We are swamped with new types of malware every day. The goal of malware analysis is not to reveal every single detail of the malware. It is more important to develop tools for efficiency or introduce automation to avoid repeating the same analysis process. Therefore, malware analysts usually actively develop tools and build analysis systems. On the other hand, it costs a lot for such tool developments and system maintenance. Incident trends change daily, and malware keeps evolving. However, it is not easy to keep up with new threats. Malware analysts spend a long time maintaining their analysis systems, and it results in reducing their time for necessary analysis of new types of malware. To solve these problems, we incorporate DevOps practices into malware analysis to reduce the cost of system maintenance by using CI/CD and Serverless. This presentation shares our experience on how CI/CD, Serverless, and other cloud technologies can be used to streamline malware analysis. Specifically, the following case studies are discussed. * Malware C2 Monitoring * Malware Hunting using Cloud * YARA CI/CD system * Malware Analysis System on Cloud * Memory Forensic on Cloud Through the above case studies, we will share the benefits and tips of using the cloud and show how to build a similar system using Infrastructure as Code (IaC). The audience will learn how to improve the efficiency of malware analysis and build a malware analysis system using Cloud infrastructure.

1. © 2022 JPCERT/CC
0
Fight Against Malware
Development Life Cycle
CODE BLUE 2022

2. © 2022 JPCERT/CC
1
Problem of Incident Response
Attacker vs Defender

3. © 2022 JPCERT/CC
2
Problem of Incident Response
Attacker vs Defender
We are in the Malware Development Life Cycle…

4. © 2022 JPCERT/CC
Surface Analysis
Runtime Analysis
Static Analysis
Create YARA Rule
Finished analysis …
3
Malware Analysis Operations (MAOps)

5. © 2022 JPCERT/CC
Surface Analysis
Runtime Analysis
Static Analysis
Create YARA Rule
Automation！
4
All roads lead to AUTOMATION!

6. © 2022 JPCERT/CC
5
Problem of MAOps
Attacker vs Malware Analyst

7. © 2022 JPCERT/CC
6
Problem of MAOps
Attacker vs Malware Analyst
Changed C2 server
Changed encrypt key
Added new function

8. © 2022 JPCERT/CC
7
Problem of MAOps
Attacker vs Malware Analyst
STOP

9. © 2022 JPCERT/CC
Maintenance of malware analysis tools is
hard work.
Creating a lot of malware analysis
tools requires the maintenance of
many tools.
8
Problem of MAOps
Need the methods to counter the attacker's
development lifecycle

10. © 2022 JPCERT/CC
9
Goal of This Presentation
This presentation shares
methods for building
analytical tools to counter
the attacker's lifecycle.

11. © 2022 JPCERT/CC
Approach
Technologies such as CI/CD and serverless are methods
that make system maintenance and release more efficient.
Cloud services can be a solution to the problems of
malware analysts.
We managed the Malware Analysis System on Cloud.
10
Use cloud services CI/CD, serverless, and
Infrastructure as Code (IaC) to fight the malware
development life cycle.

12. © 2022 JPCERT/CC
IP addresses can be changed dynamically
Easy to update analysis tools
Easy to build scale-out systems
No server provisioning or maintenance required
Low maintenance costs
11
Advantages of Using the Cloud for Malware Analysis

13. © 2022 JPCERT/CC
12
Malware Analysis System on Cloud
Scanner
Memory
Forensic
Surface
Analysis
Sandbox
YARA
Log
Analysis
Thread
Research

14. © 2022 JPCERT/CC
Presentation Topics
13
1 Malware C2 Monitoring
2 Malware Hunting using Cloud
3 YARA CI/CD system
4 Surface Analysis System on Cloud
5 Memory Forensic on Cloud

15. © 2022 JPCERT/CC
14
1 Malware C2 Monitoring
2 Malware Hunting using Cloud
3 YARA CI/CD system
4 Surface Analysis System on Cloud
5 Memory Forensic on Cloud

16. © 2022 JPCERT/CC
Blocked access to the C2 server.
Targeted by an attacker.
Cloud services solve these problems.
15
Malware C2 Monitoring
Monitoring the attacker's C2 server is important to
understand their activity.
Notes

17. © 2022 JPCERT/CC
16
Case1: Monitoring the Lucky Visitor Scam C2

18. © 2022 JPCERT/CC
17
Lucky Visitor Scam Infrastructure
C2 Server
Compromised Server
Scam Server
Website access
#1 Send client information
#2
Reply scam
server URL
#3
Send scam
server URL
#4
Access scam website
#5

19. © 2022 JPCERT/CC
18
PHP Backdoor Installed in Compromised Server
C2 Server

20. © 2022 JPCERT/CC
$ curl -i -X POST http[:]//144.76.47[.]168/app/assets/api2?action=redir -d
"ip=153.213.10.51&qs=dfaljfadfa.com%2Findex.php%3Ffc858f%3DiPhone-Apple-Windows&ua=Mozilla%2F5.0
(...) &conn=close&uid=fb06bc98-576a-d5df-2195-a4b0a64bec44" -H "User-Agent: " -H "Accept: "
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Tue, 23 Feb 2021 23:46:35 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 590
Connection: keep-alive
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
a:2:{s:4:"type";s:5:"redir";s:4:"data";a:1:{s:4:"code";s:524:"<html>
<head>
<META http-equiv="refresh" content="1;URL=https[:]//finishsandperson-
9[.]life/?utm_campaign=pEv9cTd8QNHYzqqr5UNFx2COHvnp_JE3r8uVIhm3Qww1&t=main7d">
<script>
window.location = "https[:]//finishsandperson-
9[.]life/?utm_campaign=pEv9cTd8QNHYzqqr5UNFx2COHvnp_JE3r8uVIhm3Qww1&t=main7d";
</script>
</head>
<body>
To the new location please <a href="https[:]//finishsandperson-
9[.]life/?utm_campaign=pEv9cTd8QNHYzqqr5UNFx2COHvnp_JE3r8uVIhm3Qww1&t=main7d"><b>click here.</b></a>
</body>
</html>";}}
19
Request to C2 for Redirect URL

21. © 2022 JPCERT/CC
Check
 Displays the number of files stored on
the server
templates
• Creates a .html file for templates
keywords
• Creates a .lst file for keywords
update_sitemap
• Updates sitemap.xml
20
PHP Backdoor Installed in Compromised Server
pages
 Creates a new page
ping
 Sends a sitemap.xml URL to google and
bing
robots
 Creates robots.txt
eval
 Runs PHP code
PHP Backdoor Features

22. © 2022 JPCERT/CC
IP Address Status
144.76.47.168 〇
144.76.51.144 ×
178.63.30.186 〇
178.63.30.30 〇
178.63.34.6 ×
5.9.146.0 ー
5.9.235.245 〇
5.9.239.221 ×
5.9.34.13 〇
5.9.37.245 ×
94.130.71.28 ×
21
Lucky Visitor Scam C2
Attackers use different C2 servers over time.

23. © 2022 JPCERT/CC
Get PHP content form VT
Check C2
Get redirect URL form C2
Report to Google safe browsing
Blocked by web browser
22
Flow of Lucky Visitor Scam Countermeasures
Automatically execute the below process, from discovering
C2 servers to blocking redirects in web browsers.

24. © 2022 JPCERT/CC
23
Monitoring the Lucky Visitor Scam C2 System (AWS)
C2
AWS Lambda
Amazon EventBridge
GitHub Actions Private
Public
AWS GitHub
Git push
Git push
Event
Get HTML content
Amazon S3
output bucket
Put IoC Get IoC
Git checkout
Google Safe Browsing
Report
VirusTotal

25. © 2022 JPCERT/CC
24
Monitoring the Lucky Visitor Scam C2 System
https://github.com/JPCERTCC/Lucky-Visitor-Scam-IoC

26. © 2022 JPCERT/CC
25
Monitoring the Lucky Visitor Scam C2 System (GCP)
C2
Cloud Functions
Cloud Scheduler
GitHub Actions Private
Public
GitHub
Git push
Git push
Event
Get HTML content
Cloud Storage
Put IoC Get IoC
Git checkout
Google Safe Browsing
Report

27. © 2022 JPCERT/CC
26
Access Control for C2 Server
C2
C2 server is inaccessible from Japan.

28. © 2022 JPCERT/CC
27
C2 Activity
0
50
100
150
200
250
300
350
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
(Count)
(Time UTC+9)
Investigation of the attacker’s redirect URL delivery cycle.

29. © 2022 JPCERT/CC
28
1 Malware C2 Monitoring
2 Malware Hunting using Cloud
3 YARA CI/CD system
4 Surface Analysis System on Cloud
5 Memory Forensic on Cloud

30. © 2022 JPCERT/CC
Get IoCs
Download malware
Analyze malware
Hunt and detect incident
29
Malware Hunting using Cloud
Malware hunting gets unknown IoCs and can be used for
incident detection.

31. © 2022 JPCERT/CC
Get IoCs
Download malware
Analyze malware
Hunt and detect incident
30
Malware Hunting using Cloud
Malware hunting gets unknown IoCs and can be used for
incident detection.

32. © 2022 JPCERT/CC
31
Case2: Cobalt Strike Beacon Hunting
Cobalt Strike is a popular penetration tool among attackers.
[1]
Cobalt Strike's C2s are found in large numbers and cannot all be analyzed manually.

33. © 2022 JPCERT/CC
Get C2 server form VT
Download Cobalt Strike beacon
Analysis Cobalt Strike beacon
Publish configuration
32
Flow of Cobalt Strike Beacon Hunting
Automatically execute from discovering C2 servers to
hunting Cobalt Strike beacon.

34. © 2022 JPCERT/CC
33
C2 Server Data
https://www.virustotal.com/api/v3/intelligence/search?query=entity%3Aip%20c
omment%3A%23cobaltstrike&limit=300&descriptors_only=true
VT API
Extract a list of IP addresses of Cobalt Strike's servers from
VirusTotal.

35. © 2022 JPCERT/CC
32bit
/aaa9
/aab8
64bit
/aab9
/aac8
34
Default URL Path for Cobalt Strike Beacon
Many C2 servers do not change the default URL path.
Default URL path for Cobalt Strike beacon

36. © 2022 JPCERT/CC
35
Configuration Data
Encode
configuration data
in Cobalt Strike
beacon
XOR 0x2E

37. © 2022 JPCERT/CC
set Description Remarks
0x01 BeaconType
0=HTTP, 1=Hybrid HTTP and
DNS, 8=HTTPS
0x02 Port number
0x03 Polling time
0x04 Unknown
0x05 Jitter
Ratio of jitter in polling time (0-
99%)
0x06 Maxdns
Maximum length of host name
when using DNS (0-255)
0x07 Unknown
0x08 Destination host
0x09 User agent
0x0a
Path when communicating
HTTP_Header2
0x0b Unknown
0x0c HTTP_Header1
0x0d HTTP_Header2
0x0e Injection process
0x0f Pipe name
0x10 Year
Stops operating after the
specified date by Year, Month,
Day
36
Configuration Index
set Description Remarks
0x11 Month
0x12 Day
0x13 DNS_idle
0x14 DNS_Sleep
0x1a HTTP_Method1
0x1b HTTP_Method2
0x1c Unknown
0x1d
Process to inject arbitrary
shellcode (32bit)
0x1e
Process to inject arbitrary
shellcode (64bit)
0x1f Unknown
0x20 Proxy server name
0x21 Proxy user name
0x22 Proxy password
0x23 AccessType
1 = Do not use proxy server
2 = Use IE configuration in the
registry
4 = Connect via proxy server
0x24 create_remote_thread
Flag whether to allow creating
threads in other processes
0x25 Not in use

38. © 2022 JPCERT/CC
37
Cobalt Strike Beacon Hunting System
Cobalt Strike C2
Lambda
EventBridge GitHub Actions Private
Public
AWS Cloud GitHub
Git push
Git push
Event
Get beacon
S3 output bucket
Put Config Get Config
Git checkout
Put Config
VirusTotal
Get server list
API Gateway
WAF
Run
REST API
Client

39. © 2022 JPCERT/CC
38
Published Configuration Repository
https://github.com/JPCERTCC/CobaltStrike-Config

40. © 2022 JPCERT/CC
39
Cobalt Strike Beacon Hunting System
Cobalt Strike C2
Lambda
EventBridge GitHub Actions Private
Public
AWS Cloud GitHub
Git push
Git push
Event
Get beacon
S3 output bucket
Put Config Get Config
Git checkout
Put Config
VirusTotal
Get server list
API Gateway
WAF
Run
REST API
Client

41. © 2022 JPCERT/CC
40
REST API
https://[mask]/cs-scan-api?scan=http://185.38.142.75:80/aaa9
You do not need to download Cobalt Strike Beacon to analyze.

42. © 2022 JPCERT/CC
41
Changes in Cobalt Strike C2 (Daily)
0
20
40
60
80
100
120
140
160
180
200
2/17/2022 3/17/2022 4/17/2022 5/17/2022 6/17/2022 7/17/2022 8/17/2022
(Count)
(Date)

43. © 2022 JPCERT/CC
42
1 Malware C2 Monitoring
2 Malware Hunting using Cloud
3 YARA CI/CD system
4 Surface Analysis System on Cloud
5 Memory Forensic on Cloud

44. © 2022 JPCERT/CC
Since creating YARA rules cannot be automated, malware
analysts create them manually, and they spend too much time
on it.
Some characteristic malware can be created automatically.
43
YARA CI/CD System
Creation of YARA rules must be done manually by the
malware analyst, and automation of YARA rule creation is a
challenge.

45. © 2022 JPCERT/CC
44
Case3: HUI Loader Analysis System
Legitimate HUI Loader Encoded Malware
DLL Data
HUI Loader used in APT10, Blue Termite,
A41APT and DEV-0401.
for i in range(len(enc_data)):
data = ord(enc_data[i]) ^ 0x20 ^ ord(key[i % len(key)])
dec_data.append(data)
Decode code

46. © 2022 JPCERT/CC
2015
2016
2017
2018
2019
2020
2021
2022
45
Overview of HUI Loader Timeline
2015 Jan
APT10 started using HUI loader
2015 Apr
Blue Termite started using HUI loader
2020 Jun
A41APT started using HUI loader
2021 Aug
DEV-0401 started using HUI loader
2016 Jul
 Password randomized
 DLL injection
2021 Dec
 Security features bypassed
 "HUI…" strings deleted

47. © 2022 JPCERT/CC
46
Common Problems with Loader
Legitimate HUI Loader Encoded Malware
DLL Data
Even if the Loader is found, the function of the malware is
unknown because the encoded malware cannot be found.
Found it!
Not found!

48. © 2022 JPCERT/CC
Get HUI Loader form VT
Analysis HUI Loader
Create YARA rule
Push YARA rule to VT
47
Flow of HUI Loader Analysis System
Automatically execute from getting HUI Loader to creating
the YARA rule.

49. © 2022 JPCERT/CC
48
HUI Loader Analysis System
Lambda
EventBridge Github Action Private
Public
AWS Cloud Github
Git push
Git push
Event
S3 output bucket
Put Config Get Result
Git checkout
Put Config
VirusTotal
Get HUI Loader
API Gateway
WAF
Run
REST API
Client
Push YARA rule

50. © 2022 JPCERT/CC
49
Created YARA rule
rule malware_HUILoader_data_2317d3e14a {
meta:
description = "HUI Loader loading data"
author = "JPCERT/CC Incident Response Group"
HUI_loader_hash = "2317d3e14ab214f06ae38a729524646971e21b…"
condition:
uint32(0) == 0x7A8F473A or
vt.metadata.file_name iequals "vlc.cnf"
}
The file name and encoding key are unique to each loader, and thus rules
must be created for each it.
YARA rule

51. © 2022 JPCERT/CC
50
Published Analysis Results Repository
https://github.com/JPCERTCC/HUILoader-research

52. © 2022 JPCERT/CC
51
1 Malware C2 Monitoring
2 Malware Hunting using Cloud
3 YARA CI/CD system
4 Surface Analysis System on Cloud
5 Memory Forensic on Cloud

53. © 2022 JPCERT/CC
52
Surface Analysis System on Cloud
Confusing: each type of malware is called different names
by different vendors.

54. © 2022 JPCERT/CC
53
Surface Analysis System on Cloud
Malware names are different for each security vendor and
get confusing when looking at each reports.
What is this
malware?
I want to scan
using my YARA
rule…

55. © 2022 JPCERT/CC
54
Surface Analysis System on Cloud
Same issues on twitter…

56. © 2022 JPCERT/CC
55
Surface Analysis System on Cloud
Same issues on twitter…
What is this
malware?
I want to scan
using my YARA
rule…

57. © 2022 JPCERT/CC
56
Can sandbox alone solve all problems?

58. © 2022 JPCERT/CC
57
Can sandbox alone solve all problems?
No.
Sandbox analysis results
need to be analyzed further,
which is time consuming.

59. © 2022 JPCERT/CC
Simple
Fewer steps to execute
Execute multiple analyses all at once
Easy to customize
Store analysis results
58
Our Requirements for Malware Analysis Tools

60. © 2022 JPCERT/CC
YARA
scan
floss capa
olevba Sandbox
My
toolset
59
For Example
These analyses are executed in a single step.

61. © 2022 JPCERT/CC
Send analysis job from web browser
Get malware form VT
Analyze malware for selected tools
Save analysis results
60
Flow of Surface Analysis System on Cloud
Analysis results in a single action for multiple malware.

62. © 2022 JPCERT/CC
61
FireFox Add-on

63. © 2022 JPCERT/CC
62
Analysis Results

64. © 2022 JPCERT/CC
63
Surface Analysis System on Cloud
AWS Cloud
S3
REST
VirusTotal
API Gateway
WAF
Client
Submit job
Lambda Batch
CodeCommit ECR
Run
Clone
Get malware Push results
Image
pull
Lambda
EventBridge
EventBridge
SNS
CloudWatch
Twitter
Get twitter data
Status notification
Blog
Get contents
Submit job

65. Demo

66. © 2022 JPCERT/CC
65
Infrastructure as Code (IaC)
Code and manage the building of the Surface Analysis
System on cloud.
Heavy use of IaC increases the cost of managing the code.
Limit the cases in which IaC is used.
Simple systems that do not need to use IaC.
Problem

67. © 2022 JPCERT/CC
66
IaC using Terraform
Building analysis system using Terraform

68. © 2022 JPCERT/CC
67
Surface Analysis System on Cloud with IaC
GitHub Actions
Private
Github
run
apply
commit
AWS Cloud
Client
S3
API Gateway
WAF Lambda Batch
CodeCommit ECR
Lambda
EventBridge
EventBridge
SNS
CloudWatch

69. Demo
- Infrastructure as Code -

70. © 2022 JPCERT/CC
69
Surface Analysis System on Cloud

71. © 2022 JPCERT/CC
70
1 Malware C2 Monitoring
2 Malware Hunting using Cloud
3 YARA CI/CD system
4 Surface Analysis System on Cloud
5 Memory Forensic on Cloud

72. © 2022 JPCERT/CC
Investigating multiple hosts simultaneously is time-consuming.
Memory forensic system must scale out.
Build a memory forensic system that scale out on cloud service.
71
Memory Forensic on Cloud
Increased memory size has become a bottleneck for
memory forensic investigations.

73. © 2022 JPCERT/CC
Get memory images
Send memory images to cloud
Run Volatility 3 analysis system (docker image)
Save analysis results
72
Flow of Memory Forensic on Cloud
Build a memory forensic system that scale out on
cloud service.

74. © 2022 JPCERT/CC
73
Memory Forensic on Cloud
AWS Cloud
S3 output bucket
Client
Submit job
Lambda Batch
CodeCommit ECR
Run
Clone
Push results
Image pull
Memory Image
S3 EventBridge
Analysis results
REST
WAF API Gateway
Run
EventBridge
SNS
CloudWatch
Status notification

75. © 2022 JPCERT/CC
74
Memory Forensic on Cloud
AWS Cloud
S3 output bucket
Client
Submit job
Lambda Batch
CodeCommit ECR
Run
Clone
Push results
Image pull
Memory Image
S3 EventBridge
Analysis results
REST
WAF API Gateway
Run
EventBridge
SNS
CloudWatch
Status notification
Scale out

76. © 2022 JPCERT/CC
75
Analysis Results

77. © 2022 JPCERT/CC
76
Analysis Results

78. Demo

79. © 2022 JPCERT/CC
78
Memory Forensic on Cloud with IaC
GitHub Actions
GitHub
Run
commit
Client
AWS Cloud
S3 output bucket
Submit job
Lambda Batch
CodeCommit ECR
Run
Clone
Push results
Image pull
S3 EventBridge
Analysis results
WAF API Gateway
Run
EventBridge
SNS
CloudWatch
apply

80. © 2022 JPCERT/CC
79
Surface Analysis System on Cloud

81. Tips

82. © 2022 JPCERT/CC
limit Lambda
Batch
(Fargate)
Cloud
Functions
Cloud Run
runtime 900s - 540s 3600s
memory 10G 30G 16G 32G
data 10G 200G 16G 32G
81
Limited of Serverless Service
Serverless service have limited runtime, memory
and data size.
Check the limits and select a serverless service.

83. © 2022 JPCERT/CC
API Gateway
• 10MB
presigned url s3
• 5GB
AWS CLI
• 160GB
82
Transfer of Large Data
Limited transfer of large data, such as memory
images, log file etc.
CUI is required for large
data transfers.
For Example (AWS)

84. © 2022 JPCERT/CC
83
Use as a Serverless System for GitHub Actions
GitHub Actions can also be used as a serverless
system. (free: 3000min/month)

85. © 2022 JPCERT/CC
84
Monitoring the Lucky Visitor Scam C2 System (GitHub)
C2
AWS Lambda
Amazon EventBridge
GitHub Actions Private
Public
AWS Cloud GitHub
Git push
Git push
Event
Get HTML content
Amazon S3
output bucket
Put IoC
Git checkout
Google Safe Browsing
Report
Get IoC

86. © 2022 JPCERT/CC
Share MAOps (Malware Analysis Operations) that
fight the malware development life cycle.
Introduce the case study on how to build a malware
analysis system with low maintenance costs.
Learn how to build the Malware Analysis System on
Cloud.
85
Takeaways (repost)

87. Thank you!
@jpcert_en ir-info@jpcert.or.jp
PGP https://www.jpcert.or.jp/english/pgp/
@jpcert_ac

88. © 2022 JPCERT/CC
[1] JSAC2021: Knock, knock, Neo. - Active C2 Discovery Using Protocol Emulation
https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_201_haruyama_jp.pdf
87
Reference