03 — Practice
Investigation cases
Six detailed scenarios from real practice. Each one includes: situation, step-by-step
methodology, toolkit, possible results, and a sample investigation output.
Scenario
A DeFi protocol loses 2.41M USDT due to a smart contract vulnerability. Funds are immediately converted to ETH and start being „laundered" through the Tornado Cash mixer. The task — reconstruct the money flow, identify off-ramps, and prepare KYC requests to the exchanges.
Investigation steps
- Identification of the initial wallet address (exploit transaction)
- Address clustering (common-input ownership heuristic)
- „Peeling chain" tracking — chain of smaller transfers
- Correlation of mixer deposits by time and denomination
- Off-ramp identification — CEX deposit addresses
- KYC requests via the FCIS (LT) and Europol channels
Possible results
- Address-cluster map with 87% fund traceability
- Identified off-ramp (Binance, KuCoin deposit ID)
- KYC data via lawful channels (passport copy, IP, sessions)
- Intermediate „mule" agent whose account was used for the cash-out
- Function-signature matches with known Lazarus, FIN7 attacks
Legal basis
LT CCP Art. 154, 158 · FATF Travel Rule (R.16) · AMLD6 Directive · International cooperation under the Budapest Convention.
case://BC-2024-0091.tracing
# Fund movement map
source: 0x4a1c…d8e2 (exploited vault)
stolen: 2,412,890 USDT # Ethereum mainnet
first_hop: 0x9c33…f721 # Uniswap swap to ETH
mixer: Tornado Cash 100 ETH pool
deposits: 28 tx in 9h 14m # pattern: 10 ETH x 28
## Off-ramp clusters (post-mixer)
cluster_A: Binance hot wallet 2,099,514 USDT (87.0%)
cluster_B: KuCoin deposit 265,418 USDT (11.0%)
cluster_C: unknown / OTC desk 47,958 USDT ( 2.0%)
## KYC request status
jurisdiction: LT (FCIS) - BVI (Binance)
filed: 2024-08-22 11:04 EET
response: received 2024-09-01 | passport, IP, session UA
linked_id: Subject-7193 (see case://NEE-2024-0473)
Scenario
An e-commerce platform (WordPress, WooCommerce) notices an unusual number of administrator accounts. Customers report that a foreign payment form appears during checkout. A web shell and a fake payment form (Magecart-style) are suspected.
Investigation steps
- Collection of Nginx, Apache access and error logs (90 d.)
- Correlation of WAF (ModSecurity, Cloudflare) events
- File-system diff — newly created or modified PHP files
- YARA signatures applied to detect the web shell
- Identification of the infection vector (CVE) in the plugin
- Search for JS injection on the checkout page (Magecart skimmer)
- DB query analysis — what data was exfiltrated
Possible results
- Precise attack chronology from zero-day to exfiltration
- Web shell hash, over 12 IOC indicators
- List of exfiltrated cards (customer notification under GDPR)
- Magecart skimmer C2 endpoint and DOMAIN linkage
- Privilege-escalation path from www-data to root
nginx/access.log — moment of compromise
# Intrusion HTTP request
185.220.101.42 - - [14/Aug/2024:02:17:33 EEST] "POST
/wp-content/plugins/wpforms-lite/includes/admin/ajax-actions.php
?action=wpforms_form_save&data=PD9waHAgZX..."
200 412
"-" "ZmEu"
# 2 seconds later — web shell is activated
185.220.101.42 - - [14/Aug/2024:02:17:35 EEST] "GET
/wp-content/uploads/2024/08/.cache.php?cmd=id"
200 86
# Magecart skimmer deployment in checkout.js
185.220.101.42 - - [14/Aug/2024:02:18:11 EEST] "POST"
/wp-admin/admin-ajax.php?action=heartbeat"
200 # inject: cdn-pay[.]net/skim.js
## IOC
shell_sha256: 9f3c1a7e4d2b5c8a6f0e9b4d7a3c1e5f2b8a6d9c7e1f0a4b3d8c5e2f1a9b6d3
skimmer_c2: cdn-pay[.]net # registered 6 days before attack
cve: CVE-2024-10571 (WPForms Lite < 1.9.1)
Scenario
A SOC analyst notices odd periodic TLS traffic from a workstation to 185.220.101.42 every 67 seconds. The EDR flags nothing. Fileless C2 beaconing is suspected. Before powering down the workstation a RAM dump is captured and a full PCAP is taken from the core switch SPAN port.
Investigation steps
- PCAP „carving" (Arkime, Moloch)
- JA3, JA4 TLS ClientHello fingerprint comparison with known samples
- Beaconing interval analysis (jitter, sleep skew)
- Detection of DGA (Domain Generation Algorithm) DNS queries
- Hunting for exfiltration „byte volume" anomalies
- C2 infrastructure mapping via passive DNS, VirusTotal
Possible results
- Confirmed C2 protocol, distinctive URI keyword
- JA3 match against a Cobalt Strike Malleable C2 profile
- Beacon interval: 67 ± 11 s (sleep jitter 16%)
- ~412 MB exfiltrated over HTTPS POST to several CDNs
- Attribution to a known APT (78% TTP overlap)
zeek/conn.log — beaconing pattern
# Periodic beacon connections (every ~67 s)
ts=1716042893.21 uid=Co7wxR orig=10.0.42.117 resp=185.220.101.42:443
proto=tcp duration=8.31s orig_bytes=512 resp_bytes=128
conn_state=SF history=ShADdaF
ja3=e7d705a3286e19ea42f587b344ee6865 Cobalt Strike default
ja3s=ec74a5c51106f0419184d0dd08fb05bc
ts=1716042960.43 uid=Co8axR orig=10.0.42.117 resp=185.220.101.42:443
duration=7.94s orig_bytes=528 resp_bytes=144
ja3=e7d705a3286e19ea42f587b344ee6865
## Exfiltration „burst" (00:14:22 UTC)
ts=1716046462.18 uid=Cq9zxR resp=185.220.101.42:443
duration=412.7s orig_bytes=432,189,440 412 MB uplink
conn_state=SF
# Statistics
beacons_total: 1,247 over 23h 11m
avg_interval: 67.2s (±10.8s jitter)
classification: Cobalt Strike Beacon (high confidence)
Scenario
A hospital workstation is encrypted by unknown ransomware. The antivirus does not recognise the signature; no public decryptor exists. The task — perform a full binary analysis, identify the encryption scheme, and determine whether the key is stored locally, transmitted to C2, or generated deterministically (which would make reverse engineering possible).
Investigation steps
- Static analysis: PE header, sections, strings, imports (IDA, Ghidra)
- Packer detection (DIE, PE-bear) and unpacking (UPX, custom)
- Dynamic analysis in an isolated sandbox (Cuckoo, ANY.RUN)
- API call trace — CryptoAPI, BCrypt calls
- Identification of encryption algorithm and mode (ChaCha20, AES-CBC)
- Key-management scheme: PRNG seed, C2, ephemeral key
- Creating CAPA, YARA signatures to identify the family
Possible results
- Full IOC report (hashes, mutexes, paths, keys)
- Decoded C2 protocol — configuration extract possible
- Encryption-scheme diagram (how the key is generated)
- Attribution based on code similarities (Black Basta, LockBit, Akira)
- Potential decryptor hypothesis (if a weak PRNG is used)
# Anti-analysis
capa: detect virtual machine via CPUID (T1497.001)
capa: detect debugger via IsDebuggerPresent (T1622)
capa: check for sandbox via timing-attack (T1497.003)
# Encryption
capa: encrypt data using ChaCha20 (T1486)
capa: generate key via CryptGenRandom # weak seed
capa: encode key in registry HKCU\Software\... (T1112)
# C2 communication
capa: resolve domain via DNS-over-HTTPS (T1071.004)
capa: communicate via HTTPS POST (T1071.001)
capa: send RSA-encrypted session key
# Persistence
capa: persist via Run registry key (T1547.001)
capa: persist via Scheduled Task "AdobeUpdateService" (T1053.005)
# Impact
capa: delete Volume Shadow Copies (vssadmin) (T1490)
capa: drop ransom note "!HOW_TO_RECOVER.txt"
## Attribution
rich_header: matches Black Basta build chain
code_sim: 82% overlap with Akira r3-2024
verdict: ransomware — variant Akira.B, Black Basta hybrid
Scenario
A company director's computer behaves oddly: it is slow, sending packets periodically even when the browser is closed. The antivirus and EDR are clean. No suspicious files are on disk. A classic „living off the land" scenario where malicious code lives only in memory. A RAM dump is taken with WinPMEM before the system is rebooted.
Investigation steps
- Acquiring the RAM image (WinPMEM, FTK Imager Lite)
- OS profile identification (vol3 windows.info)
- Process tree — pstree, malfind, ldrmodules
- Hunting for process injection (process hollowing, DLL injection)
- Hidden network connections (netscan)
- Cmdline and envars history (cmdline, envars)
- YARA scan directly against memory (yarascan)
Possible results
- PID and parent of the injected process (svchost, spoolsv, injected)
- C2 connections the EDR missed (raw socket)
- In-memory PowerShell payload (Base64, GZip)
- Actual executing code that differs from the on-disk file (hollowing confirmation)
- Full executable dumped from RAM (procdump)
vol3 windows.malfind — injection detected
# Volatility 3 — process injection indicators
$ vol3 -f mem.raw windows.malfind
PID Process Start VPN End VPN Tag Protection
---- ------- --------- ------- --- ----------
1240 svchost.exe 0x1f0000 0x1ffffff VadS PAGE_EXECUTE_READWRITE
# Disassembly preview:
0x1f0000 e8 00 00 00 00 call 0x1f0005
0x1f0005 58 pop rax
0x1f0006 48 83 c0 12 add rax, 0x12
0x1f000a 48 31 c9 xor rcx, rcx
# Hallmark of reflective loader, Cobalt Strike beacon
$ vol3 -f mem.raw windows.netscan
Proto Local Addr Foreign Addr State Owner
----- ---------- ------------ ----- -----
TCP 10.0.42.117:51234 185.220.101.42:443 ESTABLISHED svchost.exe (1240)
# But EDR shows no network activity for PID 1240 — hidden
$ vol3 -f mem.raw windows.cmdline --pid 1240
PID Process CommandLine
---- ------- -----------
1240 svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s Schedule
legitimate command line — but executable image differs
$ vol3 -f mem.raw windows.dumpfiles --pid 1240
dumped 1240.svchost.exe.bin (SHA256: a7c3…f902)
# Hash NOT matching legitimate svchost.exe — confirmed process hollowing
Scenario
A victim of domestic violence suspects that her ex-partner is tracking her location in real time and reading her conversations. No suspicious apps are visible on the phone (Android 14), but the battery drains within 6 hours and the device runs hot. The task — perform a forensic examination of the phone and prepare evidence for the prosecutor's office regarding a violation of the right to privacy (LT Criminal Code Art. 167).
Investigation steps
- Logical acquisition with the victim's consent (Cellebrite, MOBILedit)
- Installed-app inventory (including system-level)
- Hunting for hidden launcher (no app icon)
- Analysis of notification and „accessibility service" permissions
- GPS, location history (Google and Android system logs)
- Decryption of WhatsApp, Signal databases
- Stalkerware signatures (mvt-android)
- Network traffic analysis via VPN proxy (if possible)
Possible results
- Identification of the stalkerware app, vendor URL
- Installation date and circumstances (USB debugging, sideload)
- Exfiltration channel — C2 server address
- List of the victim's location points sent to the stalker
- Possible attacker identification via C2 and the pay-per-use account
Legal basis
LT Criminal Code Art. 167 (privacy) · Art. 168 (unlawful collection of information) · LT CCP Art. 158 (examination of objects) · Expert appointment under LT CCP Art. 84.
mvt-android scan — stalkerware detected
# Mobile Verification Toolkit — Android scan results
$ mvt-android check-backup --output ./case-mobile-06 backup/
## Installed apps check (suspicious)
[!] Detected app: com.qoolsoft.androidsystemwebview
name: "Android System WebView" # spoofed
real_pkg: not from Google Play
install: 2024-02-14 21:33 EET # installed via adb sideload
permissions: ACCESS_FINE_LOCATION, RECORD_AUDIO, READ_SMS,
READ_CONTACTS, READ_CALL_LOG, BIND_ACCESSIBILITY
launcher_icon: hidden
matches: mvAndroidStalkerware:FlexiSPY rule
## SafetyNet, Play Protect bypass
[!] Device Owner: "com.qoolsoft.androidsystemwebview"
# App promoted to device admin — cannot be uninstalled normally
## Network traffic (last 24 h)
domain: api.flexispyclient[.]com 1,247 connections
domain: geo-tracker-cdn[.]net 8,932 POST requests
total_exfil: 147 MB (audio, SMS, GPS, contacts)
## Conclusion
verdict: commercial stalkerware (FlexiSPY-family)
vector: physical access window, USB sideload
evidence: suitable for inspection act under LT CCP Art. 158
recommend: KYC request to FlexiSPY (UK) via Europol