HTB Sherlock: Stagecomp

Stagecomp

HackTheBox Sherlock. Static analysis of a malware sample, analyzing its C2 config and internal mechanics. Sample: 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14. Did the reversing in FlareVM, mostly in IDA.

Task 1: C2 server hostname#

Q: What fully-qualified hostname does the stager contact as its C2 server?

Answer: moonzonet.com

Opened the binary in IDA and looked for WinHttpOpenRequest usage, the function that builds the HTTP request handle. Checked the xrefs and pulled the hostname of the call arguments.

Task 2: Registration JSON format#

Q: What is the exact JSON format string used to build the initial registration POST body?

Answer: {"client_id":"%s","computer_name":"%s","username":"%s","domain":"%s"}

The malware collects the client ID, computer name, username, and domain from the infected machine, then formats them into this string to register with the C2.

Task 3: Stager User-Agent string#

Q: What User-Agent string does the stager announce to WinHttpOpen?

Answer: StageClient/2.0

Found it on the WinHttpOpen xref, as the pszAgentW parameter (last argument pushed).

Task 4: Downloads folder append string#

Q: What runtime-assembled widechar string does the folder-resolution helper append to the path returned by SHGetFolderPathW?

Answer: \Downloads

SHGetFolderPathW gets called with CSIDL 40 (user profile folder). A WideCharToMultiByte call then builds the \Downloads string and appends it to that path.

Task 5: WinHttpOpenRequest dwFlags value#

Q: What dwFlags value (hex) does the malware pass to every WinHttpOpenRequest call?

Answer: 0x800000

Every call to the C2 communication function sets dwFlags to 0x800000, which maps to WINHTTP_FLAG_SECURE. Forces the traffic over HTTPS instead of plaintext HTTP.

Task 6: Payload staging subdirectory#

Q: What subdirectory name does the stager append to its working directory to create the payload staging folder?

Answer: GameFiles

Appended to the current working directory to build the staging path.

Task 7: Second-stage payload filename#

Q: What filename is passed as the child executable to CreateProcessA when the stager launches the second-stage payload?

Answer: Game.exe

"Game.exe" gets concatenated into the command line and handed to CreateProcessA to spawn the second stage.

Task 8: Self-deletion command format#

Q: What is the exact format string used to build the command line of the self-deletion child process?

Answer: cmd.exe /c ping 127.0.0.1 -n 6 > nul && del /f /q "%s"

Task 9: C2 POST HTTP header#

Q: What exact HTTP header string is passed as pwszHeaders to WinHttpSendRequest on every C2 POST?

Answer: Content-Type: application/json

Task 10: Second-stage exit timeout#

Q: What timeout (decimal milliseconds) does the stager use when waiting for the second-stage payload process to exit?

Answer: 5000