Lupin Sherlock Malware Analysis
Technical analysis of the Lupin malware Sherlock challenge.
Foreigner Sherlock Malware Analysis
Sherlock Scenario
An organization has requested assistance after a user followed instructions from a website claiming their system required an urgent fix. The site prompted the user to manually execute several commands to resolve the issue. Shortly afterward, the workstation began exhibiting suspicious behavior, including the execution of unknown processes and unexpected outbound network communications. The organization requires your help to analyze the provided artifacts.
Task 1 What compiler timestamp is embedded in the malware binary? (UTC)
I opened the file with PEstudio and checked the compiler timestamp (stamp > compiler) to find the answer.
Answer: 2089-10-01 03:41:58
Task 2 What is the name of the suspicious packed section found in the executable?
I opened the file with DIE (Detect It Easy) and identified the following section:
The malware checks whether this section exists before performing any operations.
When new Publisher runs, C# creates the object in memory and automatically executes any code written inside its constructor.
Answer: .CSS
Task 3 Which encryption algorithm is used by the malware?
After inspecting the Publish class:
We can see that the DeleteSentence method accepts 4 parameters:
inputData: The encrypted input data.inputDataLength: The length of the encrypted data.decryptionKey: The decryption key.keyLength: The length of the decryption key.
Additionally, a second DeleteSentence call is made to decrypt the malicious section that the program checks before entering the Publisher method.
If we look inside the DeleteSentence method, we find the following logic:
It initializes an array of 256 bytes filled with values from 0 to 255 in linear order. It also repeats the key Sygcydy across a second array to match the 256-byte length (indicative of the RC4 Key Scheduling Algorithm).
Let’s examine the result of this decryption. The first output is:
And the second is:
Answer: RC4
Task 4 Which WinAPI function is leveraged to execute the shellcode?
When analyzing the imported APIs, we see two critical calls: first, VirtualProtect, and second, CallWindowProcA.
VirtualProtect modifies the permissions of the memory region holding the decrypted inputData to PAGE_EXECUTE_READWRITE. This is necessary because heap memory is allocated with read/write permissions (PAGE_READWRITE) by default, which prevents shellcode execution.
CallWindowProcA is then used to transfer the execution flow directly to the decrypted shellcode residing in memory.
This technique is known as Callback Execution, which malware developers often use to evade EDR (Endpoint Detection and Response) detection.
Answer: CallWindowProcA
Task 5 Which process is targeted by the shellcode for injection?
Answer: msbuild.exe
This is the decrypted data extracted from memory for inputData. It contains several API calls and the path to MSBuild.exe.
Task 6 What technique is used to execute the second-stage payload?
Analyzing the extracted input data from memory reveals the process hollowing steps:
CreateProcesslaunches a newMSBuild.exeprocess (C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe) in a suspended state.VirtualAllocExallocates a new block of executable memory inside the target process.WriteProcessMemorycopies the decrypted malicious shellcode into the allocated memory space.GetThreadContextreads the target process’s registers to prepare to alter the execution entry point.SetThreadContextoverwrites the entry point register inside the suspendedMSBuild.exeto point directly to the base address of the newly injected payload.ResumeThreadwakes up the suspendedMSBuild.exeprocess, executing the payload.
Answer: process hollowing
Task 7 Which Computer name does the second-stage malware check for to evade analysis environments? (lowercase)
This check is located in the startup function. The malware checks for the sequence j o e h 9. If it detects this sequence, it terminates execution. This is shorthand for JohnDoe (username) and HAL9TH (computer name), which are hardcoded default system values used by Microsoft Defender’s emulation and sandbox environments.
Answer: hal9th
Task 8 What string does the second-stage malware register to prevent multiple executions on the same host? (Format lowercase: string)
By debugging the malware and tracing the event creation APIs (such as OpenEventA), we find the following registration string:
Answer: approve_april
Task 9 Which function address initializes the malware’s internal string structure by setting the fields to zero?
This initialization function is called frequently throughout the code. Examining its disassembly:
Answer: 0x40f3b0
Task 10 Besides FileZilla, which other file transfer client is targeted for credential extraction?
As shown in the disassembly, the malware targets WinSCP (a free, open-source file manager and transfer client for Microsoft Windows) to extract stored credentials.
Answer: winscp
Task 11 What is the function address that starts crawling the Steam process by acquiring its handle?
When searching for references to steam.exe:
The function sub_411250 searches all currently running processes on the system to locate a process matching steam.exe.
Once found, it passes control to sub_40ee70, which acts as a memory stealer targeting Steam authentication tokens.
Answer: 0x40ee70
Task 12 What type of authentication artifact does the second-stage malware search for in Steam’s process memory?
By converting the extracted hex values to ASCII using CyberChef, we can see the target token type:
Answer: JWT
Task 13 What unique hardcoded identifier does this second-stage malware instance use to identify itself during data exfiltration?
Analyzing the exfiltration routine shows the following hardcoded campaign/bot identifier:
Answer: ee4724586a69cda3db87344f07509f40
Task 14 What special marker string did the second-stage malware use in the Discord crawling process?
Searching for Discord-related token extraction logic:
Answer: dQw4w9WgXcQ
Task 15 Which messaging platform does the second-stage malware exfiltrate stolen data to?
Answer: telegram