LAB-13Medium

Suspicious API Chains

Read a binary's API imports as a capability narrative and determine its likely behavior.

15 min5 prerequisites5 tools

Investigate

Hints

Hint 1

InternetOpenW + InternetConnectW + HttpSendRequestW = an HTTP client.

Hint 2

RegCreateKeyExW + RegSetValueExW = write a startup entry.

Hint 3

Network + persistence + a temp path = a classic implant profile.

Submit Findings

Prerequisites

  • w5-winapi-native
  • sa2-imports-exports
  • WinINet API (InternetOpen, InternetConnect, HttpOpenRequest, HttpSendRequest)
  • Registry API (RegCreateKeyEx, RegSetValueEx)
  • File API (GetTempPath, CreateFile, WriteFile)

Methodology

Investigation Methodology

1. Group Imports by Capability

Map each DLL to functional category:

Category DLL Key APIs
Network (WinINet) WININET.dll InternetOpen, InternetConnect, HttpOpenRequest, HttpSendRequest, InternetReadFile
Network (WinHTTP) WINHTTP.dll WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpSendRequest
Network (Winsock) WS2_32.dll WSASocket, connect, send, recv, WSAConnect
Registry ADVAPI32.dll RegCreateKeyEx, RegSetValueEx, RegOpenKeyEx, RegDeleteValue
Filesystem KERNEL32.dll CreateFile, WriteFile, ReadFile, GetTempPath, CopyFile, MoveFile
Process KERNEL32.dll CreateProcess, OpenProcess, CreateThread, CreateRemoteThread
Memory KERNEL32.dll VirtualAlloc, VirtualAllocEx, VirtualProtect, VirtualProtectEx
Crypto ADVAPI32.dll / CRYPT32.dll CryptAcquireContext, CryptEncrypt, CryptDecrypt, CryptHashData

2. Read as Narrative (Verbs + Objects)

Don't just list APIs — read the sequence:

InternetOpenW()       → "I am an HTTP client"
InternetConnectW()    → "I connect to a server"
HttpSendRequestW()    → "I send data / request"

3. Identify Chains

Chain Capability
Open → Connect → Request → Read/Write HTTP C2
OpenKey → CreateKey → SetValue Registry persistence
GetTempPath → CreateFile → WriteFile File dropper
OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread Process injection
LoadLibrary → GetProcAddress → Call Dynamic resolution

4. Cross-Reference with Strings

  • C2 URLs → match to InternetConnectW host argument
  • Registry paths → match to RegCreateKeyEx key argument
  • File paths → match to CreateFile path argument

5. Score Confidence

  • Single API: Low (e.g., VirtualAlloc = legitimate heap use)
  • Chain (2-3): Medium
  • Full chain + strings + matching behavior: High

6. Build Behavioral Profile

Profile: C2 Beacon / Implant
Network:     WinINet HTTP (GET/POST to c2.domain)
Persistence: Run Key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run)
Drop:        %TEMP%\payload.exe
Injection:   None (but has OpenProcess + VirtualAllocEx = capability)

Common Pitfalls

  • Listing APIs without grouping into chains
  • Missing that `HttpOpenRequest` is between `InternetConnect` and `HttpSendRequest`
  • Confusing WinINet (high-level) with Winsock (low-level) — different detection
  • Overlooking `GetTempPath` → it's a strong dropper indicator
  • Not cross-referencing with strings (URLs, paths, keys)

Tools

  • Ghidra (Imports, Decompiler for call sequences)
  • PE-bear / CFF Explorer (Import Table)
  • API Monitor (dynamic)
  • Procmon (File/Reg/Network activity)
  • CAPA (Mandiant) — auto capability detection

References

  • Lesson W5: WinAPI & Native
  • Lesson SA2: Imports & Exports
  • Microsoft Docs: WinINet API Reference
  • MITRE ATT&CK: API-to-Technique mapping
  • CAPA Rules (GitHub)

Extensions & Challenges

  • Write a Ghidra script to auto-detect API chains in a binary
  • Build a CAPA rule for a custom capability
  • Analyze a sample with both WinINet and Winsock — why both?
  • Research: How to detect API hashing (no static imports)?
  • Create a behavioral profile template for your team