How Darktrace’s AI detects metamorphic malware

Justin Fier, Director of Cyber Intelligence & Analytics | Monday July 31, 2017

Some of the most insidious threats that Darktrace finds use self-modifying technology to hide their presence on the network. These attacks can dynamically change their threat signatures, automatically extract data, and spread without a human controller.

Recently, we discovered anomalous activity on the network of a major US university. After investigation, we found that the anomaly was the ‘Smoke Malware Loader’ which employs numerous techniques to evade internal security. Most notably, the malware generates fake traffic to hide its presence.

Darktrace observed the initial infection when three anomalous executables were transferred over plain text. The malware did not match any known threat signatures, allowing it to bypass the network’s perimeter controls.

C1ulyq1wLrMBs6LG00 on Thu Sep 8, 13:19:01
Co2eAJ2GifEkWut700 on Thu Sep 8, 12:09:52
CdcZeu200UOsuf5u00 on Wed Sep 14, 16:38:44

The connections originated from a suspicious external domain that the company had never communicated with before:

lago666[.]com (91.243.193.149)

Both the anomalous download and the beaconing activity represented major deviations from the unique ‘pattern of life’ learned by the Enterprise Immune System.

Although the payload circumvented the network’s perimeter security, the company also had an alternate security system monitoring network flow. This tool raised an alert when the download occurred, but it was deemed a ‘false positive’ because the malware proceeded to install new, previously unknown versions of the executable to the Windows registry.

After the self-modifying modules were uploaded to the company device, a large number of HTTP POST requests were sent against /smk/log.php to the following domains:

lago666[.]com
lago666[.]xyz
lago666[.]pw
lago666[.]top
lago666[.]site
lago666[.]bid
www.lago666[.]website
lago666[.]online
www.lago666[.]space
lago666[.]website
lago666[.]space
www.lago666[.]online
lago666[.]trade
lago666[.]webcam
lago666[.]tech
lago666[.]host
lago666[.]press

The malware attempted to transfer data to these external destinations, but to hide its tracks, the remote machine replied with a fake 404 error code. These connections were deemed highly anomalous by Darktrace’s AI algorithms.

Since the payload was designed to be compatible with the password grabber module2 – which is often deployed side-by-side with Smoke Malware Loader – the data attempting to leave the network likely contained user credentials and passwords.

In conjunction with the initial transfer, another anomalous file was then delivered to a different device. This activity indicated that the threat actor was likely attempting to move laterally across the network:

hxxp://cdn.che[.]moe/izgmcx.exe (connection UID: CGH6uV3G5tdKSNY800) to 10.1.105.117 on Mon Sep 12 at 08:02:03.

Darktrace detected each anomaly in real time as the situation developed. By using AI algorithms to continuously learn normal behavior, Darktrace was able to monitor the malware’s changing threat signature.

Traditional security tools – no matter how advanced – are incapable of detecting such sophisticated threats. Legacy controls rely on rules and signatures, and these threats are specifically designed to bypass rules and signatures.

Darktrace’s real-time threat detection allowed the university’s security team to quarantine the infected devices before the malware could burrow deeper into the network, and before the attacker could use the passwords to further compromise the network. Darktrace then assisted the security team as they remediated the situation and changed their security protocols and passwords.

Blog Archive

Thursday January 10, 2019
Monday December 3, 2018
Thursday November 22, 2018
Thursday October 25, 2018
Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.