CHALLENGE LAB 01PRACTICAL MALWARE ANALYSIS (PMAT)DIFFICULTY: NOVICE / INTERMEDIATE
SillyPutty.exe: Trojanized SSH Client Dissection
Dissect a modified PuTTY binary executing a covert secondary thread that bootstraps a hidden PowerShell TCP reverse shell.
Lab Progress
0% (0/4 Verified)
Threat Scenario & Analyst Mission
A system administrator downloaded a PuTTY installer from an unofficial mirror. While the application presents a fully functional PuTTY SSH client GUI, network monitoring telemetry flagged suspicious outbound TCP connection attempts immediately upon startup.
Your objective is to reverse engineer SillyPutty.exe, trace the thread initialization cross-references (xrefs) in x86 disassembly, locate the hardcoded C2 beacon parameters, and extract actionable IOCs for perimeter defense.
5-Stage Reverse Engineering Methodology
01
Static Triage & Cryptographic Hashes
Calculate SHA256, verify code signature status, examine PE sections, and run FLOSS for obfuscated strings.
02
Import Address Table (IAT) & Win32 APIs
Identify suspicious process creation and thread execution APIs (CreateThread, ShellExecuteA).
03
Cutter / Ghidra Control Flow Graph & Xrefs
Jump to WinMain entry point, trace xrefs to CreateThread (offset 0x00412880), and inspect the thread worker payload routine.
04
Dynamic Detonation in FLARE Sandbox
Observe process tree creation (SillyPutty.exe spawning hidden PowerShell.exe) and Wireshark TCP 3-way handshake.
05
IOC Extraction & Defensive Rule Generation
Extract C2 IP (192.168.195.139), Port (4444), generate YARA and Sigma detection signatures.
Sample Properties
Filename:SillyPutty.exe
Architecture:x86 (32-bit)
File Size:1.08 MB
Entropy:6.84 (Unpacked)
Digital Signature:Invalid / Revoked
MITRE ATT&CK Mapping
T1059.001Execution
Command and Scripting Interpreter (PowerShell)
T1036Defense Evasion
Masquerading (Legitimate Utility)
T1095Command and Control
Non-Application Layer Protocol (TCP)