SOC Incident Report: Investigation of a Volt Typhoon-Inspired Intrusion
A Complete Write-Up Demonstrating Real SOC Investigation Methodology
A SOC Threat Intelligence Investigation. TryHackMe First Shift CTF — Task 3: Probably Just Fine
A practical walkthrough of SOC investigation techniques, including IOC analysis, malware classification, and MITRE ATT&CK mapping.
Introduction
This write-up documents a Threat Intelligence investigation based on Task 3: Probably Just Fine of the First Shift CTF room on TryHackMe.
In this scenario, I take on the role of a Security Operations Center (SOC) Analyst, tasked with analyzing indicators of compromise (IOCs) such as IP addresses, file hashes, domains, and threat intelligence reports.
This task simulates a real-world SOC workflow, where analysts must pivot across multiple intelligence sources to:
- Enrich indicators
- Identify malicious infrastructure
- Correlate threat activity
- Map findings to frameworks like MITRE ATT&CK
The objective is to demonstrate practical defensive security skills, including OSINT usage, malware analysis, and threat attribution.
Q1. What is the ASN number related to the IP?
Process:
I performed a WHOIS lookup on the suspicious IP using DomainTools to identify ownership and network attribution.
Answer: 212238
Q2. Which service is offered from this IP?
Process:
Using the provided file hash, I searched the TryDetectThis Threat Intelligence platform.
Under Detections and Reports, I reviewed linked intelligence sources, including a report from Recorded Future. This provided contextual information about infrastructure usage.
Answer: VPN
Q3. What is the filename of the file related to the hash?
Process:
From the same hash lookup results, I navigated to the File Details section to identify the associated filename.
Answer: zY9sqWs.exe
Q4. What is the threat signature that Microsoft assigned to the file?
Process:
Within the Vendor Analysis section of the intelligence results, I identified the detection name assigned by Microsoft.
Answer: Trojan:Win32/LummaStealer.PM!MTB
Q5. One of the contacted domains is part of a large malicious infrastructure cluster. Based on its HTTPS certificate, how many domains are linked to the same campaign?
Process:
I searched for the domain gadgethgfub.icu in the Threat Intelligence platform.
In the HTTPS Certificate Data section, I reviewed the Subject Alternative Name (SAN) field, which lists associated domains sharing the same certificate.
I exported the domain list into a text editor with line numbering enabled to accurately count the entries.
Answer: 151
Q6. The file matches one of the YARA rules made by “kevoreilly”. What line is present in the rule’s “condition” field?
Process:
In the YARA Rules section of the intelligence platform, I accessed the linked GitHub repository.
By reviewing the rule definition, I identified the relevant condition logic.
Answer: uint16(0) == 0x5a4d and any of them
Q7. The file is also mentioned in one of the TI reports. What is the title of the report mentioning this hash?
Process:
Under Detections and Reports, I navigated to the Reports section and followed the referenced link to confirm the report title.
Answer: Behind the Curtain: How Lumma Affiliates Operate
Q8. Which team did the author of the malware start collaborating with in early 2024?
Process:
I reviewed the same threat intelligence report and identified collaboration details within the campaign analysis.
Answer: GhostSocks
Q9. A Mexican-based affiliate related to the malware family also uses other infostealers. Which mentioned infostealer targets Android systems?
Process:
Continuing analysis of the report, I identified references to additional malware families used by affiliates.
Answer: CraxsRAT
Q10. The report states that the affiliates behind the malware use the services of AnonRDP. Which MITRE ATT&CK sub-technique does this align with?
Process:
Based on the use of rented infrastructure services like AnonRDP, I mapped this behavior to the relevant MITRE ATT&CK sub-technique under the Resource Development tactic.
Answer: T1583.003
Conclusion
This task highlights the importance of threat intelligence correlation and analytical thinking in SOC environments.
By pivoting across multiple data sources — such as WHOIS records, malware databases, and intelligence reports — I was able to:
- Attribute malicious infrastructure
- Identify malware characteristics
- Map attacker behavior to standardized frameworks
These are essential skills for detecting and responding to modern cyber threats.
Key Skills Demonstrated
- Threat Intelligence Analysis
- IOC Enrichment (IP, hash, domain)
- OSINT Investigation
- Malware Classification
- YARA Rule Analysis
- Threat Actor Profiling
- MITRE ATT&CK Mapping
Tools & Platforms Used
- DomainTools (WHOIS lookup)
- TryDetectThis (Threat Intelligence Platform)
- Public Threat Intelligence Reports
- GitHub (YARA rule analysis)
