search

RogueOne

hashtag
Description

Your SIEM system generated multiple alerts in less than a minute, indicating potential C2 communication from Simon Stark's workstation. Despite Simon not noticing anything unusual, the IT team had him share screenshots of his task manager to check for any unusual processes. No suspicious processes were found, yet alerts about C2 communications persisted. The SOC manager then directed the immediate containment of the workstation and a memory dump for analysis. As a memory forensics expert, you are tasked with assisting the SOC team at Forela to investigate and resolve this urgent incident.

hashtag
Files

➜ 7z l .\RogueOne.zip

7-Zip 22.01 (x64) : Copyright (c) 1999-2022 Igor Pavlov : 2022-07-15

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2023-08-10 15:32:30 ....A   5368709120   1368046879  20230810.mem
------------------- ----- ------------ ------------  ------------------------
2023-08-10 15:32:30         5368709120   1368046879  1 files
➜ 7z x .\RogueOne.zip -p"hacktheblue"

hashtag
Tasks

hashtag
Task 1. Please identify the malicious process and confirm process id of malicious process.

➜ vol.exe -f .\20230810.mem windows.malfind.Malfind | tee malfind.log
➜ cat .\malfind.log | select -First 3
Volatility 3 Framework 2.7.0

PID     Process Start VPN       End VPN Tag     Protection      CommitCharge    PrivateMemory   File output     Notes   Hexdump Disasm
➜ cat .\malfind.log | sls '\.exe'

3136    MsMpEng.exe     0x2bb32980000   0x2bb32980fff   VadS    PAGE_EXECUTE_READWRITE  1       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb331f0000   0x2bb331f0fff   VadS    PAGE_EXECUTE_READWRITE  1       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb335b0000   0x2bb335b0fff   VadS    PAGE_EXECUTE_READWRITE  1       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb333f0000   0x2bb333f0fff   VadS    PAGE_EXECUTE_READWRITE  1       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb33400000   0x2bb33401fff   VadS    PAGE_EXECUTE_READWRITE  2       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb33490000   0x2bb33492fff   VadS    PAGE_EXECUTE_READWRITE  3       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb334a0000   0x2bb334a0fff   VadS    PAGE_EXECUTE_READWRITE  1       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb33510000   0x2bb33511fff   VadS    PAGE_EXECUTE_READWRITE  2       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb335f0000   0x2bb335f7fff   VadS    PAGE_EXECUTE_READWRITE  8       1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb34f70000   0x2bb3506ffff   VadS    PAGE_EXECUTE_READWRITE  256     1       Disabled       Function prologue
3136    MsMpEng.exe     0x2bb360e0000   0x2bb362dffff   VadS    PAGE_EXECUTE_READWRITE  512     1       Disabled       Function prologue
6812    svchost.exe     0x1b0000        0x1e1fff        VadS    PAGE_EXECUTE_READWRITE  50      1       Disabled       MZ header

The malfind plugin finds malicious programs and dumps details about them. What we should look for is MZ Header. MZ is Windows executable file signature (Magic Bytes if you will). If malfind identified the process as malicious and there's no other MZ headers then this program is definitely malicious.

circle-check

Answer: 6812

hashtag
Task 2. The SOC team believe the malicious process may spawned another process which enabled threat actor to execute commands. What is the process ID of that child process?

From Hacktricksarrow-up-right:

Filtering by PID reveals cmd.exe being spawned from svchost.exe

circle-check

Answer: 4364

hashtag
Task 3. The reverse engineering team need the malicious file sample to analyze. Your SOC manager instructed you to find the hash of the file and then forward the sample to reverse engineering team. What's the md5 hash of the malicious file?

Get the MD5 hash:

circle-check

Answer: 5BD547C6F5BFC4858FE62C8867ACFBB5

hashtag
Task 4. In order to find the scope of the incident, the SOC manager has deployed a threat hunting team to sweep across the environment for any indicator of compromise. It would be a great help to the team if you are able to confirm the C2 IP address and ports so our team can utilize these in their sweep.

circle-check

Answer: 13.127.155.166:8888

hashtag
Task 5. We need a timeline to help us scope out the incident and help the wider DFIR team to perform root cause analysis. Can you confirm time the process was executed and C2 channel was established?

The connection Created column can be seen in netscan.log

circle-check

Answer: 10/08/2023 11:30:03

hashtag
Task 6. What is the memory offset of the malicious process?

psscan.log contains program offset in hex.

circle-check

Answer: 0x9e8b87762080

hashtag
Task 7. You successfully analyzed a memory dump and received praise from your manager. The following day, your manager requests an update on the malicious file. You check VirusTotal and find that the file has already been uploaded, likely by the reverse engineering team. Your task is to determine when the sample was first submitted to VirusTotal.

From "Task 3" we got the hash of malicious program. We can use it to search the VirusTotal with 5BD547C6F5BFC4858FE62C8867ACFBB5 hash for already known malicious programs.

https://www.virustotal.com/gui/file/eaf09578d6eca82501aa2b3fcef473c3795ea365a9b33a252e5dc712c62981ea/detailsarrow-up-right

Writeup.png

We're interested in First Submission datetime.

circle-check

Answer: 10/08/2023 11:58:10

PreviousRecollectionNextUltimatum

Last updated