Security Vision
Wireshark, Zeek, Suricata are traditionally used in network incident investigation. The first one provides the most powerful filter language, support for a huge number of protocols and the ability to analyse every header of a network packet. The disadvantages are low performance and lack of ability to display network session metadata.
Zeek has a powerful DPI, the ability to analyse Windows protocols (SMB, DCE RPC, NTLM, Kerberos), provides extensive session metadata, and supports detection of complex network attacks through its own scripting language. The downside is the lack of a user-friendly graphical interface.
Suricata perfectly copes with the task of signature-based attack detection and has high performance, but in terms of DPI, network protocol parsing and detection of complex attacks it is noticeably inferior to Zeek.
Thus, each of the mentioned tools has its own advantages and disadvantages, so it would be reasonable to use them in combination from a single interface. Such an opportunity is provided by ZUI (Brim) traffic analyser, which will be discussed in this article.
ZUI has Zeek and Suricata engines under the bonnet and unlike Wireshark it has high performance because it works on the level of network sessions instead of individual data packets. The performance is also ensured by its own data model, designed for high speed data processing.
Let's take a look at the ZUI capabilities on the example of the Formbook malware sample traffic
https://www.malware-traffic-analysis.net/2023/07/11/index.html
The first thing worth noting is the convenience and speed of executing aggregate queries and collecting statistical information, which are important for primary traffic analysis. The developer has prepared TOP of the most frequent and useful queries in the form of a json file, which can be easily imported in the ZUI interface using the drug and drop method.
Primary sample analysis
Let's highlight some of them and consider them further on the example of traffic with a malicious sample.
1) _path==‘dns’ | count() by query | sort -r
Outputs a list of unique DNS queries in descending order of the number of queries.
In the screenshot above we can see the list of domains that were detected in the traffic - as we will see later, most of them are malicious and related to C&C activity.
2) Next, let's display the statistics of bytes transmitted and received by IP addresses.
_path==‘conn’ | put total_bytes := orig_bytes + resp_bytes | sort -r total_bytes | cut id, orig_bytes, resp_bytes, total_bytes
From these statistics we can see that the only IP address used was 10.7.11.101 from internal addresses. The most data was received from the external IP
104.21.18.206.
3) Filtering the output by this IP address, we see that the domain kyliansuperm92139124.shop is parked on it.
Having accessed Virustotal from the context menu, we conclude that this domain is malicious and probably belongs to the Formbook virus family.
In-depth analysis
Next, let us analyse the facts of detecting files in the traffic by executing the query file| cut _path, tx_hosts, rx_hosts, mime_type, filename, md5 | not http | fuse.
The passing of an exe file (md5 hash c0e88be9b83acf26d8269f07fe927f5c) against the background of numerous plain-text, html files and x509 certificates catches our eye.
From the context menu we call virustotal to analyse this exe and make sure that it is a formbook trojan.
This way we have confirmed that the Trojan has been downloaded. Now we need to understand what caused it. Let's analyse the two files that preceded the trojan download. Once again, we call virustotal and see that the first one (md5 hash de36330f5ecc55cc90226af3db4a8992) is the CVE-2017-11882 exploit in RTF format. This is a critical RCE vulnerability in Microsoft Office that to this day is actively exploited ‘in the wild’ in phishing attacks.
Exploitation of this vulnerability leads to the loading of an OLE object in the form of a malicious hta file with powershell content, as we can see by analysing the following file (md5 hash d78521f4011c505c5d57d1ef39221969).
By running the query md5=="d78521f4011c505c5d57d1ef39221969 ’ and clicking on the package download icon, we can fall through to Wireshark, opening the corresponding pcap c the contents of the hta file, which is another handy feature of the ZUI.
We can see that inside the contents of the hta file is encoded powershell code, which, according to the Virustotal report and Suricata alerts, is the first-stage downloader of the Formbook trojan (win.exe file).
Building the attack timeline
To make it clearer, we can filter the output by HTTP traffic with the http | method!=null | fuse request, which confirms our conclusions about the victim's compromise chain: launching the CVE-2017-11882 exploit -> downloading the malicious hta payload with powershell code -> downloading the first stage of the Formbook trojan as an exe file.
Next, we observe numerous requests to C&C domains with the distinctive pattern /qm18 in the request URL.
The above HTTP list allows us to build us a timeline of the attack:
1. 2023-07-11T16:24:54 Running an rtf file with the CVE-2017-11882 exploit
2. 2023-07-11T16:24:56 Uploading a malicious hta peylode IE_NET.hta with powershell code
3. 2023-07-11T16:31:53 Downloading and launching the first stage of the Formbook trojan in the form of the win.exe file
4. 2023-07-11T16:32:09 Downloading and launching the body of the Formbook trojan from the malicious domain kyliansuperm92139124.shop
5. 2023-07-11T16:35:19 - 2023-07-11T16:58:58 Multiple C&C taps to malicious Formbook domains
Suricata Analytics
Let's also demonstrate the huge benefit of integrating this tool with the Suricata IDS. By running a query that displays a list of Suricata alerts grouped by number, we again find confirmation of our earlier conclusions regarding the Formbook Trojan infection pattern, which can be clearly seen in the IDS alerts list.
Conclusion
Due to the high performance achieved by working with network session metadata instead of individual packets, ZUI has proven to be an effective network forensics tool that can cover many of Wireshark's blind spots. First of all, this is achieved by integration with Zeek, which has a very powerful DPI, as well as by linking with analytical services (Virustotal, whois). A nice bonus is integration with Suricata, which allows you to detect attacks and anomalies from a single interface.
