BRabbit Lab
Level: Medium
Last updated
Was this helpful?
Level: Medium
Last updated
Was this helpful?
In this challenge, we were provided with a .eml file, accompanied by a compelling warning—this case is based on a real ransomware incident.
By analyzing the email header, we can identify both the sender and receiver of the email, providing key insights into its origin and delivery path.
By uploading the provided file to VirusTotal, we can observe that it is classified under specific malware family labels, as shown in the image below.
Since the key question revolves around execution, our next step is to analyze the email attachment to identify the file dropped by the malware. Upon examining the email, we can see that it includes an .exe file, as shown in the image below.
After obtaining the sample, I used the strings command to extract readable characters. To refine the results based on the provided clue, I applied regex to filter and limit the output, making the analysis more efficient.
Using the above method, we can uncover the persistence mechanisms employed by the malware, helping us understand how it maintains access to the system.
By using Any.Run to monitor the processes created by the malware, we can see that it generates two new scheduled tasks. These tasks are designed to execute the malware’s behavior, ensuring its persistence and continued activity on the system.
dispci.exe displayed a suspicious message upon execution, urging users to disable their defenses. This tactic aimed to evade detection and enable the ransomware's full execution. What suspicious message was displayed in the Console upon executing this binary?By checking the dropped file on VirusTotal, we can obtain its hash. Using this hash in Any.Run, we can analyze its execution and observe what appears in the command prompt (cmd) during the malware's activity.
As shown in the provided image, we can identify the installation path of the driver file. To further analyze it, we retrieve its hash and check it on VirusTotal for additional threat intelligence.
I leveraged MITRE ATT&CK to gather more insights about this malware and its associated threat actor.
By utilizing information from MITRE ATT&CK, we can identify the techniques used by the malware.
By using a conversion tool, we can extract the attachment and analyze it further. After extraction, the downloaded file is named application.bin, which is another alias for the attached executable. We then upload this file to VirusTotal for further inspection.
By analyzing the dropped files section and considering the provided clue, a character resembling the letter ‘i’, we can swiftly pinpoint the relevant file. Additionally, another method I used was leveraging to analyze the attached file for further insights.
To extract strings from the dropped file, we first need to obtain the sample. For this, I used Any.Run. In the process , under the modules section, we can retrieve the sample for further analysis.
Following the framework, we can identify the technique used in this attack. To pinpoint the sub-technique, I searched within MITRE ATT&CK under the Application Layer Protocol category, using the keyword web protocols to refine the results.
To solve this challenge, I referred to an about this malware, gaining insights that helped in understanding its behavior and techniques.
