“In this scenario, the Security Information and Event Management (SIEM) system at Forela has detected a series of alerts in a brief period, signaling potential Command and Control (C2) communication originating from an employee, Simon Stark's, workstation. Despite Simon not observing any anomalies, the IT team conducted a preliminary investigation by reviewing screenshots of his task manager for any unusual processes, but found nothing out of the ordinary.”
Your SIEM system generated multiple alerts in less than a minute, indicating potential C2 communication from Simon Stark's workstation. Despite Simon not noticing anything unusual, the IT team had him share screenshots of his task manager to check for any unusual processes. No suspicious processes were found, yet alerts about C2 communications persisted. The SOC manager then directed the immediate containment of the workstation and a memory dump for analysis. As a memory forensics expert, you are tasked with assisting the SOC team at Forela to investigate and resolve this urgent incident.
Easy - DFIR
First, we need to download the Volatility framework in our machine. I will be using Volatility 2 and 3:
- To download Volatility 2, visit the archived GitHub repo, download the Linux standalone zip file and extract the executable. You can delete everything else and keep the executable.
- To download Volatility 3, simply use
gitin the terminal to clone the repo:git clone https://github.com/volatilityfoundation/volatility3.git. Use thevol.pyfile to interact with Volatility.
- Please identify the malicious process and confirm process id of malicious process.
By using some process information modules from Volatility 3, we can learn more information that could lead to us discovering a potentially malicious process in the machine. After using the windows.cmdline module, we can observe a strange process being executed in an unusual location.
└──╼ [★]$ volatility3/vol.py -f 20230810.mem windows.cmdline
...
6812 svchost.exe "C:\Users\simon.stark\Downloads\svchost.exe"
...svchost.exe is not supposed to be in the Downloads folder of any user…
- The SOC team believe the malicious process may spawned another process which enabled threat actor to execute commands. What is the process ID of that child process?
Using the windows.pstree module, we can find evidence that the suspicious svchost.exe executable spawned a cmd.exe instance.
The cmd.exe process allowed the attacker to execute commands.
- The reverse engineering team need the malicious file sample to analyze. Your SOC manager instructed you to find the hash of the file and then forward the sample to reverse engineering team. Whats the md5 hash of the malicious file?
Let's use the windows.filescan module to locate the offset of the suspicious svchost.exe file.
└──╼ [★]$ volatility3/vol.py -f 20230810.mem windows.filescan | grep "simon.stark" | grep Downloads | grep svchost.exe
0x9e8b909045d0.0\Users\simon.stark\Downloads\svchost.exe
0x9e8b91ec0140 \Users\simon.stark\Downloads\svchost.exeNow, let's try dumping the file using the given offset with windows.dumpfiles:
└──╼ [★]$ volatility3/vol.py -f 20230810.mem -o svchost-dump windows.dumpfiles --physaddr 0x9e8b91ec0140
Volatility 3 Framework 2.28.1
Progress: 100.00 PDB scanning finished
Cache FileObject FileName ResultThe file was dumped successfully! At first, I tried using --virtaddr but it failed, which means that there are two files inside svchost-dump. These are the files dumped to the output directory:
└──╼ [★]$ ls
file.0x9e8b91ec0140.0x9e8b90819750.DataSectionObject.svchost.exe.dat file.0x9e8b91ec0140.0x9e8b957f24c0.ImageSectionObject.svchost.exe.imgUsing simple static analysis, we can determine which is the correct file and calculate the MD5 hash of the executable.
- In order to find the scope of the incident, the SOC manager has deployed a threat hunting team to sweep across the environment for any indicator of compromise. It would be a great help to the team if you are able to confirm the C2 IP address and ports so our team can utilise these in their sweep.
We can find our answer easily by checking the active network connections with the windows.netstat module and focusing on the network connection established by PID 6812 (svchost.exe).
The established connection with an unusual port number is our malicious connection.
- We need a timeline to help us scope out the incident and help the wider DFIR team to perform root cause analysis. Can you confirm time the process was executed and C2 channel was established?
The answer can be found in the Created timestamp from the windows.netstat output.
- What is the memory offset of the malicious process?
This can be found by going back to the windows.pstree output and reading the Offset(V) field corresponding to the PID 6812 process.
- You successfully analyzed a memory dump and received praise from your manager. The following day, your manager requests an update on the malicious file. You check VirusTotal and find that the file has already been uploaded, likely by the reverse engineering team. Your task is to determine when the sample was first submitted to VirusTotal.
Simply navigate to VirusTotal using the MD5 hash found before and find the Creation Time field by reading Details > History.
