PepoRoot

Foreigner Sherlock Malware Analysis

Thu, 20 Aug 2026 19:01:58 +0000

Foreigner Sherlock Malware Analysis

Sherlock Scenario

An organization has requested assistance after a user followed instructions from a website claiming their system required an urgent fix. The site prompted the user to manually execute several commands to resolve the issue. Shortly afterward, the workstation began exhibiting suspicious behavior, including the execution of unknown processes and unexpected outbound network communications. The organization requires your help to analyze the provided artifacts.

Task 1 What compiler timestamp is embedded in the malware binary? (UTC)

I opened the file with PEstudio and checked the compiler timestamp (stamp > compiler) to find the answer.

Answer: 2089-10-01 03:41:58

Task 2 What is the name of the suspicious packed section found in the executable?

I opened the file with DIE (Detect It Easy) and identified the following section:

The malware checks whether this section exists before performing any operations.

When new Publisher runs, C# creates the object in memory and automatically executes any code written inside its constructor.

Answer: .CSS

Task 3 Which encryption algorithm is used by the malware?

After inspecting the Publish class:

We can see that the DeleteSentence method accepts 4 parameters:

inputData: The encrypted input data.
inputDataLength: The length of the encrypted data.
decryptionKey: The decryption key.
keyLength: The length of the decryption key.

Additionally, a second DeleteSentence call is made to decrypt the malicious section that the program checks before entering the Publisher method.

If we look inside the DeleteSentence method, we find the following logic:

It initializes an array of 256 bytes filled with values from 0 to 255 in linear order. It also repeats the key Sygcydy across a second array to match the 256-byte length (indicative of the RC4 Key Scheduling Algorithm).

Let’s examine the result of this decryption. The first output is:

And the second is:

Answer: RC4

Task 4 Which WinAPI function is leveraged to execute the shellcode?

When analyzing the imported APIs, we see two critical calls: first, VirtualProtect, and second, CallWindowProcA.

VirtualProtect modifies the permissions of the memory region holding the decrypted inputData to PAGE_EXECUTE_READWRITE. This is necessary because heap memory is allocated with read/write permissions (PAGE_READWRITE) by default, which prevents shellcode execution.

CallWindowProcA is then used to transfer the execution flow directly to the decrypted shellcode residing in memory.

This technique is known as Callback Execution, which malware developers often use to evade EDR (Endpoint Detection and Response) detection.

Answer: CallWindowProcA

Task 5 Which process is targeted by the shellcode for injection?

Answer: msbuild.exe

This is the decrypted data extracted from memory for inputData. It contains several API calls and the path to MSBuild.exe.

Task 6 What technique is used to execute the second-stage payload?

Analyzing the extracted input data from memory reveals the process hollowing steps:

CreateProcess launches a new MSBuild.exe process (C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe) in a suspended state.
VirtualAllocEx allocates a new block of executable memory inside the target process.
WriteProcessMemory copies the decrypted malicious shellcode into the allocated memory space.
GetThreadContext reads the target process’s registers to prepare to alter the execution entry point.
SetThreadContext overwrites the entry point register inside the suspended MSBuild.exe to point directly to the base address of the newly injected payload.
ResumeThread wakes up the suspended MSBuild.exe process, executing the payload.

Answer: process hollowing

Task 7 Which Computer name does the second-stage malware check for to evade analysis environments? (lowercase)

This check is located in the startup function. The malware checks for the sequence j o e h 9. If it detects this sequence, it terminates execution. This is shorthand for JohnDoe (username) and HAL9TH (computer name), which are hardcoded default system values used by Microsoft Defender’s emulation and sandbox environments.

Answer: hal9th

Task 8 What string does the second-stage malware register to prevent multiple executions on the same host? (Format lowercase: string)

By debugging the malware and tracing the event creation APIs (such as OpenEventA), we find the following registration string:

Answer: approve_april

Task 9 Which function address initializes the malware’s internal string structure by setting the fields to zero?

This initialization function is called frequently throughout the code. Examining its disassembly:

Answer: 0x40f3b0

Task 10 Besides FileZilla, which other file transfer client is targeted for credential extraction?

As shown in the disassembly, the malware targets WinSCP (a free, open-source file manager and transfer client for Microsoft Windows) to extract stored credentials.

Answer: winscp

Task 11 What is the function address that starts crawling the Steam process by acquiring its handle?

When searching for references to steam.exe:

The function sub_411250 searches all currently running processes on the system to locate a process matching steam.exe.

Once found, it passes control to sub_40ee70, which acts as a memory stealer targeting Steam authentication tokens.

Answer: 0x40ee70

Task 12 What type of authentication artifact does the second-stage malware search for in Steam’s process memory?

By converting the extracted hex values to ASCII using CyberChef, we can see the target token type:

Answer: JWT

Task 13 What unique hardcoded identifier does this second-stage malware instance use to identify itself during data exfiltration?

Analyzing the exfiltration routine shows the following hardcoded campaign/bot identifier:

Answer: ee4724586a69cda3db87344f07509f40

Task 14 What special marker string did the second-stage malware use in the Discord crawling process?

Searching for Discord-related token extraction logic:

Answer: dQw4w9WgXcQ

Task 15 Which messaging platform does the second-stage malware exfiltrate stolen data to?

Answer: telegram

References

Lupin Sherlock Malware Analysis

Wed, 08 Jul 2026 23:47:00 +0000

Lupin Sherlock Malware Analysis

Sherlock Scenario

After a security incident, unusual activity on Samira’s workstation led to the discovery of a suspicious binary operating stealthily in the background. The executable evades standard detection while maintaining persistence and network communication. Your mission is to reverse the binary and extract the attacker’s TTPs for the endpoint security team.

Task 1: What is the entropy value of the executable file?

I opened the file in DIE (Detect It Easy) to analyze its entropy, which helps malware analysts determine if a binary is packed:

So, the answer is: 6.41450.

Let’s begin the Advanced Static Analysis.

Task 2: What is the consistent filename used by the malware when replicating itself across different locations?

In this image, we can see the call to GetModuleFileNameW(), which gets the full path of the current module.

Then, PathFindFileNameW() takes the full file path and returns a pointer to the filename, which is then passed to wsprintfW() to build a new full path.

Afterwards, the malware attempts to delete its original binary, rename itself to syscrondvr.exe, and establish persistence in the registry Run keys to start automatically.

So, the answer is: syscrondvr.exe.

Task 3: Following filename verification, which Win32 API does the binary use to enforce region-based execution constraints?

Looking at the previous image, if the file finds syscrondvr.exe, it proceeds to execute the function sub_40EA40.

This function checks if the system’s locale is Ukraine (UKR). It returns 0 if the system is NOT in Ukraine, and 1 if it is, allowing the malware to avoid infecting systems in Ukraine. The Win32 API used for this check is GetLocaleInfoA.

So, the answer is: GetLocaleInfoA.

Task 4: The function at relative address 0x407680 makes a WinAPI call immediately before initiating the network request. Which WinAPI function does it call to ensure fresh data is retrieved from the C2 server?

When I jumped to the address mentioned in the task (0x407680), I found a call to DeleteUrlCacheEntry:

This function is often used to clear cache/remove evidence of communication, or to force a new request to the C2 server to fetch fresh commands rather than reading cached data.

So, the answer is: DeleteUrlCacheEntry.

Task 5: Samira noticed unusual behavior during the paste operation — what is the relative address of the function that is responsible for this strange activity?

From the import section, we can see that the malware uses clipboard functions:

It monitors the clipboard and steals any text the user copies, specifically targeting cryptocurrency addresses.

So, the address is: 0x405B90.

Task 6: Which Windows message serves as the primary trigger for initiating the clipboard content?

By analyzing the clipboard monitoring function, we can find the message used as a trigger:

So, the answer is: WM_DRAWCLIPBOARD.

Task 7: What is the relative address of the function used to modify Samira’s clipboard content by replacing it with new data?

Looking at this function, we can see that it attempts to identify the copied cryptocurrency wallet address and replace it:

So, the address is: 0x404A60.

Task 8: A transaction was made from “jamilaaidos.eth”; what is the transaction hash associated with the user latest operation?

After analyzing the clipboard replacement function, we can identify the attacker’s wallet address:

Performing OSINT on this wallet leads us to the Etherscan page: https://etherscan.io/address/0x46e5cc402bc848cec9f4d65c9b48ae7d7a24821b

We can also get the address of jamilaaidos.eth (0x75D4A4B37177c92B26D7563fbB7EF4758fE9aa03), which allows us to find the transaction hash on-chain:

So, the answer is: 0xab2d474dad344da1e3b7ece6e7022c3295c52b176978337be82288a59e5a2a40.

Task 9: What specific multicast IP address is targeted by the SSDP M-SEARCH discovery probes?

Looking at the SSDP function, we can see the targeted multicast IP address:

So, the answer is: 239.255.255.250.

Task 10: What standard UDP port number is used for the SSDP M-SEARCH discovery requests?

From the same function call, we can determine the UDP port used:

So, the answer is: 1900.

Task 11: What is the malware family associated with the malware?

By performing threat intelligence queries on the indicators discovered during our investigation, such as the C2 IP 185.156.72.39 and the dropped filename syscrondvr.exe, we find that this malware is related to the Phorpiex malware family.