Malevolent ModMaker

Scenario

This Sherlock case involves a malware incident where a seemingly innocuous program, shared within a gaming community, turns out to be malicious. The program, disguised as a mod-making tool, is executed by a senior software engineer at Acme Inc., leading to a ransomware attack. The malware encrypts files on the victim’s machine and demands a ransom for their decryption. Through this case, investigators will analyze the provided artifacts to uncover the malware’s behavior, including its communication with a command and control server, the execution of additional malicious binaries, and the encryption process.

Executive Summary

A Minecraft mod-making tool shared in a gaming community was a trojan. Run by an Acme engineer, it profiled the victim through a geolocation lookup, reported back to an attacker-controlled chat-service endpoint over JSON, and launched PowerShell with the execution policy bypassed to pull down and run a second-stage binary from the attacker’s server. That binary is a Go ransomware that walks the filesystem, skips directories it cannot read, and encrypts text files with AES-GCM using a key hardcoded in the binary. Because the key sits in the sample, the encrypted file was decrypted statically, without ever running the malware.

Artifacts

• danger.zip: password-protected archive. The password is in the accompanying danger.txt. Extract into an empty directory and never execute anything inside
• MCModMaker-v.1.4.exe: the trojanised loader. Go binary, so plain strings output is fragmented because Go packs its string data. Use grep -a for URLs and commands
• goteem.exe: the ransomware payload. Go binary with a pclntab, which lets you recover function names and addresses without a disassembler plugin
• Text files: a plain-text ransom note and a second file carrying an extra extension, which is the encrypted victim document

Gotcha: Go packs string literals back to back with no terminators, so strings alone truncates or merges them. grep -aoE with a pattern around the thing you want (a URL, a command line) returns it cleanly.

Execution

Start with the dropped text files. One is a note demanding payment; the other is a victim document renamed with an attacker-chosen extension appended. Both point at the same family of file-encrypting extortion malware.

unzip -P hacktheblue danger.zip

Carve the loader for command-line fragments. A PowerShell invocation with the execution policy switched off is sitting in the binary, which means the loader shells out to run something other than itself.

grep -aoE 'powershell[^"]{0,40}' MCModMaker-v.1.4.exe

Discovery

Pull every URL out of the loader. One points at a geolocation-style API whose path lists country,city,vpn fields and carries an apiKey query parameter. The key is the final token of that URL.

grep -aoE 'https?://[^ "]+' MCModMaker-v.1.4.exe

Command and Control

The same URL dump shows a discordapp.com/api/ path with a numeric ID and token. That is the shape of a Discord endpoint that accepts POSTed messages without a bot login, a convenient channel because the traffic blends in with ordinary Discord use. The question asks for the mechanism, not the host, so name what the /api/... path is.

grep -aoE 'https?://[^ "]+' MCModMaker-v.1.4.exe

Search the loader for a content type string. The request that reports back to the C2 sets a JSON media type, so the stolen data is posted as a JSON body.

grep -aoE 'application/[a-z+.-]+' MCModMaker-v.1.4.exe

The loader also embeds a plain HTTP URL on port 8080 ending in goteem.exe. That is the second-stage download, and its host is the server delivering the payload. The filename matches the payload in the archive and the extension the encrypted file carries.

grep -aoE 'http://[^ "]+\.exe' MCModMaker-v.1.4.exe

Collection

Switch to goteem.exe. The enumerator function name and its status message both name the single document type it collects, and the format mask is three characters.

strings -a goteem.exe | grep -iE 'findTxtFiles|Found \.'

The directory walker prints a skip message when it hits a folder it cannot read. The message is a Go format string with a %s placeholder, and the question wants it exactly as stored, placeholder included.

strings -a goteem.exe | grep -i 'access denied'

Impact

objdump cannot name Go functions, so a small script parsing the pclntab maps symbol names to addresses. That located main.encryptFile. Disassembling it with objdump shows os.ReadFile followed by a success check, and the first call after that check targets 0x47d5a0, which the pclntab resolves to a function in the crypto package. The answer uses underscores in place of the slashes and dot in the Go symbol path.

python3 -I pcln.py goteem.exe | grep -E 'encryptFile|47d5a0'

objdump -d goteem.exe

Tip: The format mask has underscores where the Go symbol has / and .. Read the mask before typing the name.

A 32-character hex string sits in the binary, and the cipher constructor from Q9 takes a 16-byte key. Decoded, the hex reads as a short ASCII phrase (“change this pass”), a placeholder passphrase the author never replaced. The answer is the hex form, matching the 32-character mask.

grep -aoE '[0-9a-f]{32}' goteem.exe

echo 6368616e676520746869732070617373 | xxd -r -p

The cipher mode is AES-GCM, and the encrypted file stores the 12-byte nonce as its first bytes with the ciphertext and tag after it. Decrypt it with the Q10 key using a Python cryptography install; the plaintext names the project. The ransomware is never run.

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
data = open("probably_important.txt.goteem", "rb").read()
key = bytes.fromhex("6368616e676520746869732070617373")
print(AESGCM(key).decrypt(data[:12], data[12:], None).decode())

Note: The nonce layout and cipher mode were reasoned from the crypto/aes and GCM calls in encryptFile and confirmed when decryption succeeded, since GCM authentication fails on a wrong key or offset.

Attack Summary

Phase	Action
Execution	Victim runs the fake mod tool, which launches PowerShell with the execution policy bypassed
Discovery	Loader queries a geolocation API to profile the victim
Exfiltration	Victim data is POSTed as JSON to a Discord webhook
Command and Control	Loader downloads the ransomware over HTTP from the attacker’s server
Collection	Ransomware enumerates text files and skips unreadable directories
Impact	Files are encrypted with AES-GCM and renamed, and a ransom note is dropped

IOCs

Type	Value
Domain (payload C2)	goteem[.]htb
URL	hxxp[://]goteem[.]htb:8080/goteem[.]exe
Domain (geolocation API)	hunnid[.]htb
API key	ZVBOKX3P8H7
Webhook	discordapp[.]com/api/webhooks/213742/...
File	MCModMaker-v.1.4.exe
File	goteem.exe
Extension	.goteem
AES key (hex)	6368616e676520746869732070617373

MITRE ATT&CK

Technique	ID	Description
User Execution: Malicious File	T1204.002	Victim ran a trojanised mod tool
Command and Scripting Interpreter: PowerShell	T1059.001	Loader runs PowerShell with execution policy bypassed
Web Service	T1102	Discord webhook used as the reporting channel
Exfiltration Over Web Service	T1567	Victim data posted as JSON to the webhook
Ingress Tool Transfer	T1105	Ransomware pulled from the attacker’s server
File and Directory Discovery	T1083	Ransomware walks directories and lists text files
Data Encrypted for Impact	T1486	AES-GCM encryption of victim files

Defender Takeaways

Unsigned tools from community forums are an execution risk, not a download. The entry point was a user running a mod utility from a gaming community on a corporate machine. Application control that blocks unsigned executables from user-writable paths, and separation of personal gaming from work devices, would have stopped the chain at step one.

powershell -ep bypass launched from a non-script parent is worth an alert. The loader spawns it directly. Detect PowerShell started with execution policy overrides by a freshly downloaded GUI program, using process creation logging.

Webhook traffic to consumer chat services is an exfil channel. A workstation posting JSON to discordapp.com/api/webhooks has no business reason in most corporate settings. Block or proxy-inspect the path, and alert on small POSTs to it.

Hardcoded keys make the damage reversible. The ransomware shipped with its AES key in the binary, so one sample was enough to decrypt the victim file. Keep samples from incident response, because a flawed family can turn recovery from a ransom payment into a static-analysis exercise.

Conclusion

A trojanised mod tool gave the attacker a foothold, a profile of the victim, and a ransomware payload in a single click. The ransomware’s own weakness, a key stored in plain view, is what let the encrypted file be recovered without paying.