incidents

incident summary

credential theft from corporate laptop via lsass memory dump. attacker gained initial access via phishing email with weaponized excel document. lateral movement observed over 5 days before detection.

forensic timeline

• 2025-04-10 09:23 - malicious excel document opened (user interaction)
• 2025-04-10 09:24 - powershell process spawned from excel
• 2025-04-10 09:25 - cobalt strike beacon established
• 2025-04-10 14:12 - lsass.exe accessed by suspicious process
• 2025-04-10 14:13 - memory dump created in temp folder
• 2025-04-11 02:00 - credentials exfiltrated (23mb upload)
• 2025-04-12 to 2025-04-14 - lateral movement across 3 hosts
• 2025-04-15 11:45 - edr alert triggered, investigation began

artifacts recovered

• - memory dump file: 20250410_1413_lsass.dmp (768mb)
• - prefetch files showing malicious process execution
• - registry run keys modified for persistence
• - amcache showing application execution history
• - mft entries showing file creation/deletion patterns

key findings

• - 44 unique credentials extracted from lsass
• - credential theft targeted service accounts, not users
• - attacker used mimikatz with custom obfuscation
• - no disk encryption detected on stolen credentials

remediation actions

• - all 44 service accounts credentials rotated
• - affected hosts reimaged and hardened
• - edr policies updated to block lsass access patterns
• - user training on phishing awareness conducted

incident summary

rust-based ransomware with custom encryption and anti-debugging features. analysis reveals c2 infrastructure and detection signatures.

malware characteristics

• - rust-based encryptor with custom cha20 implementation
• - double-extortion: encrypts data and exfiltrates before notification
• - uses windows api for process hollowing injection
• - encrypted c2 over https with custom protocol
• - anti-debugging: checks for debugger presence via ntqueryinformationprocess

encryption workflow

• 1. enumerate network shares via netshareenum
• 2. generate 256-bit key per victim (ecdh on victim id)
• 3. encrypt files with custom cha20-chacha variant
• 4. create ransom note with payment instructions
• 5. send victim id + encryption proof to c2

c2 infrastructure

• primary c2: 185.xxx.xxx.44 (domain parked, now offline)
• backup c2: onion service active (tracked)
• traffic pattern: keep-alive every 30 seconds, encrypted payload

detection signatures

• yara rule: win_ransom_rust_variant
• strings:
• $rust_string = "core::str::slice_error_fail"
• $custom_encrypt = {e8 3c 4a 7b 9f 21 d4}
• $c2_pattern = /https?:\\\\//\\\\[a-z0-9]{32}\\\\.onion/
• condition: 2 of them

incident summary

heap-based buffer overflow in png_handle_iTXt() function when processing malformed iTXt chunks. attacker-controlled data can overwrite adjacent heap metadata, leading to arbitrary code execution when png_free() is called.

technical details

• offset calculation error at line 2347:
• text_len = png_get_uint_16(buf);
• lang_len = png_get_uint_16(buf + 2);
• key_len = png_get_uint_16(buf + 4);
• // unchecked allocation
• text = png_malloc(png_ptr, text_len); // vulnerable
• // bounds check fails when lang_len + key_len > text_len

exploitation requirements

• - target must process attacker-supplied png file
• - heap grooming required for reliable control
• - aslr and heap mitigations present on modern systems
• - confirmed exploitable on ubuntu 22.04, fedora 38

mitigation

upgrade to libpng 1.6.41 or later. apply patch from upstream commit 8a3d2c1. validate all png inputs through sanitization proxy before processing.