Lion Cipher Lab
Reconstruct a malware loader's execution chain: parent-child, temp files, and the final payload
- Digital Forensics & IR (DFIR)
- Advanced
- ~60 min
- Free · no account required
Why it matters
Modern commodity malware almost never arrives as one obvious executable that runs the malicious code itself. It arrives as a loader: a small, boring-looking chain of stages — a document or script, a script host, an interpreter that decodes a blob, a dropped file — whose only job is to smuggle the real payload into memory and start it inside a trusted, signed Windows process so nothing on disk looks wrong. If you can only read one stage at a time, the malware wins: each stage alone looks explainable. The skill that catches it is reconstruction — stitching the process tree, the temp files, and…
What you'll learn
- reading a process tree (parent-child ancestry) as a single execution story
- spotting the script-host and interpreter stages of a staged loader
- using temp-file create-then-delete events to reconstruct staging
- recognising process injection from RWX memory + CreateRemoteThread evidence
- identifying the TRUE payload host: a legitimate process running injected code
- mapping observed behaviour to MITRE ATT&CK (T1055, T1620, T1140)
- knowing when the artifacts settle the chain and when you must go to memory
Steps in this lab
- The scenario, and what 'reconstruction' means
- Artifact 1 — the process tree (read the ancestry as the story)
- Artifact 2 — temp files written and deleted (the staging)
- Artifact 3 — the deobfuscation stage, named (T1140)
- Artifact 4 — DLL loads and the CreateRemoteThread event (the injection)
- Artifact 5 — the memory note (where the payload actually runs)
- The third rule: when the artifacts settle the chain, when you need memory, and how a pro reads it
- Write it up: the reconstruction in five lines