Incident Timeline: imreallynotbatman.com & Wayne Enterprises

Boss of the SOC v1 dataset (botsv1-attack-only.tgz) · reconstructed from live Splunk queries against index=botsv1

All timestamps UTC, August 2016. Source IPs and hostnames verified directly against Splunk search results, not copied from a published answer key.

Reconnaissance
Initial access
Endpoint compromise
Ransomware detonation
Lateral impact
2016-08-10
Reconnaissance

Automated scan of imreallynotbatman.com

Source IP 40.80.148.42 generated 1,928 of the 10,010 HTTP-stream requests seen against the site, using a Chrome-spoofed user agent. 17,469 events from this IP contain the string "acunetix," and 19,751 events reference "joomla." The site is a Joomla install being scanned with the Acunetix web vulnerability scanner.

index=botsv1 sourcetype=stream:http imreallynotbatman.com | stats count by src_ip, http_user_agent
40.80.148.42Acunetix scannerJoomla CMS
2016-08-10 23:52:47 UTC
Initial access

Malicious file upload via Joomla com_extplorer

Same source IP POSTs a multipart upload to /joomla/administrator/index.php?option=com_extplorer (the Joomla file-manager component) containing 3791.exe (raw MZ/PE header visible in the capture) and a PHP web shell, agent.php. Server response: "Upload successful."

index=botsv1 dest_ip=192.168.250.70 sourcetype=stream:http "multipart/form-data"
3791.exeagent.phpdest 192.168.250.70
2016-08-24 18:17:31 UTC
Endpoint compromise

In-memory payload staged on we8105desk

On workstation we8105desk.waynecorpinc.local (user WAYNECORPINC\bob.smith), Sysmon logs csc.exe (the C# compiler) spawning cvtres.exe, compiling code staged into %TEMP%, a living-off-the-land technique typical of a VBScript/macro dropper avoiding disk-based AV signatures. This appears to be a separate spear-phishing intrusion chain, two weeks after the web-app compromise.

index=botsv1 host=we8105desk sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (.tmp OR .vbs OR cerber)
we8105deskbob.smithcsc.exe → cvtres.exe
2016-08-24 18:49:41 UTC
Ransomware detonation

Cerber ransomware C2 burst

FortiGate UTM fires 9,231 "Botnet: Cerber.Botnet" IPS signature alerts in the same second, all sourced from 192.168.250.100 (we8105desk) and sprayed across the entire 85.93.63.0/24 block. This is Cerber's known technique of contacting a wide range of decoy IPs to defeat static blocklisting of its ransom-payment C2.

index=botsv1 cerber sourcetype=fgt_utm | table _time, msg, srcip, dstip
192.168.250.10085.93.63.0/24Cerber.Botnet
2016-08-24, following detonation
Lateral impact

Encryption reaches shared network storage

152 SMB sessions from we8105desk (192.168.250.100) to a file server at 192.168.250.20 contain ransom-note/encryption-related keywords. The ransomware reached a mapped network drive, not just the local workstation.

index=botsv1 sourcetype=stream:smb (cerber OR readme OR ransom) | stats count by src_ip, dest_ip
192.168.250.20 (file server)

Dead ends worth recording

  • No md5/file_hash field was populated on the 3791.exe upload event. Splunk Stream wasn't configured to compute file hashes, so the executable's hash could not be pulled from network data alone in this environment.
  • Searched iis and stream:http for the actual defaced homepage/image (keywords "batman", "poison"): zero hits. The 135MB attack-only package appears to have trimmed that artifact out; it would need the full 6.1GB dataset.
  • Sysmon events came through as raw, unparsed XML (no CommandLine/Image fields) since the official Microsoft-Sysmon Splunk add-on wasn't installed. Usable, but required reading full event bodies instead of clean field tables.
← back to the BOTS v1 writeup