LetsDefend - Downloader#

Start Investigation#

What is the address of the function “main”? Answer Format: 0x000000000

First, I used DIE to detect which compiler was used to make this malware which is Microsoft Visual C/C++ which mean we might need to use Ghidra or IDA to conduct malware analysis of this binary file.

To make life easier, disassembly this binary in IDA and it will automatically detect main function for us and here is where we get an address of all functions in IDA.

1
0x140001170

What is the end address of the .text section? Answer Format: 0x000000000

Go to “View” -> “Toolbars” -> “Segments” which will display segments button in toolbars then after press it, it will display all segments of this binary including start and end offset of each section.

1
0x140007000

What is the IP address used to download the payload?

As you might noticed, there are some function declaration in main which are

• C2 IP address
• User-agent
• filename that will be downloaded

And we also see WinHTTPOpen will be called so this binary will connect to C2 address on port 80 with defined User-agent to download defined filename from that server.

1
45.249.93.80

What is the name of the payload downloaded?

1
payload.bin

What is the name of the user agent used by the downloader?

1
WinHTTP Example/1.0

What is the name of the DLL loaded by the downloader?

We can also see that after downloaded a file from C2 server, this dll was loaded then VirtualProtect was called to change memory protection of specific region of memory probably to allow writing file.

1
dbghelp.dll

What is the first API used during the function that retrieves data from the HTTP response?

After reversing these 2 functions, here are the result

And the first API that was used in a function that retrieves data from the HTTP response is this API

1
WinHttpReceiveResponse

What is the name of the function that establishes the HTTP request?

Here is a function responsible for HTTP request, you can see WinHTTPConnect and WinHTTPOpenRequest being called here.

1
sub_140001000

Summary#

On this challenge, we investigated windows binary file with IDA freeware to uncover C2 server and a payload that will be downloaded to infected system.