Introduction

A compromised workstation has been flagged after generating suspicious outbound network traffic, and the resulting PCAP capture has been handed to the SOC for triage. Our objective in this lab is to reconstruct the intrusion end-to-end: determine how the attacker achieved initial execution, identify every payload pulled down during the infection chain, and map the post-compromise behavior to known adversary tradecraft.

The investigation begins at the network layer and works its way down through several obfuscation layers that give this sample its name. We will peel back an obfuscated VBScript that stages a PowerShell downloader, a PE payload masquerading as a .jpg, and a . NET-based RAT reflectively loaded into a signed Microsoft binary. By the end of the walkthrough, we will have recovered both stages of the malware, identified the family and its C2 infrastructure, listed the artifacts dropped to disk, and tied the execution chain back to MITRE ATT&CK techniques.

Tools used throughout this lab:

• Wireshark — PCAP inspection and HTTP stream reconstruction
• CyberChef — hex decoding and payload extraction
• Python / PowerShell — script de-obfuscation
• VirusTotal — hash lookup and family attribution
• Hosting Checker — IP attribution and WHOIS

Analysis

PCAP Analysis:

Q1: The attacker successfully executed a command to download the first stage of the malware. What is the URL from which the first malware stage was installed?

We begin by opening the capture in Wireshark and applying an http display filter to isolate web traffic. Two GET requests immediately stand out — both originating from the victim host 10.1.9.101 and reaching out to 45.126.209.4 on port 222:

• GET /xlm.txt — returned as text/plain
• GET /mdm.jpg — returned as image/jpeg

The xlm.txt request comes first, so that is where we start. Following its HTTP stream (tcp.stream eq 0) reveals that, despite the .txt extension, the response body is a VBScr…