Synapse Consulting
Home SynapseRM / TPRM Services Pricing About BlogCareersLabsContact
EN · FR
Test access Book a demo

Incident response · Infostealer · Credential theft · MITRE T1539

After the steal: triaging an infostealer log

An infostealer ran on a workstation and dropped a log: passwords, cookies, wallets, grabbed files. Verizon found 54% of ransomware victims had credentials leaked by infostealers first. Your job is to triage the damage and drive the response, and the single most dangerous item is not the passwords.

~60 minEstimated time
unzip · grep · a text editorTools
T1555.003 · T1539 · T1005MITRE ATT&CK
★★☆☆ IntermediateIR / TriageCredential theft

The sample

Filechallenge-06-stealer-log.zip
SHA-256fcf50ff377f947d33f705c9cb45ce2f8eddceaa425e4d0a595cc2f87dc03c133
ShapeStealC/Lumma-style log folder
ContextDropped on NORTHSEA-DEV (alex), 2026-06-16
⬇ Download the log (.zip)

All identifiers inside are synthetic (fictional passwords, TEST-NET IPs, .example domains). Never reuse them. Analyse in an isolated VM.

1. Scenario

Infostealers (Lumma, StealC, RedLine) do not exploit anything: they harvest what is already on the machine and upload a log. That log is sold, and buyers get instant access with no exploit. It is the quiet engine behind most account takeovers and a growing share of ransomware.

You receive the log pulled from NORTHSEA-DEV. Triage what was taken, rank it by impact, and hand IR a prioritised action list.

⚠️ Synthetic data. Every credential, cookie and token here is fictional. The exercise is the triage method, not the values.

2. Objectives

3. Step-by-step triage

1

Understand the log layout

unzip · find

A stealer log is a folder the malware exfiltrates whole. Unzip it and read the structure before diving in.

bash
unzip -o challenge-06-stealer-log.zip
find stealer-log-NORTHSEA-DEV -type f | sort
output
stealer-log-NORTHSEA-DEV/SystemInfo.txt
stealer-log-NORTHSEA-DEV/Passwords.txt
stealer-log-NORTHSEA-DEV/Cookies/Chrome_Default.txt
stealer-log-NORTHSEA-DEV/Autofills.txt
stealer-log-NORTHSEA-DEV/Wallets/wallets.txt
stealer-log-NORTHSEA-DEV/Tokens/discord_token.txt
stealer-log-NORTHSEA-DEV/FileGrabber/grabbed_files.txt
stealer-log-NORTHSEA-DEV/Software.txt
stealer-log-NORTHSEA-DEV/Screenshot.txt

💡 The folders map to ATT&CK collection: SystemInfo (T1082), Passwords (T1555.003), Cookies (T1539), FileGrabber (T1005), Screenshot (T1113).

2

Victim and host

SystemInfo.txt

Start with who and what: the system profile pins the victim and the machine.

bash
cat stealer-log-NORTHSEA-DEV/SystemInfo.txt
output
User:      alex
Computer:  NORTHSEA-DEV
Domain:    NORTHSEA
IP:        203.0.113.47 (TEST-NET-3, synthetic)
OS:        Windows 11 Pro 23H2
Log date:  2026-06-16 08:55:12 UTC

🔍 Same host as the disk and PDF labs: NORTHSEA-DEV, user alex. This log is how the ORION material and the developer identity leaked out.

3

Stolen credentials and reuse

grep

Count the saved passwords, then separate corporate from personal, and hunt for reuse.

bash
grep -c '^URL:' stealer-log-NORTHSEA-DEV/Passwords.txt        # 9
grep -A2 'northsea.example' stealer-log-NORTHSEA-DEV/Passwords.txt
grep -c 'Nsd!Spring2026' stealer-log-NORTHSEA-DEV/Passwords.txt   # reuse count
output
9
URL:  https://portal.northsea.example/login   USER: alex   PASS: Nsd!Spring2026
URL:  https://mail.northsea.example          USER: alex@northsea.example   PASS: Nsd!Spring2026
URL:  https://vpn.northsea.example           USER: alex
URL:  https://github.com/login               USER: northsea-dev
2

🔴 Password reuse: the corporate SSO password Nsd!Spring2026 is reused on the mailbox. One leak, several accounts. The GitHub login northsea-dev is the same alias tracked in the OSINT lab #03.

4

Session cookies, the MFA bypass

Cookies/

This is the item that matters most. A stolen session cookie lets an attacker resume an already-authenticated session, so MFA is never re-prompted (MITRE T1539).

bash
cat stealer-log-NORTHSEA-DEV/Cookies/Chrome_Default.txt
output
.northsea.example        TRUE  /  TRUE  1789200000  SSOSESSIONID  eyJ...ACTIVE-SSO
.github.com              TRUE  /  TRUE  1789200000  user_session  gh_sess...active
.exchange-crypto.example TRUE  /  TRUE  1789200000  cx_session    cx...active

🔴 Three active high-value sessions: corporate SSO, GitHub, crypto exchange. A password reset does NOT kill these, you must invalidate the sessions server-side. This is why infostealers beat MFA.

5

Wallets, tokens and grabbed files

Wallets / FileGrabber

Stealers also copy crypto wallets, chat tokens, and any documents matching their grabber rules.

bash
cat stealer-log-NORTHSEA-DEV/Wallets/wallets.txt
cat stealer-log-NORTHSEA-DEV/FileGrabber/grabbed_files.txt
output
Detected wallet: Exodus (vault + seed copied)   MetaMask (Chrome) vault copied

Desktop\orion-report.pdf
Documents\confidential-clients.txt
Downloads\orion-export.zip
Documents\meeting-notes.txt

🔔 The FileGrabber took orion-report.pdf and confidential-clients.txt. The confidential ORION report was exfiltrated here, this log ties the whole investigation together. The Exodus seed is compromised: those funds must be considered lost.

4. Incident response, in priority order

  1. Kill the active sessions first. Revoke every session for alex at the IdP/SSO (invalidate SSOSESSIONID), then GitHub and the crypto exchange. Cookies beat password resets.
  2. Re-enrol MFA for the account and force re-authentication on all devices.
  3. Rotate the reused password (Nsd!Spring2026) on the SSO, the mailbox, the VPN and anywhere else it appears.
  4. Revoke developer secrets for northsea-dev: GitHub PATs, SSH keys, CI tokens.
  5. Secure the wallet: move funds, the Exodus/MetaMask seed is compromised.
  6. Treat the grabbed files as exfiltrated: orion-report.pdf, confidential-clients.txt, orion-export.zip, follow the breach-notification policy.
  7. Isolate and image NORTHSEA-DEV, hunt the stealer and the initial access (see labs #01 and #05).

5. IOC and ATT&CK summary

TypeValueATT&CK
Host / victimNORTHSEA-DEV / alex, 203.0.113.47T1082
Credentials9 saved logins, corp SSO password reused x2T1555.003
Session cookiesSSOSESSIONID, user_session, cx_session (active)T1539
WalletsExodus seed + MetaMask vaultT1005
Grabbed filesorion-report.pdf, confidential-clients.txt, orion-export.zipT1005
Screenshotdesktop capture at logonT1113

6. References

MITRE T1539, Steal Web Session Cookie

Why session cookies let attackers bypass MFA.

MITRE T1555.003, Credentials from Web Browsers

How stealers harvest saved browser passwords.

Verizon DBIR 2025

Infostealer logs as a precursor to ransomware and account takeover.

How ClickFix delivers StealC, LevelBlue

A current delivery chain that ends in an infostealer log like this one.

← Back to Labs

Entirely fictional environment, for educational use only. All credentials and tokens are synthetic.

Synapse Consulting

A Belgium-based provider of cybersecurity solutions, and the team behind SynapseRM / TPRM.

PLATFORM
SynapseRM / TPRM Pricing Test accessPresentation (PDF)
SERVICES
Governance Operational Training
COMPANY
About Contact Blog Labs Careers Privacy & cookies
Brussels, Belgium