← Back to Writeups
HTBMediumSOC/DFIR
Bookmark

Anpu

D3v0o0Nu119/2/20262 min read
#soc/dfir#htb#medium

Anpu

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Johnny noticed something unusual on his phone after installing a new version of WhatsApp, such as tons of notifications, web pages opening, etc., and asked us to thoroughly investigate what had happened. Using various tools, we managed to extract a copy of the phone's data and discovered that the app he had installed was malicious and belonged to a well-known family of Android malware specializing in data theft. Now we need to analyze this malicious application and create a timeline for this case.

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source
—In this case.

Evidence Analysed

  • Tools: per the investigation narrative.
  • Artifacts: per the investigation narrative.

Detailed Investigation

  1. In this case.

1ST QUESTION -> ANS:

REDACTED

3RD QUESTION -> ANS:

REDACTED

5TH QUESTION -> ANS:

REDACTED

7TH QUESTION -> ANS:

REDACTED

9TH QUESTION -> ANS:

REDACTED

11TH QUESTION -> ANS:

REDACTED

13TH QUESTION -> ANS:

REDACTED

15TH QUESTION -> ANS:

REDACTED

Findings

  1. Persistence mechanism — As documented in the investigation steps.
  2. Initial access — As documented in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
ExfiltrationExfiltration Over C2 ChannelT1041

Answers / Flags

  • 1ST QUESTION -> ANS:REDACTED
  • 2ND QUESTION -> ANS:REDACTED
  • 3RD QUESTION -> ANS:REDACTED
  • 4TH QUESTION -> ANS:REDACTED
  • 5TH QUESTION -> ANS:REDACTED
  • 6TH QUESTION -> ANS:REDACTED
  • 7TH QUESTION -> ANS:REDACTED
  • 8TH QUESTION -> ANS:REDACTED
  • 9TH QUESTION -> ANS:REDACTED
  • 10TH QUESTION -> ANS:REDACTED
  • 11TH QUESTION -> ANS:REDACTED
  • 12TH QUESTION -> ANS:REDACTED
  • 13TH QUESTION -> ANS:REDACTED
  • 14TH QUESTION -> ANS:REDACTED
  • 15TH QUESTION -> ANS:REDACTED
  • 16TH QUESTION -> ANS:REDACTED

Lessons Learned

  1. Correlate artifacts across evidence sources to build a timeline.
  2. Map findings to MITRE ATT&CK techniques.
  3. Document IoCs for detection engineering.