IDAT Loader: Fake Chrome Update to Stealer
A fake Chrome update page convinced an estimator their browser was out of date, and one installer later their saved passwords and wallet data were on their way to an unknown host. Follow the chain from a drive-by MSI through msiexec, a signed application side-loading the IDAT Loader, process injection, and StealC and Lumma infostealers to a single command-and-control endpoint.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Scope the intrusion
0The endpoint platform raised a side-loading alert on an estimator's workstation this afternoon, and shortly afterward the proxy logged a large outbound upload from the same machine to a host nobody recognizes. Before extracting indicators, orient yourself to the case so the pivots that follow make sense.
Find the fake update page
20The user did not receive a malicious email. While reading a supplier blog they were redirected to a page that claimed their browser was dangerously out of date and had to be updated at once. Identify the host that served that fake update page.
Recover the installer hash
20Convinced the browser needed updating, the user downloaded and ran a Windows installer styled as the update. Recover the SHA-256 hash of that installer so it can be blocked across the fleet.
Identify the side-loaded library
25The installer dropped a legitimate signed application into a temporary folder alongside a malicious library, then let the trusted binary load it. Name the library that the signed application side-loaded.
Recover the command-and-control host
25After the loader injected into a benign process, that process reached out to a single external host to fetch its configuration and, later, to send the stolen data. Recover the host the injected process called home to.
Classify the side-loading technique
15For the report, classify how the loader gained execution under a trusted process. Map the technique the signed application was abused with to its MITRE ATT&CK identifier.
6 tasks · 105 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allVidar: Fake Notepad++ Malvertising to Data Theft
A developer searched for a popular code editor, clicked a paid search ad, and ran an installer that was not the real thing. Follow the chain from a typosquatted landing page through a dynamic-DNS payload host to the Vidar stealer's dead-drop C2 resolution, then pin down the single hosting address that carried both the stolen data and the malware's orders.
EvilProxy AiTM: Indeed Redirect to M365 Cookie Theft
An executive at a logistics firm clicks a job-themed phishing link that abuses a recruiting platform's open redirect to reach an EvilProxy adversary-in-the-middle page. The page reverse-proxies the real Microsoft 365 sign-in, so the victim completes MFA against the attacker, who captures and replays the post-MFA session cookie. Work the email, web-proxy, DNS, Entra sign-in, and perimeter records to reconstruct the redirect chain, the relay infrastructure, and the MFA bypass.
Finding Gozi: An Italian Malspam Infection
An accounts clerk at an Italian textile firm clicked an overdue-invoice link, downloaded a ZIP, and opened an Internet shortcut that reached out over SMB to pull a second-stage loader. PowerShell and rundll32 ran the Gozi banking trojan, and the workstation began beaconing to a rotating list of bare IP-literal hosts over plain HTTP. Trace the chain from a link-based lure through an SMB stage-2 fetch to the single command-and-control endpoint the trojan settled on, where it also shipped the stolen data.