IDAT Loader: Fake Chrome Update to Stealer
A fake Chrome update page convinced an estimator their browser was out of date, and one installer later their saved passwords and wallet data were on their way to an unknown host. Follow the chain from a drive-by MSI through msiexec, a signed application side-loading the IDAT Loader, process injection, and StealC and Lumma infostealers to a single command-and-control endpoint.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Scope the intrusion
0The endpoint platform raised a side-loading alert on an estimator's workstation this afternoon, and shortly afterward the proxy logged a large outbound upload from the same machine to a host nobody recognizes. Before extracting indicators, orient yourself to the case so the pivots that follow make sense.
Find the fake update page
20The user did not receive a malicious email. While reading a supplier blog they were redirected to a page that claimed their browser was dangerously out of date and had to be updated at once. Identify the host that served that fake update page.
Recover the installer hash
20Convinced the browser needed updating, the user downloaded and ran a Windows installer styled as the update. Recover the SHA-256 hash of that installer so it can be blocked across the fleet.
Identify the side-loaded library
25The installer dropped a legitimate signed application into a temporary folder alongside a malicious library, then let the trusted binary load it. Name the library that the signed application side-loaded.
Recover the command-and-control host
25After the loader injected into a benign process, that process reached out to a single external host to fetch its configuration and, later, to send the stolen data. Recover the host the injected process called home to.
Classify the side-loading technique
15For the report, classify how the loader gained execution under a trusted process. Map the technique the signed application was abused with to its MITRE ATT&CK identifier.
6 tasks · 105 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.