I did have one question.
You were looking at all that road traffic.
I was. When you were looking at the JA3 signatures,
I noticed that port 8082 wasn't in there.
Oh, yeah.
Does that mean that ‑‑‑ is it possible then that the 8082 traffic
was encrypted and Bro just didn't identify it, or is there a way
that we can go ahead and look at that? So when we looked at those
connections that did show up, but it didn't show up in the SSL connections,
so it likely just wasn't encrypted traffic.
So let's go check that out in Wireshark.
Okay, yeah. Just to make sure that we understand here,
let's look at some encrypted traffic.
Let's see that encrypted traffic.
The 449 traffic is what we're looking at right now. Yes, the 449
traffic. Okay. And follow that TCP stream. And there's internet
widgets, so we know we're looking in the right place,
right? Right.
So even though we're looking at some encrypted traffic, there's
still going to be some plain text in there.
That's probably the SSL certificate, right?
Correct.
Yeah,
and that's that TLS exchange and then like cipher suite
stuff. And this one is not very long,
It looks like the connection got reset is what it looks like to me.
But if we instead look at port 8082 just so we have the
difference, and let's see what we get from that.
I actually forget I did look at this ahead of time. There's multiple sessions.
Oh yeah, there's a lot with TrickBot .So this looks fun.
Let's take a look at this.
Awesome.
So that looks pretty similar to something you were
talking about earlier, doesn't it? Yeah,
definitely.
There a couple of things that are going on here. Looking at the
very top, this is obviously a web connection, an HTTP
connection, and we can tell that from the HTTP headers upfront.
We have to post the user agent, the host, and all that fun stuff.
But if you look at the URL it's being posted to, it's slash Leo seven.
That's actually the group or campaign ID of TrickBot,
and you can actually monitor that.
Leo7 will eventually turn to leo8 when their configuration changes.
Or you could go backwards in time to leo6 and see what it was at some
point. And probably somebody has done some analysis on that , so you
could google Trickbot and leo6 and see what it is. After that is the
client's ID, and you can see the beginning of that client ID is WIN
dash all these letters. That looks like your generated Windows device
network.
Yeah,
that is the the name of my Windows system followed by some other
data that it generates and then the slash, and then you'll see a
number after that. And the numbers mean various things to
TrickBot. A 90 is typically a post,
but not necessarily always. It's probably dependent
upon the plug‑in that's being used.
Yeah, that makes sense.
And something good to remember too about that is it's
people coding it at at nearly random, right?
They can make it whatever they want it to be. Right, oh, exactly. So
there's no specific standard that has to be followed.
Yeah, exactly.
The User‑Agent is also kind of interesting.
You usually don't see a User‑Agent of test.
Nope, that's odd. Yeah, that'd be a great indicator.
And you were talking about least frequency analysis.
We could use Bro or any other network monitor to look at all of our HTTP
traffic and just look at all of the different user agents and then kind of
sort them like you were doing and look at the ones that are not like the
others or are not on there very often.
Maybe we'll do that after we take a look at the rest of this.
Okay. And then here we've got the post form‑data name is proclist,
and right underneath that, these are all the processes that were
running at the time that the malware ran.
And remember too, this isn't just keeping this information.
It's sending it back to the attacker. Right, yeah.
So the attacker has this information outbound,
and we have got system information,
lots of information about the system that it compromised, all the
IP address information, as we're seeing there.
If we scroll down more, we'll even start seeing some
things related to the domains.
All that information would have been sent out to the attacker.
Yeah. So you can imagine how valuable that is to an attacker to know that, hey,
they're on this domain called Really Popular Bank, so now they
know that they've compromised some bank as opposed to just some
guy like me sitting in his home lab.
Yeah, absolutely.
And this can probably help with when they're making the transition from hey,
is something, one of our automated TrickBot agents has found
something interesting, so now let's engage.
Oh yeah, absolutely.
I mean,
you can imagine the excitement the attacker would see if you the domain was
something like Microsoft or Google or something like that.
To compromise something like that as opposed to Joe's
Fish Shack or something like that.
You don't know Joe's Fish Shack.
I also thought this was interesting.
The Cowboy served.
Yeah, the server response, the server named Cowboy.
That is kind of interesting.
Again,
it's another indicator that you can look at. You can do the frequency
analysis. And maybe that is a common one, but I kind of doubt it.
Yeah,
I doubt it too, Here, let's, before we get out of this, now I'm
curious to see about that user agent. So let's see if ‑‑‑ hopefully
we have some good information on that, right?
So what I normally do, because I never ever remember the column headers,
is I usually rip through that into more, and then I can figure out
what I want to bro‑cut into. Okay. Then from here,
we'll look at ‑‑‑ where's the user agent? Do you see it? There it is.
Yep, user_agent. Yes. Why don't we say it's easy.
Cool. And let's sort. It doesn't have to be numeric, so it's fine.
Let's try that. Gets just one test. So that would definitely be
something that I'd want to look at. And remember,
we're only, at this point,
this was what? Like maybe 20 minutes of network capture all for one system.
If we were looking across an entire network,
we would definitely see a ton of different user agents and one called test.
Regardless,
should kind of pop out because even if you weren't familiar with user agents,
look at the way that the others are formatted. That's exactly
what I was going to say, is kind of a junior security analyst
looking at ‑‑‑ there's tons of stuff that does this. There's like
RockNSM and Security Onion, whatever that puts this in a nice,
pretty format, and Elasticsearch, right?
And you can just be like oh, let me just scroll through user agents.
That's weird.