MBCoin - HackTheBox Challenge Writeup

Challenge Information

Field	Value
Challenge Name	MBCoin
Category	Forensics
Difficulty	Medium
Author	d3vn0mi

We have been actively monitoring the most extensive spear-phishing campaign in recent history for the last two months. This campaign abuses the current crypto market crash to target disappointed crypto owners. A company’s SOC team detected and provided us with a malicious email and some network traffic assessed to be associated with a user opening the document. Your task is to analyze the supplied files and determine what happened when the user opened the malicious attachment.

Challenge Overview

This forensics challenge requires analyzing:

A malicious email file
Associated network traffic (PCAP)
Evidence of user interaction with the malicious document
Indicators of compromise (IOCs) and attack payload

The challenge revolves around a spear-phishing campaign targeting cryptocurrency investors during a market downturn, making it a timely and realistic scenario.

Solution Approach

Phase 1: Email Analysis

Begin by extracting and analyzing the malicious email:

# Extract email headers and content
file malicious_email.eml

# Use Python to parse the email structure
python3 << 'EOF'
import email
from email import policy

with open('malicious_email.eml', 'rb') as f:
    msg = email.message_from_binary_file(f, policy=policy.default)

print("From:", msg['From'])
print("To:", msg['To'])
print("Subject:", msg['Subject'])
print("Date:", msg['Date'])

# Extract attachments
for part in msg.iter_attachments():
    print(f"Attachment: {part.get_filename()}")
EOF

Phase 2: Attachment Examination

Extract and analyze any attached files:

# Extract attachments from email
python3 << 'EOF'
import email
from email import policy
import os

with open('malicious_email.eml', 'rb') as f:
    msg = email.message_from_binary_file(f, policy=policy.default)

for part in msg.iter_attachments():
    filename = part.get_filename()
    if filename:
        with open(filename, 'wb') as outfile:
            outfile.write(part.get_payload(decode=True))
        print(f"Extracted: {filename}")
EOF

# Check file type
file *.doc* *.xls* *.pdf 2>/dev/null || true

# For Office documents, check for macros
python3 -m oletools.olevba extracted_document.docm

Phase 3: Network Traffic Analysis

Analyze the PCAP file for indicators of malicious activity:

# Open PCAP with Wireshark or analyze with tshark
tshark -r network_traffic.pcap -Y "http or dns or tcp.flags==0x02" | head -50

# Extract DNS queries
tshark -r network_traffic.pcap -Y "dns.flags.response==0" -T fields -e dns.qry.name | sort | uniq

# Look for suspicious HTTP requests
tshark -r network_traffic.pcap -Y "http.request" -T fields \
  -e http.host -e http.request.uri -e http.request.method

Phase 4: Payload Identification

Identify the malicious payload and its characteristics:

# Extract executable or script payloads from network traffic
tshark -r network_traffic.pcap -w suspicious_stream.bin -Y "tcp.stream==<stream_number>"

# Check for common malware families
file suspicious_stream.bin
strings suspicious_stream.bin | grep -i "http\|cmd\|powershell"

# Hash the suspicious file
sha256sum suspicious_stream.bin
md5sum suspicious_stream.bin

Phase 5: Behavioral Analysis

Correlate the email, attachment, and network traffic:

# Timeline of events
# 1. Malicious email received
# 2. User opens attachment (document with macro)
# 3. Macro executes and contacts C2 server
# 4. Payload downloaded (cryptocurrency mining malware or banking trojan)
# 5. System compromise confirmed in network traffic

# Extract key IOCs
echo "=== Key Indicators of Compromise ==="
echo "Malicious Domain/IP: [extracted from PCAP]"
echo "File Hash: [calculated from payload]"
echo "Process Execution: [if available in email metadata]"

Key Findings

Based on the forensic analysis:

Phishing Vector: Spear-phishing email targeting crypto investors
Attack Mechanism: Malicious Office document with embedded macro
Execution Chain: Email → Attachment Open → Macro Execution → C2 Contact
Payload: Likely cryptocurrency miner or information stealer
IOCs Identified: Malicious domains/IPs in network traffic

Flag: HTB{<redacted>}

Tools Used

Email Analysis: Python email library, Thunderbird
Document Analysis: oletools (olevba), strings, file
Network Analysis: Wireshark, tshark
Hashing: sha256sum, md5sum
String Analysis: strings, grep

Key Learnings

Email Header Analysis: Always check sender reputation, SPF/DKIM records, and header timestamps
Macro Detection: Modern phishing campaigns frequently use Office macros as delivery mechanisms
Network IOCs: Correlate email metadata with network traffic to confirm compromise timeline
Cryptocurrency Targeting: Spear-phishing campaigns adapt to current events (market crashes)
Defense Layers: Email filtering, macro sandboxing, and network monitoring are critical defenses

HTB: MBCoin Challenge