Malware Gathering Victim Network Information via Public IP Check Services

This brief focuses on the technique of malware and related tools querying public IP check services to identify the external IP address of a compromised host. This activity is typically performed early in the infection lifecycle to give the attacker situational awareness of the victim's network. This information can be used to tailor attacks, identify the victim's geographic location, and potentially identify the organization to which the victim belongs. This technique is used by a wide variety of malware families, including Trickbot, Azorult, and many others, to perform reconnaissance on the compromised host. This behavior is identified using Sysmon EventCode 22 logs, specifically monitoring DNS queries to services.

Attack Chain

1. A user unknowingly executes a malicious executable (e.g., via drive-by download or opening a malicious attachment).
2. The malicious executable starts on the host, typically with user-level privileges.
3. The malware initiates a DNS query to a known IP check service (e.g., wtfismyip.com, ipinfo.io, icanhazip.com) using the QueryName field in Sysmon Event ID 22.
4. The DNS query is resolved, and the malware receives the external IP address of the compromised host.
5. The malware may then use this IP address for further reconnaissance, such as geolocation lookups or identifying the organization to which the IP address belongs.
6. The gathered information is sent back to the attacker-controlled command-and-control (C2) server.
7. The attacker uses the gathered information to tailor subsequent attacks, such as lateral movement or data exfiltration.

Impact

Successful execution of this reconnaissance technique provides attackers with valuable information about the victim's network. This information can be used to tailor subsequent attacks, increasing the likelihood of success. In the case of ransomware attacks, knowing the victim's organization can allow the attacker to demand a larger ransom. The use of IP check services has been observed across a diverse range of malware families and impacts organizations across all sectors.

Recommendation

• Enable Sysmon Event ID 22 logging to capture DNS query events.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.
• Block the C2 domains listed in the IOC table at the DNS resolver.
• Investigate any unusual process making DNS queries to IP check services, as highlighted by the detection rules.