Advanced Malware Analysis: Behavioral Detonation & C2 Extraction

Author: Anugrah Kizhakke Veedu

Executive Summary

An investigation was conducted on a live, weaponized malware sample sourced from open-source threat intelligence (OSINT) repositories. The objective was to safely detonate the payload within an isolated cloud sandbox to map the runtime execution graph, analyze process behavior, and extract actionable Indicators of Compromise (IoCs).

Threat Profile

• Analysis Platform: Any.Run Interactive Sandbox
• Environment: Windows 10 x64
• Threat Classification: High-Severity Malicious Activity
• Primary Vector: Malicious Microsoft Word Document (Macro-enabled)

Behavioral Analysis & Process Tree

Upon execution and enabling document content, the payload initiated a process injection sequence to execute the primary malware binary. The execution chain behaved as follows:

1. Initial Vector: WINWORD.EXE processes the malicious document.
2. Payload Drop: The document macro extracts and spawns the malicious child process ai.exe.
3. Network Beaconing: ai.exe initiates outbound traffic to an external Command & Control (C2) server, attempting to disguise the beacon using a spoofed Microsoft Dr Watson User-Agent.

Indicators of Compromise (IoCs)

• Initiating Malware Binary: ai.exe
• Command & Control (C2) IP: 48[.]209[.]138[.]189
• Destination Port: 443 (HTTPS)
• Triggered Suricata IDS Signature: ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)

Telemetry & Visual Evidence

*Figure 1: Any.Run sandbox displaying the active process tree and malicious binary execution.* *Figure 2: Verified Suricata Network Threat detection highlighting the spoofed User-Agent and C2 IP.*

Official Forensic Reports & MITRE ATT&CK Mapping

• View Full Sandbox Detonation Report (PDF)
• View MITRE ATT&CK TTP Mapping Summary (PDF)