================================================================================ STRINGS EXTRACTION OUTPUT — CTF Blue Team Lesson 03 Malware Detection & Classification ================================================================================ SAFETY NOTE: This file contains simulated strings output for training purposes only. No actual malware code is included. ================================================================================ Source File: svchost_update.exe Tool: strings -n 6 svchost_update.exe Total Strings: 847 extracted (showing selected output below) ================================================================================ --- STANDARD WINDOWS API REFERENCES (may appear in legitimate software) --- kernel32.dll ntdll.dll advapi32.dll user32.dll ws2_32.dll GetProcAddress LoadLibraryA LoadLibraryW GetModuleHandleA GetSystemDirectoryA GetTempPathA GetWindowsDirectoryA GetVersionExA CreateFileA ReadFile WriteFile CloseHandle ExitProcess GetLastError Sleep GetTickCount SetFileAttributesA CopyFileA DeleteFileA MoveFileExA FindFirstFileA FindNextFileA --- NETWORK-RELATED STRINGS --- WSAStartup socket connect send recv gethostbyname inet_addr closesocket InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA InternetReadFile wininet.dll WinHttpOpen WinHttpConnect WinHttpSendRequest --- SUSPICIOUS: PROCESS MANIPULATION APIs --- CreateRemoteThread VirtualAllocEx WriteProcessMemory OpenProcess NtUnmapViewOfSection ZwQueryInformationProcess RtlCreateUserThread VirtualProtectEx ReadProcessMemory NtWriteVirtualMemory IsDebuggerPresent CheckRemoteDebuggerPresent NtQueryInformationProcess OutputDebugStringA --- SUSPICIOUS: COMMAND EXECUTION --- cmd.exe /c del "%s" >> NUL cmd.exe /c ping 127.0.0.1 -n 3 > NUL && del "%s" powershell -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHM powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\update.ps1" /c schtasks /create /tn "SystemHealthCheck" /tr "%s" /sc ONLOGON /rl HIGHEST wmic process call create wscript.exe //B //Nologo "%TEMP%\helper.vbs" bitsadmin /transfer systemupdate /download /priority high --- SUSPICIOUS: PERSISTENCE MECHANISMS --- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKLM\SYSTEM\CurrentControlSet\Services SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run RegOpenKeyExA RegSetValueExA RegCreateKeyExA --- SUSPICIOUS: C2 COMMUNICATION --- http://c2.badactor.xyz/beacon http://c2.badactor.xyz/upload http://c2.badactor.xyz/cmd http://c2.badactor.xyz/exfil POST /gate.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Type: application/x-www-form-urlencoded Host: update-service.definitelylegit.com http://185.234.72.19:8443/checkin https://pastebin.com/raw/Xk9mQ7pL GET /config.bin HTTP/1.1 --- SUSPICIOUS: ENCODED/OBFUSCATED DATA BLOCKS --- TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAGAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9 Z3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NJAAAAAAA aHR0cDovL2V2aWwtYzIuc2VydmVyLnh5ei9zdGFnZTIuZXhl UEsDBBQAAAAIALRiY1kAAAAACgAAAA8AAAB0ZXN0X3BheWxvYWQudHh0 SwECFAAUAAAACAAAALRiY1kAAAAACgAAAA8AAAAAAAAAAAAAAAAAAAA 4d5a90000300000004000000ffff0000b800000000000000400000000000 0000000000000000000000000000000000000000000000f00000000e1fba --- SUSPICIOUS: IRC CHANNEL REFERENCE --- NICK bot_%COMPUTERNAME% JOIN #malware-control PRIVMSG #malware-control :CHECKIN|%COMPUTERNAME%|%USERNAME%|%OS% PRIVMSG #malware-control :READY PING :irc.undernet-servers.example.net PONG :irc.undernet-servers.example.net MODE #malware-control +s PART #malware-control --- FILE PATHS AND TEMP LOCATIONS --- %TEMP%\svchost_update.exe %TEMP%\update.ps1 %TEMP%\helper.vbs %APPDATA%\Microsoft\Windows\svchost.dat %PROGRAMDATA%\WindowsUpdate\config.ini C:\Windows\System32\svchost.exe %LOCALAPPDATA%\Temp\~DF4A2B.tmp %USERPROFILE%\Documents\*.docx %USERPROFILE%\Documents\*.xlsx %USERPROFILE%\Documents\*.pdf %USERPROFILE%\Desktop\*.docx --- MUTEX / NAMED OBJECTS --- Global\SvcHostUpdateMutex_7B2F Global\WindowsSystemHealthCheck Local\ShellExperienceHost_Mutex --- ANTI-ANALYSIS STRINGS --- vmware virtualbox vbox qemu sandboxie wireshark.exe procmon.exe procexp.exe ollydbg.exe x64dbg.exe ida.exe SbieDll.dll sbiedll.dll wine_get_unix_file_name --- MISCELLANEOUS --- ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ 0123456789ABCDEF [%04d-%02d-%02d %02d:%02d:%02d] [INFO] Beacon success [ERROR] Connection failed, retry in %d seconds [DEBUG] Payload size: %d bytes Encrypted payload decrypted successfully Config loaded from C2 Target acquired: %s Exfiltration complete: %d files, %d bytes ================================================================================ ANALYSIS NOTES ================================================================================ Key indicators identified in strings output: 1. Process injection APIs (CreateRemoteThread, VirtualAllocEx, WriteProcessMemory) 2. C2 communication URLs (c2.badactor.xyz, 185.234.72.19:8443) 3. Persistence via registry Run keys and scheduled tasks 4. Anti-analysis/VM detection strings 5. IRC-based C2 fallback channel (#malware-control) 6. Base64-encoded data blocks (likely embedded payloads) 7. Document file enumeration (*.docx, *.xlsx, *.pdf) suggesting data theft 8. Self-deletion mechanism (cmd.exe /c del with ping delay) CHALLENGE: Categorize each string group by MITRE ATT&CK technique ID. Which strings would you use as IOCs for network-level detection? Which strings are too generic for reliable detection rules? ================================================================================