Starting with a suspicious email, you need to pivot and find as much information as possible about the potential threat actor targeting Jason, collect indicators, and map their techniques to the MITRE ATT&CK framework.
A fake game studio approached a developer over X and followed up by email with an NFT game collaboration pitch and an executable to try. The sending domain had been registered only days earlier, and the studio’s social profile and hosted build were all attacker-prepared infrastructure. The lure game, the shared binary and the infrastructure pattern match Microsoft’s reporting on a North Korean actor that also trojanizes well-known software. Pivoting on that actor’s tradecraft led to a second, closely related npm supply chain campaign from late July 2024. Its malicious packages pulled a second-stage payload from a hard-coded C2 and ran it through a renamed file loaded by a signed Windows binary.
Opportunity to Invest in NFT Game Project.eml → read the headers with grep, or open it in any mail client. This is the only evidence file; every question after Q1 is open-source researchFormat note: Several answers are MITRE IDs in the
T####.###form, and the Q14 answer ispackage-name vX.X.X.
Take the sender domain from Q1 and pull its WHOIS history on whoisfreaks. The record sits only days before the email arrived, which is the signature of a throwaway campaign domain. Read the history rows carefully: the creation date is the one that precedes the update and expiry dates, not the neighbouring field.
Gotcha: The history page layout is easy to misalign. One reading puts the creation date a day later than the correct one and shows a create date after the expiry date, which is the clue the columns have slipped. This answer was reasoned from the record rather than read from a cleanly labelled field.
Buying a domain to host a lure and send mail from is Acquire Infrastructure, and the sub-technique for domains is .001. This is a MITRE mapping, not an artifact lookup.
The email says the first contact happened in a chat on X, and the sender domain names the studio, so the profile handle follows the studio name. The format hint (*****://*.***/*******_******) fixes the shape: scheme, x.com, and a handle of seven characters, an underscore and six characters. The studio name split on an underscore fits that mask. This one was reasoned from the email text and the mask; the profile itself was not viewed, and the answer is the one the platform accepted.
Hint: Match the handle to the mask character for character, and keep the capitalisation of the studio name.
A company-branded X account set up to approach targets is an attacker-created persona. Within Resource Development, that is Establish Accounts, and the social media sub-technique is .001.
Placing the game build on infrastructure the actor controls so the victim can download it is Stage Capabilities, and uploading malware is the .001 sub-technique.
The mailbox holds a single message, Opportunity to Invest in NFT Game Project.eml. Read the From and Return-Path headers directly. Both carry the same address on a custom domain rather than a webmail provider.
grep -iE '^(From|Return-Path|Date|Subject):' "Opportunity to Invest in NFT Game Project.eml"The pitch is an NFT game collaboration with a build to try. Microsoft’s Moonstone Sleet report describes this exact lure: a fake game studio offering a tank game, with a trojanized executable behind it. The game name comes from that report (Microsoft Security Blog, 2024-05-28).
The archive the actor shared is not in the evidence, so the hash cannot be computed locally. Microsoft’s IOC table for the same report lists three SHA-256 values for the game files, and the executable DeTankWar.exe is the first. This answer is therefore taken from the vendor IOC list and matched to the lure by name, not hashed from a sample.
Gotcha: The IOC table has three similar hashes for the game’s files. Match the one listed against the
DeTankWar.exename, not the supporting files.
A fake game studio, an NFT or tank game pitch, a fresh domain and social media outreach all line up with the Microsoft report on this actor, which is where the name comes from (Microsoft Security Blog).
The same Microsoft report introduces the actor as a new North Korean threat actor.
Besides the game lure, Microsoft documents Moonstone Sleet shipping trojanized versions of legitimate tools to victims. The well-known software in that campaign is the SSH client below.
Tampering with software before it reaches the victim is Supply Chain Compromise. The sub-technique for modifying software dependencies or installers in the delivery path is Compromise Software Supply Chain, T1195.002.
Datadog Security Labs published “Stressed Pungsan” on 2024-07-31, describing a DPRK-aligned actor using a software package ecosystem for initial access. That ecosystem is the technology the question asks for (Datadog Security Labs).
The Datadog report lists the malicious packages with publish times. On 2024-07-07 harthat-api 1.3.1 went up at 15:59 UTC and harthat-hash 1.3.3 at 16:19 UTC, so the hash package is the later one.
Gotcha: Guessing a plausible version such as
v1.0.xdoes not work. Read the exact publish timestamps in the report and take the latest, which is not the first package listed.
The Datadog indicator list gives the C2 the packages contact for the second stage. The Datadog page failed to load directly, so the indicators were read from a public mirror of the same report (hendryadrian.com).
Per Datadog, the downloaded payload is saved under a different name (package.db) and loaded by rundll32. Running code through a signed Windows binary is System Binary Proxy Execution, and rundll32 is the .011 sub-technique.
| Phase | Action |
|---|---|
| Resource Development | Registers a lookalike studio domain days before the campaign |
| Resource Development | Creates a company-branded X profile used for first contact |
| Resource Development | Hosts the trojanized game build on its own infrastructure |
| Initial Access | Emails an NFT game collaboration pitch with an executable to run |
| Initial Access | Related actor activity: trojanized PuTTY and malicious npm packages |
| Command and Control | npm packages fetch a second-stage payload from a hard-coded C2 |
| Defense Evasion | Renamed payload is executed through rundll32 |
| Type | Value |
|---|---|
| Sender | theodore.todtenhaupt@developingdreams[.]site |
| Domain | developingdreams[.]site |
| X profile | hxxps[://]x[.]com/Develop_Dreams |
| SHA-256 (DeTankWar.exe) | 56554117d96d12bd3504ebef2a8f28e790dd1fe583c33ad58ccbf614313ead8c |
| npm package | harthat-hash v1.3.3 |
| npm package | harthat-api v1.3.1 |
| C2 IP | 142.111.77[.]196 |
| Technique | ID | Description |
|---|---|---|
| Acquire Infrastructure: Domains | T1583.001 | Newly registered sender domain |
| Establish Accounts: Social Media Accounts | T1585.001 | Studio X profile used for first contact |
| Stage Capabilities: Upload Malware | T1608.001 | Game build hosted on actor infrastructure |
| Supply Chain Compromise: Compromise Software Supply Chain | T1195.002 | Trojanized PuTTY and malicious npm packages |
| System Binary Proxy Execution: Rundll32 | T1218.011 | Renamed payload loaded by rundll32 |
Treat newly registered sender domains as untrusted. The sending domain was created days before the email. Mail gateways that score or quarantine domains by age would have flagged the pitch before anyone read it.
Unsolicited collaboration offers with an executable are a known lure. Developers get approached over social media and then sent a build to run. Block or detonate executables arriving from first-time external senders, and tell staff that a “game to test” is a standard delivery method.
Pin and vet npm dependencies. The malicious packages looked like ordinary utilities and pulled a second stage at install time. Lock versions, review new packages before adding them, and alert on install scripts that make outbound connections.
Alert on rundll32 loading unusual file extensions. The payload was renamed to a database-style name and executed through a signed binary. A rundll32 command line pointing at a .db file or a path in a temp or package directory is a high-signal detection.
Feed vendor IOCs into hunting. The package names, versions and C2 address from the Datadog report let a team check lockfiles and egress logs for exposure without waiting for an alert.
A single phishing email led to a North Korean actor that runs fake game studios, trojanized tools and malicious npm packages. Nothing in the chain relied on exploits; the defence is in domain reputation, dependency hygiene and noticing a signed binary loading a renamed file.