Malware Investigation: RedLine Stealer Infostealer Campaign
Investigate a RedLine Stealer infection originating from a malicious 'Netflix Checker' application. Analysts will trace the execution from the initial dropper to the final payload, identify the specific sensitive data targeted (browsers, crypto wallets, VPNs), and analyze the SOAP-based C2 communication used for exfiltration.
Start this operation
Create your free account and begin immediately.
Get Early Access — FreeFree forever — no credit card required
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identifying the Initial Entry Point
10Dropper Execution and Decryption
15Analyzing Payload Masquerading
15Brute Force Source Identification
20Identify the external IP address that successfully gained access to the FIN-WS-01 workstation via a RemoteInteractive logon after multiple failed attempts.
Profiling the Victim's Location
15Crypto Wallet Discovery
20Persistence Mechanism
15C2 Infrastructure Identification
20Analyzing Exfiltration Volume
209 tasks · 150 points total
Start investigationTraining Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
Create your free account and begin immediately.
Get Early Access — FreeFree forever — no credit card required
More Operations
View allClickFix: The Fake CAPTCHA Trap
Investigate a modern 'ClickFix' social engineering attack where a user was tricked into executing a malicious PowerShell command via a fake CAPTCHA interface. You will analyze SIEM and XDR telemetry to trace the infection from the initial web lure to the deployment of an infostealer.
Phishing Investigation: ZipLine Supply Chain Campaign
Investigate a sophisticated social engineering campaign targeting manufacturing supply chains. You will analyze a 'reversed' phishing flow where attackers use 'Contact Us' forms to trick employees into initiating email conversations, leading to the deployment of the custom MixShell in-memory implant via DNS tunneling.
Credential Harvesting: The Lookalike Login
An investigation into a modern phishing campaign targeting critical infrastructure. You will analyze email headers for domain spoofing, identify 'Paste and Run' execution chains, and track the delivery of the LummaC2 information stealer through SIEM logs.