Incident Summary

Someone brute forced RDP from 185[.]107[.]56[.]136, a Netherlands VPN/proxy IP, and got in as LetsDefend on Shirley (172[.]16[.]20[.]191) with a Type 10 logon. From there it was hands on keyboard. They ran recon, went after credentials in PowerShell history, System32\config and Chrome’s Login Data, and turned off Defender and the Windows firewall. Then they ran test[.]py, which sends hand-built DNS packets straight to 60[.]216[.]3[.]126 (China) on UDP 53. That’s the traffic SOC272 picked up.

Timeline (2024-04-04)

Time	Activity
09:58:11	Successful RDP Type 10 logon after brute force
09:58:56	whoami, whoami /groups
09:59:28	cd C:\Windows\System32\config, reads SavedConfigHash[.]txt
09:59:59	cd to PSReadLine, reads ConsoleHost_history[.]txt
10:00:32	Navigates to AppData\Local\Google\Chrome\User Data\Default
10:01:46	Get-content Login Data
10:02:08	Creates Downloads\test[.]txt
10:03:04	Set-MpPreference -DisableRealtimeMonitoring $true; -DisableScriptScanning 1, netsh firewall set opmode disable, netsh advfirewall set allprofiles state off
10:03:55	.\test[.]py
10:04:00	SOC272 fires

test.py Analysis

• It opens a raw UDP socket with socket.SOCK_DGRAM and sends straight to 60[.]216[.]3[.]126:53. It never touches the Windows DNS Client service, so Sysmon EID 22 never logs it. That’s why L1 saw a lot of DNS traffic but couldn’t tie it to a process.
• The header is built by hand: a 2-byte ID, standard query flags, QDCOUNT=1, and a fixed question for www[.]example[.]com (type A, class IN).
• The data is split into 62-byte chunks and tacked on after the question section, each with its own length byte. A normal resolver would treat that as junk. A listener the attacker controls just reads it off the end of each packet.
• There’s a 100ms sleep between chunks and the whole thing runs 10 times. That’s the rapid burst that tripped the rule.
• In this copy the payload is a hardcoded string. It’s the channel that’s confirmed, not that the harvested credentials went through it.

Negative Findings

• The only EID 22 in the window is SentinelRanger[.]exe (SYSTEM) looking up an internal EC2 hostname. It has nothing to do with this.
• Nothing shows how test[.]py got onto the host. There’s no download, clipboard or transfer artifact for it, so the delivery method is still a gap.
• Nothing shows the contents of Login Data being sent out. Chrome locks that SQLite file while it’s running, and the path with a space isn’t quoted in the command, so the read probably didn’t work as typed.

MITRE ATT&CK

ID	Tactic	Technique
T1110.001	Credential Access	Password Guessing
T1133	Initial Access	External Remote Services
T1078	Initial Access	Valid Accounts
T1021.001	Lateral Movement	Remote Desktop Protocol
T1033	Discovery	System Owner/User Discovery
T1552.001	Credential Access	Credentials In Files
T1555.003	Credential Access	Credentials from Web Browsers
T1059.001	Execution	PowerShell
T1059.006	Execution	Python
T1562.001	Defense Evasion	Disable or Modify Tools
T1562.004	Defense Evasion	Disable or Modify System Firewall
T1071.004	Command and Control	DNS
T1048.003	Exfiltration	Exfiltration Over Unencrypted Non-C2 Protocol

IOCs

Type	Value
Brute force / RDP source	185[.]107[.]56[.]136
DNS exfil destination	60[.]216[.]3[.]126
Compromised account	LetsDefend
Victim host	Shirley / 172[.]16[.]20[.]191
Script	C:\Users\LetsDefend\Downloads\test[.]py
File	C:\Users\LetsDefend\Downloads\test[.]txt

Containment and Recommendations

• Isolate the host and kill test[.]py
• Disable LetsDefend and reset its password, plus any creds found in PS history, SavedConfigHash[.]txt and Chrome
• Block both IPs at the perimeter
• Take RDP off the internet, put it behind VPN with MFA, and turn on account lockout
• Turn Defender and the firewall back on, and alert on Set-MpPreference and netsh firewall changes
• Allow outbound 53 only to the internal resolvers. A DNS packet going anywhere else is the detection here.

Verdict

True Positive. Brute force, credential access, defense evasion and DNS exfiltration all confirmed.

Analysis Reports

• 🌐 AbuseIPDB: 185.107.56.136
• 🌐 AbuseIPDB: 60.216.3.126
• 🔬 VirusTotal: 60.216.3.126