Analyzing Suspicious Artifacts (deep dive)

The talk is a deeper follow-up to an earlier session on triaging suspicious artifacts. The presenters focus on working out what a sample does, what it is for and where it came from, and on how those answers feed threat intelligence and threat hunts. They stress operational security, so all analysis runs offline on an isolated Windows virtual machine rather than in public sandboxes.

The first demo pulls an embedded executable out of a malicious Word document using OLE tooling, then rebuilds the binary from a hex dump in CyberChef. The portable executable is then inspected for imports and header flags, the ASLR setting is disabled, and a debugger check is bypassed in a 32-bit debugger. Watching memory allocations reveals a dumped DLL containing PowerShell strings and a user agent. A stageless Cobalt Strike beacon is identified from its import and export patterns, including a reflective loader. The final section compares two shellcode emulators, shellcode_debug and speakeasy, on a staged beacon, showing the attempted connections to a command-and-control address.

The takeaway is that static inspection, targeted debugging and emulation complement one another. Each step yields indicators and behaviours that can be carried into detections and hunts. The presenters note that this is the first part of a longer series.