takahiroharuyama.github.io

Blog Archive - CCI

http://takahiroharuyama.github.io/blog/archives

Presentation at SECURE 2015. Remote Malware Triage Automation. DFRWS EU Slide Deck and Generic IOCs. OpenIOC Parameters used by openioc scan. Fast Malware Triage using openioc scan Volatility Plugin. Memory Forensics: still aborted. ID/IDAPython scripts extracting PlugX configs. PlugX Builder/Controller (Type III, 0x840). 64bit big sized RAM Image Acquisition Problem. Presentation at SECURE 2015. Remote Malware Triage Automation. DFRWS EU Slide Deck and Generic IOCs. Tweets by @cci forensics.

ID/IDAPython scripts extracting PlugX configs - CCI

http://takahiroharuyama.github.io/blog/2014/03/27/id-slash-idapython-scripts-extracting-plugx-configs

ID/IDAPython Scripts Extracting PlugX Configs. I release Immunity Debugger and IDAPython scirpts dumping PlugX configs (and original PEs) then parsing them. IIJ-SECT (CSIRT team at IIJ, Inc.) classifies PlugX samples into 3 types: type I/II/III. In more detail, check our presentation. The Immunity Debugger script can be used for PlugX type I&II. The IDAPython script can parse type III configs. Distinction between Type I&II and III. ID Script for Type I&II. IDAPython Script for Type III. After the configu...

Remote Malware Triage Automation - CCI

http://takahiroharuyama.github.io/blog/2015/07/03/remote-malware-triage-automation

Remote Malware Triage Automation. I published the script automating remote malware triage with F-Response and openioc scan. F-Response provides read-only access to the full physical disk(s) of any networked computer. Additionally the physical memory (RAM) of most Microsoft Windows systems can be mounted. We can automate RAM acquisition from remote machine and IOC scan using F-Response COM API. I show the flow of the script. Let me know if any problem, request and bug. Presentation at SECURE 2015 ».

Fast Malware Triage using openioc_scan Volatility Plugin - CCI

http://takahiroharuyama.github.io/blog/2014/08/15/fast-malware-triage-using-openioc-scan-volatility-plugin

Fast Malware Triage Using Openioc scan Volatility Plugin. Last year, I proposed “volatile Indicators of Compromise (IOCs)” based on RAM evidence only at SANS DFIR Summit. We can detect malware using them faster than using disk-evidence-based IOCs. Besides, we can define indicators based on not only metadata (e.g., file path) but also malware function (e.g., code injection sign, imported functions and unpacked codes). The IOCs are described according to OpenIOC. Specification. IOC Editor. Openioc scan has...

Memory Forensics: still aborted - CCI

http://takahiroharuyama.github.io/blog/2014/04/21/memory-forensics-still-aborted

Memory Forensics: Still Aborted. 2 years ago, I talked about the anti memory forensic method by modifying Windows kernel data structure on victim systems at BlackHat Europe 2012. The situation is still the same. Abort Factors and PoC Driver. In the past presentation, I showed “Abort Factors”, they are key structures for virtual address translation, guessing OS version and listing kernel objects. Once they are modified, memory analysis tools cannot continue to analyze images. On the other hand, Redline (M...