Employ Volatility to analyze a memory dump, identifying suspicious processes, network IOCs, memory protections, and attacker's command-and-control infrastructure.
As a member of the Security Blue team, your assignment is to analyze a memory dump using Redline and Volatility tools. Your goal is to trace the steps taken by the attacker on the compromised machine and determine how they managed to bypass the Network Intrusion Detection System (NIDS). Your investigation will identify the specific malware family employed in the attack and its characteristics. Additionally, your task is to identify and mitigate any traces or footprints left by the attacker.
Easy - Endpoint Forensics | Completion Achievement
We are provided with a MemoryDump.mem file. To interact with it, we will be using the Volatility framework.
- To download Volatility 2, visit the archived GitHub repo, download the Linux standalone zip file and extract the executable. You can delete everything else and keep the executable.
- To download Volatility 3, simply use
gitin the terminal to clone the repo:git clone https://github.com/volatilityfoundation/volatility3.git. Use thevol.pyfile to interact with Volatility.
- What is the name of the suspicious process?
Let's look for interesting processes using windows.pstree. Let's filter these events using grep Users to find executables ran under the Users directory, which is suspicious for an executable:
$ ./volatility3/vol.py -f MemoryDump.mem windows.pstree | grep Users
*** 5480: 100.0448 oneetx.exeB scan0xad818d3d6080 6 - 1 True 2023-05-21 23:03:00.000000 UTC N/A \Device\HarddiskVolume3\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe - -
5896 8844 oneetx.exe 0xad8189b41080 5 - 1 True 2023-05-21 22:30:56.000000 UTC N/A \Device\HarddiskVolume3\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe - -Let's look deeper into this event throughout our investigation.
- What is the child process name of the suspicious process?
Inside the windows.pstree output, we can see a child process coming from PID 5896:
5896 8844 oneetx.exe 0xad8189b41080 5 - 1 True 2023-05-21 22:30:56.000000 UTC N/A \Device\HarddiskVolume3\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe - -
* 7732 5896 rundll32.exe 0xad818d1912c0 1 - 1 True 2023-05-21 22:31:53.000000 UTC N/A \Device\HarddiskVolume3\Windows\SysWOW64\rundll32.exe - -- What is the memory protection applied to the suspicious process memory region?
Let's for any suspicious processes based on suspicious memory spaces by using the windows.malfind module:
$ ./volatility3/vol.py -f MemoryDump.mem windows.malfind
...
5896 oneetx.exe 0x400000 0x437fff VadS PAGE_EXECUTE_READWRITE 56 1 Disabled MZ header
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ..............
...The PAGE_EXECUTE_READWRITE string refers to a memory constants that "enables execute, read-only, or read/write access to the committed region of pages." based on official Microsoft docs. For security reasons, we should be able to write XOR execute a file (Wikipedia).
- What is the name of the process responsible for the VPN connection?
Looking back at the list of process with windows.pslist, we can find a suspicious process related to networking:
4628 6724 tun2socks.exe 0xad818de82340 0 - 1 True 2023-05-21 22:40:10.000000 UTC 2023-05-21 23:01:24.000000 UTC DisabledThe tun2socks.exe executable is used to create a network proxy, which is one of the functions of a VPN:
This process also appears in the windows.netscan output:
0xad8190e5b040 UDPv4 0.0.0.0 49734 * 0 4628 tun2socks.exe 2023-05-21 23:00:41.000000 UTCThe PPID of this process is 6724, let's find the name of the process that is responsible for this VPN connection:
6724 3580 Outline.exe 0xad818e578080 0 - 1 True 2023-05-21 22:36:09.000000 UTC 2023-05-21 23:01:24.000000 UTC Disabled- What is the attacker's IP address?
At first, I thought I had to get the IP address related to the tunnel created by tun2socks.exe. However, that wasn't the correct answer. Going back to Q1, we need to find network connections related to the oneetx.exe executable, the first suspicious executable we found:
- What is the full URL of the PHP file that the attacker visited?
Let's dump the memory of the first suspicious process we found:
$ ./volatility3/vol.py -f MemoryDump.mem -o oneetx-dump windows.memmap.Memmap --pid 5896 --dumpThe oneetx-dump directory will now contain a raw memory dump of the malicious process. Using strings and grep, we can find the PHP file that the attacker visited:
- What is the full path of the malicious executable?
Let's use the windows.filescan module to find any instances of the oneetx.exe file inside memory.
$ ./volatility3/vol.py -f MemoryDump.mem windows.filescan | grep oneetx.exe
0xad818d436c70.0\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe
0xad818da36c30 \Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe
0xad818ef1a0b0 \Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exeThe drive letter of the file path is C:.