[pull] master from kevoreilly:master

conf/default/processing.conf.default

@@ -53,6 +53,8 @@ ram_boost = no
 # https://capev2.readthedocs.io/en/latest/usage/patterns_replacement.html
 replace_patterns = no
 file_activities = no
+# Get network details from behavior
+network_map = no
 
 # process behavior files in ram to speedup processing a little bit?
 ram_mmap = no

data/html/generic/_network_dns.html

@@ -3,10 +3,11 @@
     <tr>
         <th>Name</th>
         <th>Response</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for dns in results.network.dns %}
     <tr>
-        <td><span class="mono">{{dns.request}}</span></td>
+        <td><span class="mono">{{dns.request}}</span> {% if dns.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
         <td>
             {% for a in dns.answers %}
                 <span class="mono">{{a.type}} {{a.data}}</span>
@@ -15,6 +16,15 @@
                 {% endif %}
             {% endfor %}
         </td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if dns.process_name %}
+                    <span class="mono">{{ dns.process_name }}{% if dns.process_id %} ({{ dns.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>

data/html/generic/_network_hosts.html

@@ -4,6 +4,7 @@
         <th width="10%">Direct</th>
         <th>IP Address</th>
         <th>Country Name</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for host in results.network.hosts %}
         {% if host.ip[:7] != "192.168" %}
@@ -18,6 +19,15 @@
             {% endif %}
             <td><span class="mono">{{host.ip}}</span></td>
             <td>{{host.country_name}}</td>
+            {% if results.network_proc_map %}
+                <td>
+                    {% if host.process_name %}
+                        <span class="mono">{{ host.process_name }}{% if host.process_id %} ({{ host.process_id }}){% endif %}</span>
+                    {% else %}
+                        <span class="mono">-</span>
+                    {% endif %}
+                </td>
+            {% endif %}
         </tr>
         {% endif %}
     {% endfor %}

data/html/generic/_network_http.html

@@ -3,6 +3,7 @@
     <tr>
         <th>URI</th>
         <th>Details</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for http in (results.network.http_ex|list + results.network.https_ex|list) %}
     <tr>
@@ -43,6 +44,15 @@
             </td></tr>
             </table>
         </td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if http.process_name %}
+                    <span class="mono">{{ http.process_name }}{% if http.process_id %} ({{ http.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>
@@ -51,11 +61,21 @@
         <tr>
             <th>URI</th>
             <th>Data</th>
+            {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
         </tr>
         {% for request in results.network.http %}
         <tr>
-            <td style="word-wrap: break-word;">{{request.uri}}</td>
+            <td style="word-wrap: break-word;">{{request.uri}} {% if request.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
             <td style="word-wrap: break-word;"><pre>{{request.data}}</pre></td>
+            {% if results.network_proc_map %}
+                <td>
+                    {% if request.process_name %}
+                        <span class="mono">{{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %}</span>
+                    {% else %}
+                        <span class="mono">-</span>
+                    {% endif %}
+                </td>
+            {% endif %}
         </tr>
         {% endfor %}
     </table>

data/html/generic/_network_icmp.html

@@ -5,13 +5,23 @@
        <th>Destination</th>
        <th>ICMP Type</th>
        <th>Data</th>
+       {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for icmp in results.network.icmp %}
     <tr>
-       <td><span class="mono">{{icmp.src}}</span></td>
+       <td><span class="mono">{{icmp.src}}</span> {% if icmp.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
        <td><span class="mono">{{icmp.dst}}</span></td>
        <td><span class="mono">{{icmp.type}}</span></td>
        <td><span class="mono"><pre>{{icmp.data}}</pre></span></td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if icmp.process_name %}
+                    <span class="mono">{{ icmp.process_name }}{% if icmp.process_id %} ({{ icmp.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>

data/html/generic/_network_irc.html

@@ -4,12 +4,22 @@
         <th>Command</th>
         <th>Params</th>
         <th>Type</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for irc in results.network.irc %}
     <tr>
-        <td><span class="mono">{{irc.command}}</span></td>
+        <td><span class="mono">{{irc.command}}</span> {% if irc.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
         <td><span class="mono"><pre>{{irc.params}}</pre></span></td>
         <td><span class="mono"><pre>{{irc.type}}</pre></span></td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if irc.process_name %}
+                    <span class="mono">{{ irc.process_name }}{% if irc.process_id %} ({{ irc.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>

data/html/generic/_network_smtp.html

@@ -3,11 +3,21 @@
     <tr>
         <th>Destination</th>
         <th>Data</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for smtp in results.network.smtp %}
     <tr>
-        <td><span class="mono">{{smtp.dst}}</span></td>
+        <td><span class="mono">{{smtp.dst}}</span> {% if smtp.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
         <td><span class="mono"><pre>{{smtp.raw}}</pre></span></td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if smtp.process_name %}
+                    <span class="mono">{{ smtp.process_name }}{% if smtp.process_id %} ({{ smtp.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>

data/html/generic/_network_tcp.html

@@ -3,11 +3,21 @@
     <tr>
         <th>IP Address</th>
         <th>Port</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for conn in results.network.tcp %}
     <tr>
-        <td><span class="mono">{{conn.dst}}</span></td>
+        <td><span class="mono">{{conn.dst}}</span> {% if conn.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
         <td><span class="mono">{{conn.dport}}</span></td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if conn.process_name %}
+                    <span class="mono">{{ conn.process_name }}{% if conn.process_id %} ({{ conn.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>

data/html/generic/_network_udp.html

@@ -3,11 +3,21 @@
     <tr>
         <th>IP Address</th>
         <th>Port</th>
+        {% if results.network_proc_map %}<th>Process Name (PID)</th>{% endif %}
     </tr>
     {% for conn in results.network.udp %}
     <tr>
-        <td><span class="mono">{{conn.dst}}</span></td>
+        <td><span class="mono">{{conn.dst}}</span> {% if conn.source == "behavior" %}<span class="badge bg-primary">behavior</span>{% endif %}</td>
         <td><span class="mono">{{conn.dport}}</span></td>
+        {% if results.network_proc_map %}
+            <td>
+                {% if conn.process_name %}
+                    <span class="mono">{{ conn.process_name }}{% if conn.process_id %} ({{ conn.process_id }}){% endif %}</span>
+                {% else %}
+                    <span class="mono">-</span>
+                {% endif %}
+            </td>
+        {% endif %}
     </tr>
     {% endfor %}
 </table>

lib/cuckoo/core/analysis_manager.py

@@ -544,7 +544,7 @@ def route_network(self):
         elif self.route == "internet" and routing.routing.internet != "none":
             self.interface = routing.routing.internet
             self.rt_table = routing.routing.rt_table
-            self.no_local_routing = routing.routing.no_local_routing
+            self.no_local_routing = routing.routing.no_local_routing and not routing.routing.nat
             if routing.routing.reject_segments != "none":
                 self.reject_segments = routing.routing.reject_segments
             if routing.routing.reject_hostports != "none":

modules/processing/behavior.py

@@ -1268,10 +1268,12 @@ def event_apicall(self, call, process):
                 _add_http_host(self.http_host_map, host, pinfo, sock=sock)
 
         if api in HTTP_HINT_APIS:
-            url = _get_arg_any(args_map, "URL", "url", "lpszUrl", "lpUrl", "uri", "pszUrl", "pUrl")
+            url = _get_arg_any(args_map, "URL", "Url", "url", "lpszUrl", "lpUrl", "uri", "pszUrl", "pUrl")
             if isinstance(url, str) and url.strip():
                 u = _extract_first_url(url) or url.strip()
                 host = _host_from_url(u)
+                if not host and "://" not in u:
+                    host = _host_from_url(f"http://{u}")
                 if host:
                     _add_http_host(self.http_host_map, host, pinfo, sock=sock)
 
@@ -1282,6 +1284,11 @@ def event_apicall(self, call, process):
                     if host2:
                         _add_http_host(self.http_host_map, host2, pinfo, sock=sock)
 
+            if api in ("internetconnectw", "internetconnecta", "winhttpconnect"):
+                server_name = _get_arg_any(args_map, "ServerName", "lpszServerName", "szServerName", "pszServerName")
+                if server_name:
+                    _add_http_host(self.http_host_map, server_name, pinfo, sock=sock)
+
         if api in TLS_HINT_APIS:
             sni = _extract_tls_server_name(call, args_map)
             if sni:

modules/reporting/reporthtml.py

@@ -8,6 +8,7 @@
 import os
 
 from lib.cuckoo.common.abstracts import Report
+from lib.cuckoo.common.config import Config
 from lib.cuckoo.common.constants import CUCKOO_ROOT
 from lib.cuckoo.common.exceptions import CuckooReportError
 from lib.cuckoo.common.objects import File
@@ -117,6 +118,7 @@ def run(self, results):
             )
             env.loader = FileSystemLoader(os.path.join(CUCKOO_ROOT, "data", "html"))
             results["local_conf"] = self.options
+            results["network_proc_map"] = Config("processing").network.process_map
 
             try:
                 tpl = env.get_template("report.html")