Last updated
Last updated
In this exercise we will infect a windows client with a simple malware sample and investigate it with velocirpator. This time we will search for a BOT communication and also have to analyse a network dump with wireshark
Prerequisite:
Password malware
Mitre Attack techniques used in this exercise:
T1574.001: Hijack Execution Flow: DLL Search Order Hijacking
T1053.005: Scheduled Task/Job: Scheduled Task
T1562.001: Impair Defenses: Disable or Modify Tools
First made sure that the windows box is connected to the velociraptor server:
First we want to capture some network traffic. For that we use the following artifact:
Windows.Network.PacketCapture
First let's run the artifact with default settings.
From the result tab copy the path of the etl file and run the artifact again.
This time we need to configure the collector:
Uncheck StartTrace.
Paste in the path to your TraceFile
Now it took some time before we can download the pcapng file from the uploaded files tab.
Let's open the network capute file with wireshark:
Linux VM ()
Windows 10 VM ()
Malware sample ()
If you need instructions how to setup velociraptor please go back to of this series.
developed by SAM BOWNE:
1. Download this file: 2. Right-click security.zip. Click "Extract All...". Click Extract. Use the password "malware". 3. Run Bginfo64.exe as administrator. When it asks questions, just close it.
