Lupin Sherlock Malware Analysis

Sherlock Scenario

After a security incident, unusual activity on Samira’s workstation led to the discovery of a suspicious binary operating stealthily in the background. The executable evades standard detection while maintaining persistence and network communication. Your mission is to reverse the binary and extract the attacker’s TTPs for the endpoint security team.

Task 1: What is the entropy value of the executable file?

I opened the file in DIE (Detect It Easy) to analyze its entropy, which helps malware analysts determine if a binary is packed:

So, the answer is: 6.41450.

Let’s begin the Advanced Static Analysis.

Task 2: What is the consistent filename used by the malware when replicating itself across different locations?

In this image, we can see the call to GetModuleFileNameW(), which gets the full path of the current module.

Then, PathFindFileNameW() takes the full file path and returns a pointer to the filename, which is then passed to wsprintfW() to build a new full path.

Afterwards, the malware attempts to delete its original binary, rename itself to syscrondvr.exe, and establish persistence in the registry Run keys to start automatically.

So, the answer is: syscrondvr.exe.

Task 3: Following filename verification, which Win32 API does the binary use to enforce region-based execution constraints?

Looking at the previous image, if the file finds syscrondvr.exe, it proceeds to execute the function sub_40EA40.

This function checks if the system’s locale is Ukraine (UKR). It returns 0 if the system is NOT in Ukraine, and 1 if it is, allowing the malware to avoid infecting systems in Ukraine. The Win32 API used for this check is GetLocaleInfoA.

So, the answer is: GetLocaleInfoA.

Task 4: The function at relative address 0x407680 makes a WinAPI call immediately before initiating the network request. Which WinAPI function does it call to ensure fresh data is retrieved from the C2 server?

When I jumped to the address mentioned in the task (0x407680), I found a call to DeleteUrlCacheEntry:

This function is often used to clear cache/remove evidence of communication, or to force a new request to the C2 server to fetch fresh commands rather than reading cached data.

So, the answer is: DeleteUrlCacheEntry.

Task 5: Samira noticed unusual behavior during the paste operation — what is the relative address of the function that is responsible for this strange activity?

From the import section, we can see that the malware uses clipboard functions:

It monitors the clipboard and steals any text the user copies, specifically targeting cryptocurrency addresses.

So, the address is: 0x405B90.

Task 6: Which Windows message serves as the primary trigger for initiating the clipboard content?

By analyzing the clipboard monitoring function, we can find the message used as a trigger:

So, the answer is: WM_DRAWCLIPBOARD.

Task 7: What is the relative address of the function used to modify Samira’s clipboard content by replacing it with new data?

Looking at this function, we can see that it attempts to identify the copied cryptocurrency wallet address and replace it:

So, the address is: 0x404A60.

Task 8: A transaction was made from “jamilaaidos.eth”; what is the transaction hash associated with the user latest operation?

After analyzing the clipboard replacement function, we can identify the attacker’s wallet address:

Performing OSINT on this wallet leads us to the Etherscan page: https://etherscan.io/address/0x46e5cc402bc848cec9f4d65c9b48ae7d7a24821b

We can also get the address of jamilaaidos.eth (0x75D4A4B37177c92B26D7563fbB7EF4758fE9aa03), which allows us to find the transaction hash on-chain:

So, the answer is: 0xab2d474dad344da1e3b7ece6e7022c3295c52b176978337be82288a59e5a2a40.

Task 9: What specific multicast IP address is targeted by the SSDP M-SEARCH discovery probes?

Looking at the SSDP function, we can see the targeted multicast IP address:

So, the answer is: 239.255.255.250.

Task 10: What standard UDP port number is used for the SSDP M-SEARCH discovery requests?

From the same function call, we can determine the UDP port used:

So, the answer is: 1900.

Task 11: What is the malware family associated with the malware?

By performing threat intelligence queries on the indicators discovered during our investigation, such as the C2 IP 185.156.72.39 and the dropped filename syscrondvr.exe, we find that this malware is related to the Phorpiex malware family.