Lupin

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

After a security incident, unusual activity on Samira’s workstation led to the discovery of a suspicious binary operating stealthily in the background. The executable evades standard detection while maintaining persistence and network communication. Your mission is to reverse the binary and extract the attacker’s TTPs for the endpoint security team.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: per the investigation narrative.
• Artifacts: per the investigation narrative.

Detailed Investigation

1ST QUESTION -> ANS: REDACTED

2ND QUESTION -> ANS: REDACTED

3RD QUESTION -> ANS: REDACTED

4TH QUESTION -> ANS: REDACTED

5TH QUESTION -> ANS: REDACTED

6TH QUESTION -> ANS: REDACTED

7TH QUESTION -> ANS: REDACTED

8TH QUESTION -> ANS: REDACTED

9TH QUESTION -> ANS: REDACTED

10TH QUESTION -> ANS: REDACTED

11TH QUESTION -> ANS: REDACTED

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION -> ANS: REDACTED
• 2ND QUESTION -> ANS: REDACTED
• 3RD QUESTION -> ANS: REDACTED
• 4TH QUESTION -> ANS: REDACTED
• 5TH QUESTION -> ANS: REDACTED
• 6TH QUESTION -> ANS: REDACTED
• 7TH QUESTION -> ANS: REDACTED
• 8TH QUESTION -> ANS: REDACTED
• 9TH QUESTION -> ANS: REDACTED
• 10TH QUESTION -> ANS: REDACTED
• 11TH QUESTION -> ANS: REDACTED

Lessons Learned

1. Phorpiex malware family analysis, focusing on behavior and execution flow.
2. Reverse engineering clipboard hijacking techniques, identifying how address replacement logic works.
3. Static analysis using IDA, Ghidra, and Detect It Easy (DiE) for code navigation, function tracing, and basic binary inspection.