensics perspective
  • 36. 6.00 CIRK (Commercial tool) Banker Trojans from a forensics perspective
  • 37. 37 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Collector (GUI / CLI) – Standalone executable
  • 38. 38 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Collector (GUI / CLI) – Silent switches / remote execution
  • 39. 39 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Known Bad Hashes
  • 40. 40 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Possible Malware Droppers
  • 41. 41 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Suspicious Files
  • 42. 42 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Remote Administration Tools
  • 43. 43 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit AutoRun keys
  • 44. 44 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit NetStat Connections
  • 45. 45 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Quality assurance (OPTIONAL)
  • 46. 46 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting
  • 47. 47 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting
  • 48. 48 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting (Open IOC standard)
  • 49. 49 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Reporting (Open IOC standard)
  • 50. 50 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Data sharing LE (J-CAT)
  • 51. 51 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Data sharing LE (J-CAT)
  • 52. 52 CIRK • Collector • Backend analysis • Quality assurance (QA) • Reporting • Data sharing (J-CAT) • Dashboard CSIS Incident Response Kit Dashboard
  • 53. 7.00 Examples: Case: Smokebot & Mimikatz (2242474-20170120-0T5SX) Case: Trickbot & Pony (2242474-20161104-P22DA) Case: Ramnit (4235827-20170106-PMMNZ) Case: Cryptolocker (4235918-20170119-PCWEB) Banker Trojans from a forensics perspective
  • 54. 54 CIRK Benefits Find out • What happened? • When did it happen? • How did it happen? Unique forensic tool • Works with both: “Malicious employees” - & malware forensic • Collect & analyze evidence fast and secure • Comply with legal authorities & regulations • J-CAT integration Managed cloud service • Managed by specialists • Analysis performed out-of-band • Remote execution & no installation required • SaaS: No hardware & software costs
  • 55. 55 Learn more? CSIS Academy: Fraud Analyst Module 1: Threat assessment & landscape • Full Circle Crime Model • PC Malware • Mobile Malware • Introduction to Linux Module 2: Fraud techniques & attacks • Gathering intelligence • “Lie to me” • Hands-on exercises Module 3: Fraud detection & prevention • Spoofing techniques • Fraud detection • Forensics analysis • Hands-on exercises • Fraud prevention
  • 56. Thank you For more information, please contact jka@csis.dk www.csis.dk REST ASSURED