Analyze a sandbox report using Any.Run to identify Stealc malware behavior, extract configuration details, and map observed tactics to MITRE ATT&CK.
The accountant at the company received an email titled "Urgent New Order" from a client late in the afternoon. When he attempted to access the attached invoice, he discovered it contained false order information. Subsequently, the SIEM solution generated an alert regarding downloading a potentially malicious file. Upon initial investigation, it was found that the PPT file might be responsible for this download. Could you please conduct a detailed examination of this file?
Easy - Threat Intel | Completion Achievement
The provided file is just a single hash:
MD5 Hash: 12c1842c3ccafe7408c23ebf292ee3d9
Use this hash on online threat intel platforms (e.g., VirusTotal, Hybrid Analysis) to complete the lab analysis.
- Determining the creation time of the malware can provide insights into its origin. What was the time of malware creation?
Let's look up this MD5 hash on VirusTotal > Details > History.
- Identifying the command and control (C2) server that the malware communicates with can help trace back to the attacker. Which C2 server does the malware in the PPT file communicate with?
On the same VirusTotal page, navigate to Relations > Contacted URLs, and you will find some suspicious URLs. The first looks like a C2 server:
- Identifying the initial actions of the malware post-infection can provide insights into its primary objectives. What is the first library that the malware requests post-infection?
Let's navigate to the Behavior > Dropped Files section in the VirusTotal report. Since this question is asking for a 'library', we should expect something like a .dll file (dynamic-link library). The very first file that appears here appears to be the file we need:
- By examining the provided Any.run report, what RC4 key is used by the malware to decrypt its base64-encoded string?
Upon opening the provided Any.run report, we can just use CTRL+F to find the aforementioned RC4 key:
- By examining the MITRE ATT&CK techniques displayed in the Any.run sandbox report, identify the main MITRE technique (not sub-techniques) the malware uses to steal the user’s password.
Opening the provided Any.run sandbox report, we can click on the first process on the right pane (VPN.exe, PID: 3484) and read the process details. The very first described malicious action contains our answer:
- By examining the child processes displayed in the Any.run sandbox report, which directory does the malware target for the deletion of all DLL files?
The child process of the VPN.exe process contains our answer. This process describes a command executed with cmd.exe, and we can see all .dll files being deleted from a single directory:
- Understanding the malware's behavior post-data exfiltration can give insights into its evasion techniques. By analyzing the child processes, after successfully exfiltrating the user's data, how many seconds does it take for the malware to self-delete?
The answer is also in the cmd.exe displayed above. There is a timeout of 5 seconds between cmd.exe being initialized and the VPN.exe being deleted.