Loggy

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

(No scenario in source writeup.)

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: strings, ghidra, ida.
• Artifacts: per the investigation narrative.

Detailed Investigation

1. In this case, the SOC notified a credential leak involving a user from the accounting division named Janice.
2. The credentials were found on the dark web by the threat intelligence team.
3. Afterward, the SOC team successfully recovered some files from her machine and sent them to the REM analyst.
4. As Reverse Engineering Malware (REM) Analyst, we are tasked with further investigating this case.

INSIDE ZIP FILE

1ST QUESTION --> ANS: REDACTED

1. For our initial analysis, let's load the hash to threat intelligence tool so we obtain additional info regarding this file.

2. Based on the result, the file marked as malicious by few security vendors and reviewing the details section, we can identify that the malware is compiled with Golang compiler.

Using DIE.

NOTE:

DIE also can be used to identify the binary's programming language, compiler,
and it's packer (general packer).

1. Checking the graph representation, it is known there are 4 contacted domains and most of them are to microsoft. It could indicate a windows API usage for network communication.

2ND QUESTION --> ANS: REDACTED

1. Baseed on our previous identification, we know that we are dealing with golang binary. To identify the compiler version, we can just strings the binary and filter for go1.

3RD QUESTION --> ANS: REDACTED

1. Next, to identify imported github repo, I used ghidra to decompile the binary.

GHIDRA

1. Found 5 github repos and by logic the repo used for data exfiltration should be jlaffaye's repo. However to prove our assumption, we can investigate each repos since the repo's path is visible to us. (no one knows, the repo might be named different than it's actual purpose).

1. Based on the evidence above, we can much conclude github likely used to exfiltrate data should be from user jlaffaye (using File Transfer Protocol). Another convincing evidence is function usage related to FTP for handling files.

4TH QUESTION --> ANS: REDACTED

1. Again, it's clear the mentioned dependency should be github.com/kbinani/screenshot.

5TH QUESTION --> ANS: REDACTED

1. Now, to identify which function is used by the malware to create a file after execution, we need to list all the available functions.
2. Since it's related to file creation at windows, the function should be related to Windows API function.
3. We are gonna implement 2 ways to identify it, in static way we can simply load the binary to PESTUDIO, in dynamic way we need to monitor the Windows API function call using apmx.

PESTUDIO

1. Based on the evidence above, a WriteFile function which is part of Kernel32.dll is called. Let's try to monitor it using apmx.

NOTE:

Don't forget to filter for WriteFile function call first.

1. Nice, we can see that the WriteFile is called. Reviewing the hexdump on one of the summary. We can identify a PNG file signature.

2. Meaning the malware just created a PNG file.

3. Upon checking the malware's binary path, we can identify newly created screenshot image file.

4. It captured our activity at API Monitor. Knowing this, then WriteFile is the function abused by malware to create a file.

6TH QUESTION --> ANS: REDACTED

1. There are ways to identify the domain name used by the threat actor to exfiltrate data. We can just using strings and filter for FTP port or using GoReSym plugin with at Binary Ninja.
2. But at this investigation I used strings only, because my Binary Ninja is licensed free 😭

USING STRINGS

7TH QUESTION --> ANS: REDACTED

1. For this one, I used IDA to have better readability, because my ghidra seems failed to give me better readability for golang binary.

2. Long story short, upon reviewing the main_sendFilesViaFTP() function, we can identify a credential before the login() function call.

3. Great! Now we identified the threat actor's credential.

8TH QUESTION --> ANS: REDACTED

1. Next, to identify file that keeps getting written to the disk. Simply follow the graph and KEYLOG.TXT file is created twice with CreateFile() API function call.

9TH QUESTION --> ANS: REDACTED

1. To identify Janice's password, we can check the keylog.txt file which contains Janice's keystrokes.

10TH QUESTION --> ANS: REDACTED

1. Based on the evidence given to us, it is clear that Janice opened Solitaire when she ran the malware.

2. Great! We've investigated the case!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Using Ghidra, ANY.RUN, and Detect It Easy (DIE) to identify Programming Language used by the Malware.
2. Using PE Studio and API Monitor to identify Malicious Function Call.
3. Identify the FTP domain Used for Data Exfiltration.
4. Review IDA graph to identify file keeps written onto the disk.