We've done that, and now I'm going to refer back
to, back on script stuff, right?
So I actually have these commands here.
The second one that we're going to look at it is going to look at this SSL log.
Okay. So we kind of got these kind of three ports that we know we can use a
search. We can probably open up the pcap in Wireshark, and we'll get into that
in a little bit and kind of identify what's going on.
But especially, if this is encrypted information, we need
to know that. It's going to be SSL, right?
And this is where that JA3 certificate, or hash, is
going to come into play as well.
So what is interesting about this one is that there's
not really a lot of hashes generating.
Yeah, that is kind of interesting, especially on the, kind of the odd ports.
Yeah, absolutely.
And this is, I'm not, if you'll notice, I'm not sorting by port, right?
I'm not I'm not filtering by port I guess is what I'm saying, right?
Okay.
So it makes sense SSL should mainly be over 443, but here we have that SSL or a
TLS running over 447 and 449. So then we have another set of things lining up
with that weird traffic that's associated TrickBot.
Right. Right.
So let me ask what with this, one of the things with analysis is understanding
what looks normal versus what is unusual. If you were to just go onto a normal
system that was doing all this network traffic,
how would you expect the JA3 tags or hashes to look in that case?
Yeah, absolutely.
So we've got into it in some other courses and research that I've done as
well, but we did traffic analysis on a medium‑sized network for about 3
hours, and we had 16 different client JA3 hashes.
Okay,
so you would expect to see more than just what we're seeing here. There's mores,
but it's still not like an exorbitant amount.
And again,
the least frequent case, we often saw like 10,000, 3,000, 4,000, whatever, and
then there was like 5, and we're like, well, what is that?
That's weird, right?
Right. And then even here what points out that's more weird is SSL not
on 443. Yeah, and would you normally expect to see the same JA3 hash
on two different ports? You would not. That would normally be, well,
it depends on the application, right? So ts is going to be application specific,
which is why it's one of my favorite tools ever is because it is a
network tool, but we're also, it's associated directly with the
executable running on the device. And so this executable has only
certain libraries built in for that cipher suite, so it can only offer
those libraries in the TLS handshake.
Okay, that makes sense.
And so those libraries are what make the MD5 hash, and so it becomes kind of a
potential unique identifier for that executable. And especially when we talk
about malware and malware authors is they're not Google and they're not
Microsoft, and so they're not including every possible cipher suite, so it
doesn't end up being reasonably unique. And the other side of that, we can also
get the server side of that,
which is we can do that by just adding the s, right? So there's the
server side as well. And so here we have the same application reach out
on two different servers on 443. I can't verify that that is or is not
TrickBot. I just don't know, mainly based on this. I can look at these
hashes, and we can go back, and remember I said that JA3 on the
Salesforce GitHub, they actually looked at TrickBot,
right?
So if we come here,
here's an Emotet sample, and we can go back and look and
see if that's it, and then here's a TrickBot client sample.
And if we look back at that, that 673 there, that's none of them.
Right. So it's kind of interesting in the first place because this is, we're
reasonably positive that 447 and 449 is TrickBot, but neither the server nor
the client JA3 hash. So is this something new?
Maybe. So let's keep scrolling down .And I was looking at
this in preparation for this Play by Play, and I also saw
that they have the C2 servers, right?
So here's the fingerprint of TrickBot on the client, and then we
have the fingerprint of the command and control server response.
So there's the 673 for the client and the 623de for the server,
and then look at that.
So that is the exact same command and control.
Okay. We can reasonably say that this is the same version of
software for command and control running on that server that
they saw when they looked at TrickBot.
Okay, cool.
Which is kind of neat because it's built into that binary
that's running that command and control server.
And it's just another way that we can kind of confirm that the 447 and
the 449 traffic is really using TrickBot. Absolutely.
And what's even more interesting is we now kind of discovered an
indicator for this new version on the client side, is we have this JA3
hash here, and they have an associated project called JA3 here where
there's 1605 different JA3 hashes that have been submitted so that you
can identify different applications.
The idea here is remember I talked about there's only 16 JA3
hashes identified in a normal network, is that you can
whitelist them. Because why not, right?.
Make it easy to spot the outliers.
Yeah, exactly.
So I'm going to search for this hash and see if we come up
with that or if anyone's ever seen it before,
because that's kind of cool thing to do.
Maybe we just found something new,
and maybe a copy paste will work out of my ‑‑‑ yes, it did.
All right, so let's search for this, and no one's actually seen it.
Okay. So the sample that you've analyzed is a newer version of software,
including new cipher suites that wasn't included in the
previous software while they still simultaneously did not
update their command and control servers.
Right, okay.
Which is kind of a pretty interesting thing. So I'm going to go
ahead and add a comment, a Trickbot Client 2019.
Okay. And there they go.
Now we've contributed to the community.
Awesome.
Great. So we're giving back already.
Yeah, exactly.
Yeah, cool.
So that's done. And then you and I,
we were kind of messing around earlier looking at the, so we're still
looking at this SSL log here, but we started looking at the certificate
itself. So this is now we're talking about certificate,
not JA3 hash,
right? So cipher suite is available versus the
certificate used for that exchange.
So when we looked at this and identified that same 449 port,
we also see the Internet Wdgets Pty thing,
which we've learned is self‑signed certificates.
Right. Right.
But there's also some other stuff here.
It was like they didn't really go to a ton of effort, right?
Even self‑signed certificates you can change some state to actually be a state.
Some state in the country. Here it's pointing to Australia, AU,
which I think is Australia.
I think so . I hope so. It's embarrassing if it's not. Yeah, that's why I
agree. But that doesn't necessarily mean that these IP addresses or the
certificates are actually on a server in Australia,
right?
Right.
You could just go in and set it to be whatever you want.
Absolutely.
That's the kind of indicators that I look at for more behavioral stuff
that doesn't change as often. And we can use this.
You can use Bro to look at‑‑‑you can capture pcaps at
different places in your network.
Yes, you need to capture it external to internal egress,
right? That's a good point to look because this stuff is facing out.
But you also want to look internal.
There's other things we talked about.
Like you said, it was using EternalBlue, EternalRomance,
EternalChampion, but that's more lateral spread stuff, right?
Correct.