Heartbreaker-Continuum
Hack the Box Malware Analysis Lab
Introduction
This will be my first piece of malware I have ever analysed, I am using my VM to extract and view the malware sample.
Question 1: To accurately reference and identify the suspicious binary, please provide its SHA256 hash.
Answer: Using my terminal I used the sha256sum command to grab its hash.
Question 2: When was the binary file originally created, according to its metadata (UTC)?
Answer: Since its my first time looking into how to perform analysis, I looked up how to grab the most amount of information about a file. I needed to install readpe! Then to analyse the file to give me the time and date.
Question 3: Examining the code size in a binary file can give indications about its functionality. Could you specify the byte size of the code in this binary?
Answer: Using the same output as before, I looked for the actual text within the file. Not the headers and their sizes. Giving me an answer of 38400.
Question 4: It appears that the binary may have undergone a file conversion process. Could you determine its original filename?
Answer: This is also something I had never done before, finding its original file name. After some research, using the command strings might give me the answer.
It looks like there is a name of a .ps1 file in the strings of the file. This seems to be the original name.
Question 5: Specify the hexadecimal offset where the obfuscated code of the identified original file begins in the binary.
Answer: Now obfuscated code is normally done by writing code then converting it to Base64 to be used in the file. Using the hexdump command with the argument of -C, I can look for code that is obfuscated.
The output around the seemingly obfuscated code was the following:
The third line is where the code becomes a jumbled mess of characters. The hexadecimal offset at the start of this code would be: 2c74. The reason being the code starts at the 9 place in the hexadecimal column.
Question 6: The threat actor concealed the plaintext script within the binary. Can you provide the encoding method used for this obfuscation?
Answer: The main body of the code seems to start after the obfuscated section that I found earlier. Since the upper half of the hex dump is the header of the file. Scrolling down a little I looked for any mention of a text file and encoding method.
There are a couple of interesting things here, firstly the GeTsTrInG that seems to be called to convert from Base64, giving us our answer.
Question 7: What is the specific cmdlet utilized that was used to initiate file downloads?
Answer: I had never done anything like this before, so after some research I found you can use a tool such as CyberChef to reverse engineer the code and turn the Base64 code into something more legible.
Press enter or click to view image in full size
I selected the Reverse recipe and the From Base64 to make the code readable. Now I can go hunting for my answer. At the very top of the file seems to have held the answer.
The Invoke-WebRequest command is the answer. It intakes a URL and the file. Meaning it can initiate downloads.
Question 8: Could you identify any possible network-related Indicators of Compromise (IoCs) after examining the code? Separate IPs by comma and in ascending order.
Answer: This was rather simple, looking for IP address that the malware wants to connect to.
Question 9: The binary created a staging directory. Can you specify the location of this directory where the harvested files are stored?
Answer: There were a few file paths within the malware. But malware loves to invoke a variable called $targetDir that dumps the users information in the form of .txt files.
Question 10: What MITRE ID corresponds to the technique used by the malicious binary to autonomously gather data?
Answer: Looking through the code it was pretty clear that the malware wants to search for specific files with the following extensions:
Meaning this malware would fall under the MITRE ID T1119, automated collection of data.
Question 11: What is the password utilized to exfiltrate the collected files through the file transfer program within the binary?
Answer: There was an interesting line of code that stood out to me here. The malware attempts to open a secure FTP link with the credentials: service and password M8&C!i6KkmGL1-#, at the address 35.169.66.138. Pointing to an obvious exfiltration route for the data.
Conclusion
This was my first attempt at malware analysis. It took quite a bit of research and I learnt a lot along the way. I hope I can get my hands on more of theses and expand my knowledge some more, this is a major interest of mine within cybersecurity.
Last updated