Heartbreaker-Continuum

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Following a recent report of a data breach at their company, the client submitted a potentially malicious executable file. The file originated from a link within a phishing email received by a victim user. Your objective is to analyze the binary to determine its functionality and possible consequences it may have on their network. By analyzing the functionality and potential consequences of this binary, you can gain valuable insights into the scope of the data breach and identify if it facilitated data exfiltration. Understanding the binary's capabilities will enable you to provide the client with a comprehensive report detailing the attack methodology, potential data at risk, and recommended mitigation steps.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: curl, wget, powershell, strings, ghidra, cyberchef.
• Artifacts: memory.

Detailed Investigation

1. In this investigation case, we're tasked to reverse engineer a malicious executable file which originated from a link within an email identified as phising.
2. Once we gained valuable insights into the scope of the data breach, we're asked to provide the client with a comprehensive report detailing the attack methodology, potential data at risk, and a recommended mitigation steps (which we won't do in this writeup).

Basic File Check

1. Based from the evidence above, the binary is identified as a PE32 executable and likely written in .NET supported language such as C# or VB.NET.

1ST QUESTION --> ANS: REDACTED

1. One of the easiest way to identify whether a file is malicious or is a malware file, simply grab the IOC.

2. This time, I grab the sha256 hash. Afterwards, send it to threat intelligence tool to review the hash.

3. Both Virus Total and Kaspersky OpenTip shown that the file is indeed a malware categorized as Trojan.

4. Also both states that the binary acts as a downloader.

2ND QUESTION --> ANS: REDACTED

1. Next, to identify the creation timestamp, we can check the details section at virus total.

3RD QUESTION --> ANS: REDACTED

1. Using a decompiler such as ghidra, we can identify the maximum size of code of the binary in bytes.

NOTES:

The size of the code in a binary file refers to the total amount of space (in bytes) that is allocated for the actual
executable instructions within the program.

However, this does not include data segments (global / static variables), resources (image, icons), headers, and metadata.

1. To identify the code size in the binary file, simply go to window and open the memory map and check for the .text section length.

Another method --> simply check the sections in virus total under Details tab

1. Great! Now we know the size of code is 38400.

4TH QUESTION --> ANS: REDACTED

1. Interesting! It states that the binary may have undergone a conversion process and based on the question, the conversion act for the FILENAME.

2. Actually there are simple methods to identify it, by checking the details tab, go to the Dot Net Assembly, and check the Manifest Resource field.

3. Another method is to use PEStudio and check for the resource.

4. As you can see, both states the same filename.

5TH QUESTION --> ANS: REDACTED

1. Next, upon execute strings to identify readable strings from the binary. Found a what looks like a base64 encoded text.

2. Also the text later on decoded and an IEX is performed to naming an alias named ilY.

3. Interesting! Indeed the malware is using powershell script then, exactly like what we've identified for the original filename.

4. To identify the offset of which this obfuscated text, I used hexeditor and run grep for the initiliazed variable.

5. Nice, we identified the offset!

6TH QUESTION --> ANS: REDACTED

1. Base from the previous finding, we identified that the malware used Base64 to encode what might be it's exploit.

7TH QUESTION --> ANS: REDACTED

1. Anyway, we can simply decode it manually without revise the script, because it just encode the exploit and reversed it.

2. Let's wayback it using cyberchef.

3. Awesome! From now on should be easy for us, because the exploit is stop here, there are no other outbound connections which related to download another malware.

4. Long story short, after review the code, found the cmdlet used by the malware to initiate file downloads.

5. It used Invoke-WebRequest, this cmdlet in powershell is used to perform HTTP or HTTPS request to a web resources. In short, this cmdlet quite perform the same as curl and wget.

NOTE:

cmdlet (command-let) is a lightweight command used in powershell environment.

8TH QUESTION --> ANS: REDACTED

1. Previously we identified the attacker's server IP which used to infiltrate the malware via phising.
2. Then another IP IOC is identified at sftp command usage.
3. Interestingly it performed -hostkey=*/ which a method for hostkey bypass. This method allows the connection without verifying the hostkey.

9TH QUESTION --> ANS: REDACTED

1. Luckily the deobfuscated script has convential variable naming, reviewing the script at glance, we can quickly identified the specified target directory.

10TH QUESTION --> ANS: REDACTED

1. Based from MITRE page, autonomously gather data is defined as Automated Collection technique under Collection.

11TH QUESTION --> ANS: REDACTED

1. Again, based from our previous finding. The attacker seems tried to exfiltrate the collected files through sftp service using password M8&C!i6KkmGL1-#.
2. Great! We've investigated the case!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED
• 11TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Using PEStudio and Ghidra to identify size of code bytes.
2. Using threat intelligence tool to identify conversion filename and file creation time.
3. Using hexeditor to identify the obfuscated strings offset.
4. Identify MITRE ID for automated collection technique.