SOC-Investigation-CVE-2024-49138 — Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation) | Kitploit
basitsajidapply-stack/soc-investigation-cve-2024-49138SOC-Investigation-CVE-2024-49138
Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
2 days ago
Discover the most used tools by our community.
🛡️ SOC Investigation Report: CVE-2024-49138 Exploitation
📌 Executive Summary
- Alert Title: SOC335 - CVE-2024-49138 Exploitation Detected
- Severity: High
- Target Host: Victor (
172.16.17.207)
- Operating System: Windows 10
- Primary User: letsdefend
- Verdict: True Positive (Malicious Activity Confirmed)
🔍 Investigation Methodology
1. Process & Binary Analysis
- Suspicious File:
svohost.exe
- Execution Path:
C:\temp\service_installer\svohost.exe
- Anomalies:
- Process Masquerading: Name mimics the legitimate Windows system file .
svchost.exe
Path Location: System binaries run from C:\Windows\System32\, whereas this binary executed from a user temp path.2. Threat Intelligence Verification
- File Hash:
b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9
- VirusTotal Detection: 50/71 security vendors flagged the file as malicious.
- Threat Classification:
Trojan/Win64.MalwareX, tagged with cve-2024-49138 privilege escalation exploit.
3. Log Management & Network Correlation
- Queried SIEM logs for host IP
172.16.17.207.
- Findings: Confirmed outbound network connection to external Command & Control (C2) IP
185.107.56.1.
- Host Isolation: Navigated to EDR Endpoint Security and toggled Containment: Enabled for host
Victor (172.16.17.207) to block network traversal.
- Artifact Logging: Documented malicious file hash, C2 IP, and target host IP in Case Management.
- Case Closure: Finalized playbook analysis as True Positive.
🎯 Indicators of Compromise (IOCs)
| Artifact Type | Value | Description |
|---|
| File Hash (SHA-256) | b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9 | Malicious Exploit Executable |
| C2 IP Address | 185.107.56.1 | Command & Control IP |
| Victim IP | 172.16.17.207 | Compromised Windows 10 Host |
| File Path | C:\temp\service_installer\svohost.exe | Executable Location |
