Friday Overtime Walkthrough

Friday Overtime - TryHackMe Walkthrough#

Challenge Information#

Scenario#

It is a Friday evening at PandaProbe Intelligence when SwiftSpend Finance submits an urgent threat intelligence request.

Several suspicious files were discovered during an internal security sweep and have been forwarded for investigation.

As the on-duty Cyber Threat Intelligence Analyst, our objective is to:

• Download and inspect the malware samples.
• Perform static analysis.
• Correlate indicators with threat intelligence sources.
• Identify malware families and ATT&CK techniques.
• Discover infrastructure used by the threat actor.
• Produce intelligence findings for remediation.

Accessing the Investigation Portal#

Credentials provided:

Username: ericatracy
Password: Intel321!

After logging into the provided portal through Chromium, we begin reviewing the ticket.

Question 1#

Who shared the malware samples?#

Reviewing the submitted ticket reveals the sender information.

Message excerpt:

My name is Oliver Bennett from the Cybersecurity Division at SwiftSpend Finance.

Answer#

Oliver Bennett

Downloading the Malware Samples#

The malware archive was attached to the ticket.

Archive:

samples.zip

Password:

Panda321!

Extracting:

unzip samples.zip

Files extracted:

cbmrpa.dll
maillfpassword.dll
pRsm.dll
qmsdp.dll
wcdbcrk.dll

Question 2#

What is the SHA1 hash of pRsm.dll?#

Using:

sha1sum *

Results:

22532a8c8594cd8a3294e68ceb56accf37a613b3  cbmrpa.dll
8a98a023164b50dec5126eda270d394e06a144ff  maillfpassword.dll
9d1ecbbe8637fed0d89fca1af35ea821277ad2e8  pRsm.dll
0781a2b6eb656d110a3a8f60e8bce9d407e4c4ff  qmsdp.dll
10fb52e4a3d5d6bda0d22bb7c962bde95b8da3dd  wcdbcrk.dll

Answer#

9d1ecbbe8637fed0d89fca1af35ea821277ad2e8

Question 3#

Which malware framework utilizes these DLLs as add-on modules?#

Researching the DLL names across public threat intelligence sources reveals they are plugins used by the:

MgBot

malware framework.

About MgBot#

MgBot is a modular malware framework commonly associated with the Chinese APT group:

Evasive Panda

The malware uses downloadable DLL modules to extend functionality such as:

• Credential theft
• Audio capture
• Surveillance
• File collection
• Command execution

Answer#

MgBot

Question 4#

Which MITRE ATT&CK Technique is linked to pRsm.dll?#

Threat intelligence analysis indicates:

pRsm.dll

is responsible for recording audio from the victim machine.

According to MITRE ATT&CK this behavior maps to:

T1123

Technique:

Audio Capture

Answer#

T1123

Question 5#

What is the CyberChef defanged URL of the malicious download location first seen on 2020-11-02?#

Threat intelligence reporting linked MgBot activity to the URL:

http://update.browser.qq.com/qmbs/QQ/QQUrlMgr_QQ88_4296.exe

Defanging the URL in CyberChef produces:

Answer#

hxxp[://]update[.]browser[.]qq[.]com/qmbs/QQ/QQUrlMgr_QQ88_4296.exe

Question 6#

What is the CyberChef defanged IP address of the C2 server first detected on 2020-09-14?#

Identified Command and Control IP:

122.10.90.12

Defanged:

Answer#

122[.]10[.]90[.]12

Why Defang?#

Defanging prevents:

• Accidental clicking
• Automated hyperlink creation
• Accidental communication with malicious infrastructure

Common replacements:

.  -> [.]
http -> hxxp

Question 7#

What is the MD5 hash of the SpyAgent spyware hosted on the same IP targeting Android devices?#

Using the identified C2 IP:

122.10.90.12

and pivoting through VirusTotal threat intelligence results reveals multiple malware samples.

One Android sample associated with the SpyAgent family shows:

951F41930489A8BFE963FCED5D8DFD79

Converting to standard lowercase MD5 format:

Answer#

951f41930489a8bfe963fced5d8dfd79

Malware Intelligence Summary#

Malware Framework#

MgBot

Threat Actor#

Evasive Panda

Malware Type#

Modular Backdoor

Capabilities#

Credential Theft
Audio Capture
Command Execution
File Collection
Surveillance
Persistence

Indicators of Compromise (IOCs)#

DLL Modules#

cbmrpa.dll
maillfpassword.dll
pRsm.dll
qmsdp.dll
wcdbcrk.dll

SHA1 Hash#

9d1ecbbe8637fed0d89fca1af35ea821277ad2e8

Malicious URL#

hxxp[://]update[.]browser[.]qq[.]com/qmbs/QQ/QQUrlMgr_QQ88_4296.exe

Command & Control Server#

122[.]10[.]90[.]12

Android SpyAgent MD5#

951f41930489a8bfe963fced5d8dfd79

MITRE ATT&CK Mapping#

Final Answers#

Key Takeaways#

• Modular malware frameworks often use DLL plugins to extend functionality.
• Threat intelligence correlation is essential for identifying malware families and attribution.
• MgBot is a highly modular malware platform associated with Evasive Panda operations.
• ATT&CK mapping helps defenders understand adversary behaviors and detection opportunities.
• Defanging indicators is a standard CTI practice when documenting malicious infrastructure.
• Pivoting from infrastructure indicators often uncovers additional malware families and campaigns.

Challenge completed successfully.

Adapted from naval0505/TryHackMe—Writeups under MIT.