Lion Cipher Lab
Characterize a downloader: the URLs, the dropped payload, and the child processes
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A huge fraction of real intrusions begin with something small and dumb: a downloader. Its entire job is to be a tiny, disposable first stage that phones home and pulls down the real malware — so the file the user actually ran often contains almost nothing incriminating, and the interesting payload never touches the mailbox or the initial download at all. If you only look at the first file, you conclude 'it didn't do much.' The skill that matters is reading the host and network telemetry to answer 'HOW does this thing retrieve its next stage, and where is that stage?' — because the staging URL…
What you'll learn
- reading a spawned PowerShell command line (encoded/hidden) as an artifact
- decoding the intent of a PowerShell downloader from a Script Block (4104) log
- identifying the staging URL a downloader fetches its second stage from
- tracing the dropped second-stage file: its %TEMP%/%APPDATA% path and its hash
- following the parent -> child process chain from the loader to the payload
- spotting the hand-off: the child process fetching a FURTHER payload
- distinguishing a downloader (job = fetch stage 2) from self-contained malware and from a dropper
- mapping downloader behaviour to MITRE ATT&CK (T1105, T1059.001, T1204.002)
- extracting the pivot IOCs (URL + dropped-file hash) that drive the rest of the response
- judgment: when the local artifacts characterize the downloader vs when you must retrieve stage 2 in isolation
Steps in this lab
- The scene: one endpoint, the artifacts already collected, one question
- Know what you're characterizing: downloader vs dropper vs self-contained malware
- Artifact 1 — the process that spawned: read the PowerShell command line
- Artifact 2 — decode the intent: the PowerShell Script Block (4104) log
- Artifact 3 — the fetch itself: DNS query and the outbound connection
- Artifact 4 — the dropped second stage: its path AND its hash
- Artifact 5 — the hand-off: the child process fetches a FURTHER payload
- Reconstruct the chain and map it to MITRE ATT&CK
- The judgment call: when the artifacts characterize it, and when you must go get stage two
- Pull the IOCs, and what you actually learned