Investigation and forensics of suspicious endpoints
It is time to start answering the question of whether there is malicious executable code running in our environment. For this, we will take a closer look at the interesting artifacts we found throughout this exercise. This is the list of artifacts we have found so far:
- Artifact 1 – Workstation12:
c:\windows\system32\wbem\unsecapp.exe - Artifact 2 – Workstation12:
c:\windows\system32\dllhost.exe - Artifact 3 – Workstation12:
c:\windows\system32\backdoor.exe - Artifact 4 – Workstation12 :
nat-service c:\windows\system32\backdoor.exe - Artifact 5 – Workstation12:
fun-service c:\windows\system32\backdoor-v2.exe - Artifact 6 – FT-DIR1:
C:\PROGRA~2\ROCKWE~1\RSLinx\RSLINX.EXE - Artifact 7 – Workstation1:
C:\Users\engineer-1\AppData\Local\Microsoft\OneDrive\OneDrive.exe - Artifact 8 – Workstation12:
C:\Windows\System32\backdoor...
