IcedID Botnet to Dagon Locker Ransomware
A banking-trojan infection that smouldered for twenty-nine days before erupting into domain-wide Dagon Locker ransomware. A fake document portal served a JScript dropper that installed IcedID; weeks later the operator handed off to a Cobalt Strike beacon over a separate channel, pushed it across the estate through a Group Policy scheduled task, ran AdFind discovery, dumped domain credentials by replicating the directory (DCSync), moved over SMB administrative shares, exfiltrated to AWS S3 with Rclone, and deployed the encryptor while deleting shadow copies. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Recover the banking-trojan payload
35Every later event traces back to one file on one workstation. Identify the trojan the script installed and ran.
Separate the interactive channel from the botnet
35The operator ran two outbound command channels. Identify the Cobalt Strike command-and-control domain used for interactive control.
Classify the estate-wide beacon distribution
30The operator pushed the beacon to other hosts without touching each one. Classify how they distributed it.
Classify the domain credential theft
30The operator dumped domain credentials without touching LSASS on each host. Classify how they did it.
Recover the harvested administrator
35The credential dump yielded a privileged account. Identify the domain administrator credential the operator recovered and reused.
Trace the exfiltration
35Before encrypting, the operator stole the data. Identify the file-level indicator for the tool used to exfiltrate it.
Classify the exfiltration channel
30Classify how the operator moved the stolen data off the network.
Recover the encryptor indicator
35Pin down the file-level indicator for the Dagon Locker payload so it can be hunted. Provide the SHA-256 of the deployed encryptor binary.
Classify the recovery sabotage
30The encryptor took a deliberate step to stop the victim recovering. Classify it.
10 tasks · 295 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allGootLoader: SEO Poisoning to Domain Control
A paralegal searching for a contract template clicked a poisoned search result and a quiet endpoint script alert turned into a domain controller compromise by nightfall. Follow the chain from a drive-by ZIP through an obfuscated JavaScript loader, scheduled-task and Run-key persistence, a Cobalt Strike beacon, and a SystemBC proxy to the domain controller.
Vidar: Fake Notepad++ Malvertising to Data Theft
A developer searched for a popular code editor, clicked a paid search ad, and ran an installer that was not the real thing. Follow the chain from a typosquatted landing page through a dynamic-DNS payload host to the Vidar stealer's dead-drop C2 resolution, then pin down the single hosting address that carried both the stolen data and the malware's orders.
IDAT Loader: Fake Chrome Update to Stealer
A fake Chrome update page convinced an estimator their browser was out of date, and one installer later their saved passwords and wallet data were on their way to an unknown host. Follow the chain from a drive-by MSI through msiexec, a signed application side-loading the IDAT Loader, process injection, and StealC and Lumma infostealers to a single command-and-control endpoint.