Malevolent ModMaker

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Bob, a senior software engineer at Acme Inc., was taking a break from correcting AI code to check in with his favorite gaming community. One of the newer members shared a new program that can make mods for a popular game. Eager to try new things, when he ran it as administrator (as instructed), all of his files were deleted and replaced! He immediately called the help desk, so they locked his machine and an incident response was called!

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: curl, powershell, strings, ghidra.
• Artifacts: dump.

Detailed Investigation

1. In this case, we were tasked with investigating an incident where, after a senior software engineer downloaded and executed a program advertised as a modding tool for popular games, it instead encrypted all of his files and deleted the originals.
2. The scope of the investigation is relatively small. We were specifically asked to analyze the malware based on a set of defined questions. The provided artifacts for analysis are shown in the red box below:

This time we are dealing with 64-bit golang-based downloader and ransomware.

• Downloader

• Ransomware

1ST QUESTION -> ANS: REDACTED

1. Based on the incident scenario and the provided artifacts, we can clearly attribute this malware infection to ransomware.

2ND QUESTION -> ANS: REDACTED

1. Instead of manually reviewing the source code, I chose to detonate the binary and observe what happens to the sandbox environment.
2. After detonating the malware (MCModMaker-v1.4.exe), a terminal window appeared showing a failed outbound POST request to Discord (its C2 server), which was attempted via a webhook.

3RD QUESTION -> ANS: REDACTED

1. To identify which commands were used to execute binaries and scripts, I manually debugged the sample in xDbg, pausing execution just before the webhook was called.

2. The simplest approach is to search for error strings or any other strings of interest. In this case, I focused on debugging-related terms, since earlier the malware printed error messages to the terminal when its outbound connection to the Discord webhook failed.

3. Filtering for the string discord in xDbg produced several hits. The bottom four entries are likely the most relevant to our analysis.

4. Inspect the offset then scrolled-up we can identify powerhsell -ep bypass is used to perform request with curl to several domains.

4TH QUESTION -> ANS: REDACTED

1. Based on our previous findings, we can clearly identify that hunnid[.]htb is the API used to perform geolocation enumeration, as it makes use of several parameters directly related to geolocation.

2. The API key is also presented in cleartext -> ZVBOKX3P8H7.

5TH QUESTION -> ANS: REDACTED

1. Continuing our analysis, after geolocation check is failed, the malware using powershell again to perform downloads for goteem.exe to goteem[.]htb. Which no doubt is the encryptor (based on the ransom notes and encrypted file's extension).
2. We can clearly state that goteem[.]htb is the C2 that serves for the ransomware.

6TH QUESTION -> ANS: REDACTED

1. Continuing the debug of the same binary, at offsets 0xD3426A3 and 0xD326AA, we observed errors related to JSON input.
2. From this, we can conclude that the C2 server’s response uses the content type application/json.

7TH QUESTION -> ANS: REDACTED

1. To test it, I placed the ransomware in a custom directory and added several files with common target extensions.

2. I executed the sample once but observed no activity. This suggests an error occurred—potentially an internal check or error-handling routine that prevented encryption.

3. I then tested it in another directory with unrestricted read/write access (C:\Users\Public), but still saw no activity.

4. While debugging in xDbg, at offset 0x6478E4 I observed output indicating that the malware had detected a .txt file in the Documents folder and successfully encrypted it. An interesting finding.

5. To verify this behavior, I copied all the previously tested files into Documents. The result confirmed that only the .txt file was encrypted, while the Office files remained untouched.

8TH QUESTION -> ANS: REDACTED

1. This behavior suggests that the encryptor may not have access to certain directories. By searching for error-handling related strings, I found references indicating that some directories were explicitly skipped.

9TH QUESTION -> ANS: REDACTED

1. Reviewing the decompiled main code binary in ghidra, the encryption algorithm seems using AES and the function call is crypto_aes_NewCipher.

10TH QUESTION -> ANS: REDACTED

1. Since the encryption logic relies on AES, the same key is used for both encryption and decryption. In Ghidra, these code blocks are the ones that need to be inspected to identify the key value.

2. Since the offsets differ, the easiest approach is to search for nearby strings such as Error: reading file. From there, I began analyzing the surrounding assembly instructions and correlating them with the decompiled code in Ghidra.

3. Set breakpoint at offset 0x3C72C0 then dollow dunmp value at offset 0x3C72A8. At the dump tab below, we can identify the decryption key.

11TH QUESTION -> ANS: REDACTED

1. Using bruh.exe together with the identified decryption key, we can clearly identify the project name as AI Coding Chatbot.

bruh.exe -key REDACTED

1. We've finished briefly analysed the malware!

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — As documented in the investigation steps.
3. Impact — Data was stolen / systems impacted as described in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION -> ANS: REDACTED
• 2ND QUESTION -> ANS: REDACTED
• 3RD QUESTION -> ANS: REDACTED
• 4TH QUESTION -> ANS: REDACTED
• 5TH QUESTION -> ANS: REDACTED
• 6TH QUESTION -> ANS: REDACTED
• 7TH QUESTION -> ANS: REDACTED
• 8TH QUESTION -> ANS: REDACTED
• 9TH QUESTION -> ANS: REDACTED
• 10TH QUESTION -> ANS: REDACTED
• 11TH QUESTION -> ANS: REDACTED

Lessons Learned

1. Reverse Engineering Golang-based Ransoware.
2. Dynamic binary analysis using x64dbg.
3. Static binary analysis using DiE and Ghidra.