How To Scan Network Traffic With Brim For Malicious Activity.
Malware analysis is a difficult and complex task. For this, it is essential to have various tools that allow processing and interpreting large volumes of data to simplify the analysis work. Fortunately, when it comes to analyzing network traffic for malicious activity, there are very good tools available, such as Wireshark or NetworkMiner , which are well known and for which there is a lot of documentation available. However, this time we want to introduce Brim, a powerful free tool for network traffic analysis that was launched in mid-2018 and is still not so popular.
Brim: a tool to analyze network traffic
Brim is an open source tool designed for network security specialists that facilitates the search and analysis of data through the following sources:
- Network traffic traps created by Wireshark or TCPdump
- Structured records, such as those from the Zeek framework
This is particularly useful for those who need to process large volumes of network traffic, especially those that are cumbersome to analyze with Wireshark , tshark, or other packet data analyzers.
Among the most outstanding features of this tool we can mention that it has multiplatform support (the application is compatible with Windows, macOS and GNU / Linux systems), and that it is developed and integrated with other open source tools such as Zed , Zeek , Suricata and the draft rules for IDS / IPS known as Emerging Threats .
Analyzing the network activity of the Vidar Trojan with Brim
For practical purposes, we analyzed a network trace captured while the Vidar malware was running on a compromised computer.
Note: It is important to remember that when analyzing a traffic capture in which there is evidence or suspicion of the presence of malware, we must use an isolated and dedicated system for this purpose (in this case, a virtual machine on Linux is recommended, since malware in question affects Windows systems). Incorrect manipulation of the network capture and the files contained in it can lead to the compromise of our own team.
General characteristics of the malware to be analyzed
The Vidar Trojan is an improved version of the Arkei malware and is mainly focused on stealing information from compromised hosts, browser credentials, browsing history, session cookies, taking screenshots of victim user activity, and theft. of data used by 2FA solutions and cryptocurrencywallets, among others. Once this information is collected, the malware sends it to the C2 server controlled by the attackers.
Its method of spread or initial vector is mostly through malspam campaigns that contain malicious attachments and URLs, or through trojanizedkeygens that contain the malware.
Step 1: Opening the network traffic capture using Brim
Step 2: Using Brim’s default queries
Although the tool has a complete query syntax language , one of the most valued functionalities in Brim is the queries that are configured by default in the GUI. Using these queries is an excellent starting point when you begin to investigate captured network traffic.
Among the many queries available, some of the most prominent are:
- Suricata Alerts (IDS), by categories
- Suricata Alerts (IDS), by origin and destination
- Summary of activities
- Unique DNS queries
- HTTP queries
- File Activities
Step 3: Discovering malicious activity with Brim
If we select the Suricata query category and locate the so-called “Suricata alerts by category”, we verify that it is possible to quickly find indicators of malware activity and analyze the logs in search of more details.
It was easy, right? 😉
Step 4: Discovering the information exfiltrated by the malware
Then, if we select the query “File activity”, we can recognize that there is a file called “b9a69c67-9046-4571-a9af-0f60a1fcee8d8375730518.zip”
Taking into account the characteristics of this malware, we see that it is a compressed file with the computer’s information, which was exfiltrated by Vidar. To find out, we rely on another network traffic analysis tool such as NetworkMiner.
Indicators of Compromise of the Sample Executed in the Net Capture
| Filename | a2ef57bbe3a8af95196a419a7962bfaa.exe |
| Sha1 | Sha1 Detection |
| 1a0c42723cd1e2e947f904619de7fcea5ca4a183 | A Variant Of Win32 / Kryptik.HMZJ |
Downloaded binaries
| Sha256 | File path |
| a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba | File path: C: \ Users \ admin \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files \ Content.IE5 \ B6QGX7LP \ freebl3 [1] .dll |
| 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd | C: \ Users \ admin \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files \ Content.IE5 \ 6Z2BCOUL \ mozglue [1] .dll |
| 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4 | C: \ Users \ admin \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files \ Content.IE5 \ PO2HN1X2 \ msvcp140 [1] .dll |
| e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78 | C: \ Users \ admin \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files \ Content.IE5 \ 78RFYB7Z \ nss3 [1] .dll |
| 43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083 | C: \ Users \ admin \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files \ Content.IE5 \ B6QGX7LP \ softokn3 [1] .dll |
| c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d | C: \ Users \ admin \ AppData \ Local \ Microsoft \ Windows \ Temporary Internet Files \ Content.IE5 \ 6Z2BCOUL \ vcruntime140 [1] .dll |
DNS queries
- r3.o.lencr.org
- more.to
IP connections
- 45,105,185
- 248,139,254
- 32,238,178
- 99.75.82
- 108.80.190
HTTP / HTTPS requests
- http: 65.108.80 [.] 190/517
- http://65.108.80.190/freebl3[.íritudll
- http://65.108.80.190/mozglue[.íritudll
- http://65.108.80.190/msvcp140[.íritudll
- http://65.108.80.190/softokn3[.íritudll
- http://65.108.80.190/nss3[.íritudll
- http: //r3.o.lencr [.] org / MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg% 2ByvTLU% 2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5hF7dYVsuuUAlA5h% 2Bvh7YsUdows 3DCE% 2Bvh7YsW7WG% 2Bvh7YsW7
- http://65.108.80.190/vcruntime140[.íritudll
- http: //65.108.80 [.] 190 /
