malware analysis system empowering le cybercrime investigation division, spo malware analysis system...
TRANSCRIPT
Malware Analysis System empowering LECybercrime Investigation Division, SPO
Malware Analysis System, THEMIS
The
Hacking
Evidence
Malware
Investigation
System
Background
Prevalence of Malware Crimes
Limited Expertise & Workforce
Loosing Connections
Goals
1 Automate & Normalize Analysis
2 Trace & Monitor Criminals
3 Comprehensive Management ofMalware Information
System Concept
• Correlation & Trace
• Analysis • Collection
Malware Life-Cycle based Operation
DataBase
1 Collection (internal input + external resources)
Mechanism
2 Analysis
STATIC
DY-NAMIC
PE Structure, Hash, Ssdeep, Strings, Decompiling, class/meth-ods info.. Provider, Receiver, Ser-
vice, Permission, SMS/CALL
File/Registry/Network/Process Event Monitoring
Network Re-source
IP, E-Mail, Name
Mechanism
3 Correlation & Trace
Malware Dis-tribution Site
Malware Down-load
DNS RecordIP Do-
main
MD5/SHA2
Compilier Informa-tion
Packing Info
File Creation Time
Digital Signature
IAT/EAT TimeDateS-tamp
EOP
File Size
PE Section
File Informa-tion
File Name
EntropyRe-source Section
C&C Server
Information Leakage Sites
File Access/Cre-ation/Edition/Delete
Registry Access/Cre-ation/Edition/Delete Network Comuni-
cation
Autorun
Name Server
Anti Virus
Antivirus Signature
Engine Version
Related Process/DLL
API
Registrant
CNAMEE-mail
Whois History
File Type File Ver-sion
PTRIP2Location
User
PE Header
Malicious Behavior
Mechanism
3 Correlation & Trace
Mechanism
3 Correlation & Trace
Mechanism
Results
1 Speed up Initial Investigation
See the Criminal Rings
Facilitate Collaboration
2
3
Case I
System Intrusion
to a major company
Analyze 41 malicious files, identify 10 C&C
servers
Monitor the C&Cs changing their IPs
Seize a C&C, identify additional victims
Case II
Cyber Threat
on a nuclear power
plant operator
Analyze more than 10,000 EML files
Detach 5,986 malicious files from the emails
Analyze the malicious files, clarify the function
1day
Malware Analysis System empowering LECybercrime Investigation Division, SPO