SOC335 - Exploitation of CVE-2024-49138 Detected

About

This was one of the SOC lab exercises that I took on LetsDefend.

The alert was about CVE-2024-49138. I investigated the alert, checked a suspicious hash on VirusTotal and searched the available logs for related activity.

What I Did

• Investigated the initial alert
• Extracted and checked the suspicious hash on VirusTotal
• Checked LetsDefend Log Management
• Investigated the suspicious file and process
• Checked related IP addresses and network activity
• Created a timeline of the activity
• Identified the IOCs

Hash Investigation

I submitted the suspicious hash to VirusTotal.

Hash:

b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9

VirusTotal result:

The binary svohost.exe (SHA-256:b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9) was confirmed malicious

Log Investigation

I searched the LetsDefend logs using the indicators found during the investigation.

Some of the things I looked for were:

• File name
• Hash
• Process
• IP address
• Hostname
• User

Findings:

I filtered logs for IP: 172.16.17.207 and observed:

• Multiple brute-force login attempts from 185.107.56[.]141
• Successful RDP login
• Outbound traffic to a malicious C2 server

IOCs

• Hash: b432dcf4a0f0b601b1d79848467137a5e25cab5a0b7b1224be9d3b6540122db9
• IP: 185.107.56.141
• Domain: files-ld.s3.us-east-2.amazonaws.com
• File: svohost.exe

Conclusion

According to the investigation, the victim host exhibited normal activities and then underwent a successful RDP connection as well as outbound communication with the remote Java server.

Moreover, the hash examination also concluded that the file svohost.exe was malicious.

Tools

• LetsDefend
• VirusTotal
• Endpoint Security
• Log Management

Evidence

Screenshots from the investigation are stored in the screenshots folder.