challenge
This is a challenge from https://malops.io/challenges/sagerunex
Question 1
What is the exact compilation time of the malicious executable? (UTC)
Answer Format : ****-**-** **:**:**
2021-03-15 09:44:36 Open it in PE-BEAR or DIE and we can see timestamp be careful about DIE since it calculates on ur timezone not UTC
insert image here -> images/q1-01.png
**answer:**2021-03-15 09:44:36
loging_filename
Question 2
What is the exact filename used by the malware for logging its operations?
Answer Format : ***********
Open it in IDA and see export it has which is "MainEntry" after analysing that function we can see it uses
"TS_FB56.tmp" as name (0x18000663f)
insert image here -> images/q2-01.png
answer: TS_FB56.tmp
Question 3
What is the magic value used to validate the malware configuration before Answer Format : executing token impersonation? (HEX)
0x******
Since token impersonation is asked check imports and find "OpenProcessToken" go to xref to it and found exact location
which is at 0x180003294. Since it asked for "before" we can find xref to 0x180003294 and at "MainEntry" it check for 0xC91F3B (0x180006688)
insert image here -> images/q3-01.png
answer: 0xC91F3B
Question 4
What is the size (in bytes) of the XOR-obfuscated configuration data?
Answer Format : ****
Since we know v46 in MainEntry gonna hold configuration, we can track it and at "sub_1800061BC" call it xored insert image here -> images/q4-01.png insert image here -> images/q4-02.png
We can rename v46 as "configdata" and sub_1800061BC as mw_xor_. also retype configdata to hold 1888 byte insert image here -> images/q4-03.png
answer: 1888
Question 5
What process does the malware search for to steal access tokens?
Answer Format : ********.***
before jumping to this question we can prepare a configuration structure like this
struct ConfigData {
_BYTE padding_start[1356];
_DWORD magic;
_BYTE padding_end[528];
};
and retype configdata variable to ConfigData so it shows like that configdata.magic insert image here -> images/q5-01.png
we can track OpenProcessToken again and found sub_180003208 function which search for "explorer.exe"
insert image here -> images/q5-02.png
answer: explorer.exe
Question 6
What year does the malware set when timestomping files?
Answer Format : ****
File timestomping is a technique used by hackers and malware to secretly change the dates and times associated with a file to hide their tracks. And mostly SetFileTime is used, so if we track that call we can find the function
insert image here -> images/q6-01.png
answer: 2012
Question 7
What is the hardcoded fallback DNS server IP address used for public IP discovery?
Answer Format : *.*.*.*
For internet operations we should have a look to the WSAStartup or similar functions, follow WSAStartup from import and found it uses inet_addr and uses 8.8.8.8 as fallback DNS server.
insert image here -> images/q7-01.png
answer: 8.8.8.8
Question 8
What string does the malware log when the ICMP traceroute completes?
Answer Format : ***** *********
We can search in strings for "Trace" and found the answer.
insert image here -> images/q8-01.png
answer: Trace complete.
Question 9
What is the maximum total operation time (in minutes) for the C2 beacon loop?
Answer Format : ***
answer:
Question 10
How many C2 servers does the malware cycle through?
Answer Format : *
answer:
Question 11
What is the initial retry interval (in minutes) when C2 connection fails?
Answer Format : *
answer:
Question 12
What are the three command prefixes the malware recognizes for shell execution?
Answer Format : ******, ******, ***.*** /*
answer:
Question 13
What error message is returned for invalid rundll/runexe syntax?
Answer Format : ******* ***************
answer:
Question 14
What is the chunk size (in bytes) used for file exfiltration?
Answer Format : *****
answer:
Question 15
How many retry attempts are made for failed file chunk transfers?
Answer Format : *
answer:
Question 16
What registry path does the malware access for IE proxy settings?
Answer Format : \********\end withs\******** ********
answer:
Question 17
What SID pattern does the malware filter for when enumerating user registry hives?
Answer Format : *-*-*-**
answer:
Question 18
What Firefox configuration file does the malware parse for proxy settings?
Answer Format : ********
answer:
Question 19
Which user_pref keys does the malware target to extract the HTTPS proxy address?
Answer Format : *******.*****.***
answer:
Question 20
What log message indicates a successful C2 registration?
Answer Format : 0x**, ** *******.
answer:
Question 21
At what offset in the session structure are the C2 servers stored?
Answer Format : 0x****
answer:
Question 22
What is the offset for the work hour start time in the configuration?
Answer Format : 0x****
answer:
Question 23
What WinHTTP timeout value (in milliseconds) is used for ICMP traceroute?
Answer Format : ****
answer:
Question 24
What is the sleep duration (in milliseconds) when waiting outside work hours?
Answer Format : ******
answer:
Question 25
What functions control the work hour check in the beacon loop?
Answer Format : ************
answer:
Question 26
Describe in the config file path construction. What Windows API is used and what Answer Format : is the CSIDL value (decimal)?
***********************, **
answer:
