SOC335 - Exploitation of CVE-2024-49138 Detected

Summary

This was one of the SOC lab exercises that I took on LetsDefend.

The alert was about CVE-2024-49138. I investigated the alert, checked a suspicious hash on VirusTotal and searched the available logs for related activity.

What I Did

• Investigated the initial alert
• Extracted and checked the suspicious hash on VirusTotal
• Checked LetsDefend Log Management
• Investigated the suspicious file and process
• Checked related IP addresses and network activity
• Created a timeline of the activity
• Identified the IOCs

Hash Investigation

I submitted the suspicious hash to VirusTotal.

Hash:

b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9

VirusTotal result:

The binary svohost.exe (SHA-256:b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9) was confirmed malicious

Log Investigation

I searched the LetsDefend logs using the indicators found during the investigation.

Some of the things I looked for were:

• File name
• Hash
• Process
• IP address
• Hostname
• User

Findings:

I filtered logs for IP: 172.16.17.207 and observed:

• Multiple brute-force login attempts from 185.107.56[.]141
• Successful RDP login
• Outbound traffic to a malicious C2 server

IOCs

Hash: b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9
IP: 185.107.56.141
Domain: files-ld.s3.us-east-2.amazonaws.com
File: svohost.exe

Conclusion

According to the investigation, the victim host exhibited normal activities and then underwent a successful RDP connection as well as outbound communication with the remote Java server.

Moreover, the hash examination also concluded that the file svohost.exe was malicious.

Tools

• LetsDefend
• VirusTotal
• Endpoint Security
• Log Management

Screenshots

Screenshots from the investigation are stored in the screenshots folder.

Repository Structure

SOC335-CVE-2024-49138/
├── README.md
└── screenshots/
    ├── 01-VirusTotal-Detection.png
    ├── 02-Basic-Properties.png
    ├── 03-File-Name-VT.png
    ├── 04-Endpoint-Information.png
    ├── 05-Priviledge-Escalation.png
    ├── 06-Terminal-History.png
    ├── 07-Log-Management.png
    ├── 08-SIEM-Dashboard.png
    └── 09-Playbook-score.png

Connect

Thank you for taking the time to view this project.

I'm documenting my cybersecurity learning journey by completing hands-on labs in networking, Linux, digital forensics, cloud computing, and SOC analysis. Feel free to explore my other repositories to see what I'm learning next.