Meta tags:

Headings (most frequently used words):

bsides, augusta, blog, tuesday, october, friday, 2019, 2018, 2017, paul, melson, 2020, 18, july, 27, wednesday, february, saturday, september, 19, 2015, august, 20, 2013, about, me, archive, blogs, read, analysis, of, maliciousmacromsbuild, cobalt, strike, stager, 2016, talk, detroit, presentation,

Text of the page (most frequently used words):
the (57), and (24), bsides (15), string (12), #october (11), augusta (11), for (10), security (9), with (9), paulm (8), this (8), comments (7), posted (7), talk (7), takes (7), here (6), argument (6), august (5), september (5), cobalt (5), strike (5), about (5), presentation (5), detroit (5), also (5), are (5), can (5), file (5), function (5), january (4), february (4), may (4), june (4), july (4), 2017 (4), 2018 (4), 2019 (4), analysis (4), blog (4), into (4), framework (4), stager (4), payload (4), shellcode (4), see (4), path (4), first (4), april (3), november (3), maliciousmacromsbuild (3), 2020 (3), paul (3), have (3), cons (3), gave (3), that (3), conference (3), other (3), content (3), michigan (3), next (3), year (3), malware (3), viper (3), last (3), using (3), project (3), functions (3), order (3), which (3), base64 (3), when (3), new (3), exe (3), macro (3), wikiupdate (3), csproj (3), object (3), then (3), document (3), simple (2), march (2), december (2), 2013 (2), 2015 (2), working (2), past (2), two (2), posts (2), labels (2), shameless (2), self (2), promotion (2), information (2), their (2), because (2), events (2), has (2), all (2), some (2), sep (2), tuesday (2), static (2), released (2), say (2), enough (2), event (2), how (2), talks (2), code (2), from (2), friday (2), github (2), com (2), straightforward (2), used (2), http (2), windows (2), calls (2), will (2), decoded (2), what (2), m3g (2), run (2), launch (2), running (2), msbuild (2), loader (2), encoded (2), containing (2), random (2), application (2), net (2), whereis (2), delay (2), decodebase64 (2), uses (2), look (2), returns (2), fileexists (2), vba (2), office (2), binary (2), melson (2), theme, powered, blogger, grnow, wikibar, beer, advocate, tsg, microsoft, response, center, bruce, schneier, offensive, computing, anton, chuvakin, richard, bejtlich, michael, sutton, honeyblog, matasano, chargen, atlas, wandering, grsec, blogs, read, 135, 2007, 2008, 2009, 2010, 2011, 2012, archive, view, complete, profile, name, been, years, infosec, happily, married, daughters, around, whom, world, revolves, subscribe, atom, home, older, entitled, broke, note, broken, effective, program, budget, video, teased, organizers, they, ought, rename, asides, unlike, doesn, coincide, another, best, activities, any, you, great, lakes, region, recommend, making, plans, attend, there, upcoming, related, taking, place, oct, novi, cyber, summit, meeting, livonia, mi4n6, grand, rapids, grrcon, earlier, month, had, privilege, speaking, lightning, wrote, cannot, talent, quality, technical, easily, top, defensive, seriously, idea, managed, sneak, speaker, lineup, definitely, going, back, module, api, scripts, saturday, fall, promised, made, return, trip, threat, intelligence, like, virustotal, shown, more, 2016, wednesday, good, things, caliber, speakers, concentration, defender, blue, team, become, one, favorite, repo, located, https, pmelson, narc, scumbots, powershell, hunting, seven, appearance, mostly, only, replacement, obfuscation, hide, potentially, problematic, strings, confirmed, pulls, down, executes, 8004, x4bo, loading, debugger, address, user, agent, uri, plainly, seen, those, familiar, stagers, immediately, recognize, x64, visually, inspected, default, template, visual, studio, inject, processes, system32, searchprotocolhost, now, understand, works, let, arguments, builds, multiple, rounds, concatenation, reversing, opens, decodes, large, writes, output, number, seconds, creates, server, clsid, call, execute, contents, location, found, shellexecute, 9ba05972, f6a8, 11cf, a442, 00a0c90a8f39, userprofile, downloads, hdjqbnihq, where, fun, begins, loop, until, current, time, matches, passed, locations, preferred, versions, matched, checks, matching, exists, boolean, true, false, reverses, characters, strrev, three, triggers, attempt, opened, macros, enabled, convert, text, sbintostr, typed, converts, sbintost, fairly, stage, intended, insertion, came, across, interesting, sample, beacon, initial, was, built, generator, topics,

Text of the page (random words):
paul melson s blog paul melson s blog blog about information security and other random topics tuesday october 6 2020 analysis of maliciousmacromsbuild cobalt strike stager on october 4 2020 i came across an interesting malware sample the payload is a cobalt strike beacon stager and the initial loader was built using maliciousmacromsbuild generator or m3g here s a look at the first stage code which is a vba macro intended for insertion into an office document the first two functions are fairly straightforward 1 sbintost r takes a binary typed object and converts it to a string object 2 decodebase64 takes a base64 encoded string decoded it to binary and uses sbintostr to convert it to text the last seven functions in order of appearance in the file are also mostly straightforward with only some simple replacement obfuscation used to hide potentially problematic static strings 1 the first three functions are vba triggers to attempt to launch the macro when the containing office document is opened or when macros are enabled 2 strrev takes a string as an argument and reverses the order of the characters in the string 3 fileexists takes a string argument checks to see if a file path matching the content of that string exists and returns a boolean true or false 4 whereis takes no argument and uses fileexists to look for path locations for preferred versions of the net framework and returns the first matched path 5 delay takes a string as an argument and running loop until the current time matches the argument passed this function is where the fun begins the function hdjqbnihq takes no arguments it builds a base64 encoded string using multiple rounds of concatenation string reversing it opens a new file object at userprofile downloads wikiupdate csproj then decodes the large string containing the payload with the decodebase64 function and writes the output to a file it then calls the delay function for a random number of seconds next it creates a new com server application with the clsid 9ba05972 f6a8 11cf a442 00a0c90a8f39 which is then used to call document application shellexecute and run msbuild exe to execute the contents of wikiupdate csproj with the net framework location found by whereis as an argument ok now that we understand how the macro loader works let s see what s in the wikiupdate csproj payload what we can see here is the default m3g shellcode template visual studio project file when run with msbuild exe it will launch c windows system32 searchprotocolhost exe and inject the shellcode into the new running processes the base64 string can be decoded and visually inspected an ip address user agent string and uri path can all be plainly seen those familiar with shellcode stagers will immediately recognize this as an x64 cobalt strike stager loading the shellcode into a debugger we can see the windows function calls in order confirmed cobalt strike http stager which pulls down and executes the payload at http 10 10 10 20 8004 x4bo posted by paulm at 2 05 pm no comments friday october 18 2019 bsides augusta 2019 my powershell hunting presentation from bsides augusta 2019 posted by paulm at 11 33 am no comments bsides augusta 2018 this is the presentation i gave at bsides augusta 2018 on the scumbots project the github repo for this project is located at https github com pmelson narc posted by paulm at 11 31 am no comments friday july 27 2018 bsides augusta 2017 this is my talk from bsides augusta 2017 i can t say enough good things about the caliber of speakers and the concentration of defender blue team talks at their event it has become one of my favorite cons posted by paulm at 10 26 am no comments wednesday february 8 2017 bsides augusta 2016 last fall as promised i made a return trip to bsides augusta to talk about malware analysis the viper framework and threat intelligence here s the talk also like last year i released more code for using viper and virustotal as shown in the presentation posted by paulm at 12 03 pm 2 comments saturday september 19 2015 bsides augusta talk earlier this month i had the privilege of speaking at bsides augusta i gave a lightning talk on working with the viper framework for static analysis here s the talk i also released the module and api scripts i wrote for the talk i cannot say enough about the talent and quality technical content in the bsides augusta talks this is easily a top 5 defensive security event i seriously have no idea how i managed to sneak into this speaker lineup definitely going back next year posted by paulm at 10 11 am no comments labels cons malware security shameless self promotion tuesday august 20 2013 bsides detroit presentation in june i gave a presentation at bsides detroit entitled broke note broken an effective information security program with a 0 budget here s the video i have teased the bsides detroit organizers that they ought to rename their conference to asides detroit because unlike other bsides events it doesn t coincide with another security conference and also because it is has the best content and activities of any security conference in detroit if you re in michigan or the great lakes region at all i recommend making plans to attend next year i ll be there also here are some other upcoming security related events taking place in michigan grrcon sep 12 13 grand rapids mi4n6 meeting sep 19 livonia michigan cyber summit oct 25 novi posted by paulm at 7 54 am no comments labels cons security shameless self promotion older posts home subscribe to posts atom about me paulm my name is paul and i ve been working in it for the past 23 years infosec for the past 18 i am happily married and have two daughters around whom my world revolves view my complete profile blog archive 2020 1 october 1 analysis of maliciousmacromsbuild cobalt strike 2019 2 october 2 2018 1 july 1 2017 1 february 1 2015 1 september 1 2013 1 august 1 2012 1 october 1 2011 2 october 1 may 1 2010 5 october 1 may 2 april 1 january 1 2009 13 december 1 november 2 october 1 september 2 august 1 june 5 january 1 2008 55 november 1 october 2 september 3 august 3 july 5 june 6 may 3 april 6 march 8 february 11 january 7 2007 135 december 6 november 8 october 11 september 16 august 7 july 16 june 13 may 11 april 16 march 16 february 11 january 4 blogs i read grsec atlas wandering matasano chargen honeyblog michael sutton richard bejtlich anton chuvakin offensive computing bruce schneier microsoft security response center tsg beer advocate grnow wikibar simple theme powered by blogger