The Payload

With the malware extracted, Holmes inspects its logic. The strain spreads silently across the entire network. Its goal? Not destruction-but something more persistent…friends. NOTE: The downloaded file is active malware. Take the necessary precautions when attempting this challenge.

Question #1

During execution, the malware initializes the COM library on its main thread. Based on the imported functions, which DLL is responsible for providing this functionality? (filename.ext)

List imported functions:

$ objdump -x AetherDesk-v74-77.exe
        DLL Name: ole32.dll
        vma:     Ordinal  Hint  Member-Name  Bound-To
        00005358  <none>  002b  CoCreateInstance
        00005360  <none>  0091  CoUninitialize
        00005368  <none>  0060  CoInitialize
        00005370  <none>  01c1  OleRun

Question #2

Which GUID is used by the binary to instantiate the object containing the data and code for execution? (********-****-****-****-************)

Open the binary in IDA:

Instance = CoCreateInstance(&rclsid, 0, 0x17u, &riid, (LPVOID *)pUnknown);

.rdata:0000000140005A48 ; const IID rclsid
.rdata:0000000140005A48 rclsid          IID <0DABCD999h, 1234h, 4567h, <89h, 0ABh, 12h, 34h, 56h, 78h, 90h, \
.rdata:0000000140005A48                                         ; DATA XREF: sub_140001310+446↑o
.rdata:0000000140005A48                                         ; main+5B↑o
.rdata:0000000140005A48                      0FFh>>

The GUID is DABCD999-1234-4567-89AB-1234567890FF.

Binary Ninja can print the guid for you in decompiled code:

140001ca2        HRESULT hr_1 = CoCreateInstance(
140001ca2            rclsid: &_GUID_dabcd999_1234_4567_89ab_1234567890ff, pUnkOuter: 0, 
140001ca2            dwClsContext: 0x17, riid: &_GUID_00000000_0000_0000_c000_000000000046, 
140001ca2            ppv: &pAddrInfo_1)

Question #3

Which .NET framework feature is the attacker using to bridge calls between a managed .NET class and an unmanaged native binary? (string)

Search online:

1. P/Invoke
2. C++/CLI
3. Com Interop

The third one is the answer.

Question #4

Which Opcode in the disassembly is responsible for calling the first function from the managed code? (** ** **)

Call COM function:

(*(void (__fastcall **)(__int64, __int64 *))(*(_QWORD *)v5 + 104LL))(v5, &v73);

Corresponding instruction:

.text:0000000140001D23                 call    qword ptr [rax+68h]

Hex:

ff 50 68

Question #5

Identify the multiplication and addition constants used by the binary's key generation algorithm for decryption. (*, **h)

Decompile in Binary Ninja:

140001d75                if (__isa_available < 6)
140001d75                {
140001f17                    do
140001f17                    {
140001f09                        *(uint8_t*)(&var_1f8 + i) = (uint8_t)i * 7 + 0x42;
140001f10                        i += 1;
140001f17                    } while (i < 0x20);
140001d75                }
140001d75                else
140001d75                {
140001d7b                    int32_t __xmm@00000000000000010000000000000000_1[0x4] =
140001d7b                        __xmm@00000000000000010000000000000000;

Answer: 7, 42h.

Question #6

Which Opcode in the disassembly is responsible for calling the decryption logic from the managed code? (** ** **)

Call COM function:

  v54 = (*(__int64 (__fastcall **)(__int64, _QWORD, _QWORD, PCSTR *))(*(_QWORD *)v50 + 88LL))(
          v50,
          *(_QWORD *)v53,
          *v51,
          &pNodeName);

Corresponding instruction:

.text:00000001400020F6                 call    qword ptr [rax+58h]

Hex:

ff 50 58

Question #7

Which Win32 API is being utilized by the binary to resolve the killswitch domain name? (string)

List imported functions:

$ objdump -x AetherDesk-v74-77.exe
        DLL Name: WS2_32.dll
        vma:     Ordinal  Hint  Member-Name  Bound-To
        00005208  <none>  00a5  freeaddrinfo
        00005210    116  <none> <none>
        00005218  <none>  00a6  getaddrinfo
        00005220    115  <none> <none>

Question #8

Which network-related API does the binary use to gather details about each shared resource on a server? (string)

List imported functions:

$ objdump -x AetherDesk-v74-77.exe
        DLL Name: NETAPI32.dll
        vma:     Ordinal  Hint  Member-Name  Bound-To
        00005160  <none>  0052  NetApiBufferFree
        00005168  <none>  00e0  NetShareEnum

Question #9

Which Opcode is responsible for running the encrypted payload? (** ** **)

In ScanAndSpread:

14000197a                    (*(uint64_t*)(*(uint64_t*)rbx_3 + 0x60))(rbx_3, rax_11, 
14000197a                        *(uint64_t*)rsi_4, *(uint64_t*)rdi_3);
140001987                    rsi_4[2] -= 1;

Assembly:

14000197a  ff5060             call    qword [rax+0x60]

ff 50 60

Question #10

Find → Block → Flag: Identify the killswitch domain, spawn the Docker to block it, and claim the flag. (HTB{*******_**********_********_*****})

The key generation function:

140001f17                    do
140001f17                    {
140001f09                        *(uint8_t*)(&var_1f8 + i) = (uint8_t)i * 7 + 0x42;
140001f10                        i += 1;
140001f17                    } while (i < 0x20);

Encrypted payload:

1400020cc                        *(uint64_t*)r15_1 =
1400020cc                            _com_util::ConvertStringToBSTR("KXgmYHMADxsV8uHiuPPB3w==");

Decrypt:

import base64

data = base64.b64decode("KXgmYHMADxsV8uHiuPPB3w==")

key = bytearray()
for i in range(32):
    key.append((i * 7 + 0x42) & 0xFF)

print(bytes([x ^ y for x, y in zip(key, data)]))

Output:

k1v7-echosim.net

Block the domain in the provided docker and get flag:

HTB{Eternal_Companions_Reunited_Again}.