Command & Control

The Implant’s Lifeline

C2 (command and control) is how an implant receives orders and exfiltrates data. Understanding it is the core of both analysis and defense.

Common C2 Channels

Channel	APIs / traits
HTTP/HTTPS	InternetOpen, WinHTTP, HttpSendRequest — blends with web traffic
Raw TCP/UDP	socket, connect, send/recv
DNS	queries to a domain; data in subdomains (DNS tunneling)
Social/platforms	GitHub, Twitter, Discord as relay

Beaconing

Most implants beacon — they check in on a schedule (every N seconds). Detection: regular periodic network connections to a rarely-seen domain. Defenders graph connection frequency to spot beacons.

Extracting C2 Config

The C2 config (domain, port, protocol, keys) is often:

• Hardcoded — visible in strings.
• Encrypted — decrypted in memory at runtime (recover via debugging).
• Embedded as a resource — a config blob in .rsrc.

To find it statically: locate the network APIs, find the address/port they use, and trace where those values come from.

The C2 Narrative in Code

; HINTERNET InternetConnectW(hInternet, lpszServerName, nServerPort, ...)
; Win64 calling convention: arg1=RCX, arg2=RDX, arg3=R8D, ...
mov  rcx, rax           ; hInternet, from a prior InternetOpenW call
lea  rdx, [c2_domain]   ; lpszServerName = "c2.example.com"
mov  r8d, 443           ; nServerPort
call InternetConnectW   ; connect to host:443

Read the arguments in register order: handle, domain, port, protocol = the C2 endpoint.

Takeaway

C2 is the point of the whole operation. Find it, and you understand the mission.

Lab 15: C2 Configuration Extraction → C2 Configuration Extraction