Intelligence Driven Malware Analysis (IDMA) Malicious Profiling

Size: px

Start display at page:

Download "Intelligence Driven Malware Analysis (IDMA) Malicious Profiling"

Christiana Smith
6 years ago
Views:

1 Intelligence Driven Malware Analysis (IDMA) Malicius Prfiling 14 January 2015 Hmeland Natinal Cybersecurity and Cmmunicatins Integratin Center

2 whami Cyber Threat Analyst at Nrthrp Grumman Perfrmed wide range f duties frm malware analysis t cyber threat reprting Supprting US-CERT/NCCIC B.S. in Digital Frensic Science frm Defiance Cllege (Ohi) M.S. in Digital Frensic Science frm Champlain Cllege (Vermnt) Certificatins GIAC Certified Reverse Engineer f Malware (GREM) GIAC Certified Incident Handler (GCIH) GIAC Certified Frensic Analyst (GCFA) Hmeland Office f Cybersecurity and Cmmunicatins 2

3 3 Outline Intrductin & Purpse Fundatin & Origin IDMA Overview Critical Cmpnents Operatinal Use Case Cnclusins Hmeland Office f Cybersecurity and Cmmunicatins

4 Intrductin & Purpse Malware Analysis Integratin Reduce peratinal islatin Increase effectiveness f threat intelligence and incident respnse peratins Augment Existing Methdlgies Nt attempting t reinvent the wheel Utilize threat intelligence t drive analysis Hmeland Office f Cybersecurity and Cmmunicatins 4

5 Fundatin & Origin Diamnd Mdel f Intrusin Analysis (Caltagirne et al. 2013) Rbust and Scalable Designed fr incident respnse Adapted fr malware analysis Facilitate a Bridge Incident respnse Malware analysis Threat intelligence Hmeland Office f Cybersecurity and Cmmunicatins 5

6 Critical Cmpnents f IDMA Indicatr Classificatin Nvel cncept Prvides cntext fr analysis Indicatr Crrelatin Nvel cncept Facilitates actinable and relevant indicatrs Threat Intelligence Order f Vlatility (TI-OV) Nvel cncept Methdical rder f precedence Hmeland Office f Cybersecurity and Cmmunicatins 6

detectin methds Intrusin bjectives (if knwn) Vulnerability identifiers File system interactin (create, change,

7 Indicatr Classificatin & Crrelatin Hash values Single IP address Single dmain Surce and destinatin IP (net flw) Targeted prts and services Beacn addressed and lcatins Delivery methds File names File paths IDS signatures r ther detectin methds Intrusin bjectives (if knwn) Vulnerability identifiers File system interactin (create, change, delete) Registry interactins Tlchain analysis (packer, cmpiler) Impact and utcme Hmeland Office f Cybersecurity and Cmmunicatins 7

8 Threat Intelligence Order f Vlatility (TI-OV) Hmeland Office f Cybersecurity and Cmmunicatins 8

9 Prfiles f Analysis Fur Cre Prfiles (Analysis Methds) Static, Dynamic, Reversing, Adversary Segmented Analysis Reinfrce existing methdlgies Multiple cmpnents = ne prfile Mdular system f analysis Critical Questins f Malicius Prfiling Prvides fcus t cre prfiles Drives analysis twards intelligence criteria Hmeland Office f Cybersecurity and Cmmunicatins 9

Mdular analysis Prfiles can be individually r cllectively applied t the diamnd mdel

10 IDMA Prfiles The basic cncept f malicius prfiling leverages existing malware analysis techniques applied with critical thinking and intelligence analysis skills. Mdular analysis Prfiles can be individually r cllectively applied t the diamnd mdel t increase efficiency and fcus analysis. Hmeland Office f Cybersecurity and Cmmunicatins 10

11 IDMA Cncept Hmeland Office f Cybersecurity and Cmmunicatins 11

12 IDMA Prcess Flw Hmeland Office f Cybersecurity and Cmmunicatins 12

13 Use Case SATR Discvery IDMA Analysis Malware hashes beacning t gvernment hsts Intelligence -> malware analysis -> incident respnse Integratin f effrts IDMA prject was a derivative f this effrt Hmeland Office f Cybersecurity and Cmmunicatins 13

14 Hmeland Office f Cybersecurity and Cmmunicatins 14

15 Use Case: Malicius Prfile TI-OV Adversary Infrastructure Capabilities Victim Behaviral Anti-frensic techniques Sample signed with tw digital certificates Hst Based Public facing server URL Designed t run n Windws XP Netwrk Based Digital certificate dmains Malicius dmain hardcded Hsting IP address Ephemeral Cmpile time Sample hash Detectin Time (Zeltser, 2015) Hmeland Office f Cybersecurity and Cmmunicatins 15

16 Use Case: Crrelating Evidence Original Wrk Flw Samples discvered Net flw examined (limited scpe) Samples were sent t malware shp (little cntext prvided) Callback dmain Net flw cnclusins Ttal time invested ~10 days (prir t additinal respnse) IDMA Wrk Flw Samples discvered IDMA applied (cntext discvery) Samples can be sent t malware shp Indicatrs frm all 8 categries f the prfile supplied Additinal cntext can drive further analysis (malware, IRT) Hmeland Office f Cybersecurity and Cmmunicatins 16

17 Use Case: Crrelating Evidence Original Wrk Flw Samples discvered Net flw examined (limited scpe) Samples were sent t malware shp (little cntext prvided) Callback dmain Net flw cnclusins Ttal time invested ~10 days (prir t additinal respnse) IDMA Wrk Flw Samples discvered IDMA applied (cntext discvery) Samples can be sent t malware shp Indicatrs frm all 8 categries f the prfile supplied Additinal cntext can drive further analysis (malware, IRT) Hmeland Office f Cybersecurity and Cmmunicatins 17

18 Use Case Cnclusins Full Scale Reverse Engineering Time cnsuming, resurce intensive prcess Few individuals are fully qualified IDMA Analysis Tw prfiles used (Static, Reversing) Tls utilized OllyDbg PEStudi BinText Cntext driven analysis Ttal time invested ~3 hurs (additinal) Hmeland Office f Cybersecurity and Cmmunicatins 18

Diamnd Mdel Value f Time Sample analysis can feed all fur cmpnents Malware analysis des nt have t be cmpartmentalized & segregated Cntext and

19 Cnclusins Cntext Vlatility Shift field away frm single indicatrs Additinal cntext increases effectiveness f incident respnse and threat intelligence peratins Facilitates indicatr precedence Fcus analysis n less vlatile indicatrs Adds additinal cntext fr reprting Malware Analysis & Diamnd Mdel Value f Time Sample analysis can feed all fur cmpnents Malware analysis des nt have t be cmpartmentalized & segregated Cntext and behavir can be derived withut full scale reversing Can lead t increased effectiveness in incident respnse peratins Hmeland Office f Cybersecurity and Cmmunicatins 19

20 Questins? Hmeland Office f Cybersecurity and Cmmunicatins 20

IS315T IS Risk Management and Intrusion Detection [Onsite]

IS315T IS Risk Management and Intrusin Detectin [Onsite] Curse Descriptin: This curse addresses cncepts f risk management and intrusin detectin. Areas f instructin include hw t assess and manage risks