MalBuster

This room aims to be a practice room for Dissecting PE Headers and Static Analysis 1. In this scenario, you will act as one of the Reverse Engineers that will analyse malware samples based on the detections reported by your SOC team.

Prerequisites

This room requires basic knowledge of Malware Static Analysis. We recommend going through the following rooms before attempting this challenge.

• Intro to Malware Analysis
• Dissecting PE Headers
• Basic Static Analysis

Scenario

You are currently working as a Malware Reverse Engineer for your organisation. Your team acts as a support for the SOC team when detections of unknown binaries occur. One of the SOC analysts triaged an alert triggered by binaries with unusual behaviour. Your task is to analyse the binaries detected by your SOC team and provide enough information to assist them in remediating the threat.

Investigation Platforms

The team has provided two investigation platforms, a FLARE VM and a REMnux VM. You may utilise the machines based on your preference.

If you prefer FLARE VM, you may start the machine attached to this task. Else, you may start the machine on the task below to start REMnux VM.

The machine will start in a split-screen view. In case the VM is not visible, use the blue Show Split View button at the top-right of the page.

You may also use the following credentials for alternative access via Remote Desktop (RDP):

Username	administrator
Password	letmein123!
IP Address	MACHINE_IP

Lastly, you may find the malware samples on C:\Users\Administrator\Desktop\Samples. 

WE ADVISE YOU NOT TO DOWNLOAD THE MALWARE SAMPLES TO YOUR HOST.