Go Hunting for Malware

Another Interesting Challenge from AISA CTF that I would like to blog about, is the final forensic challenge to find the following information, out of a malware infected system's memory dump

The Process ID of the malicious process ?

The Process ID of any spawned child processes ?

The date and time of when the initial Process ID was created ?

The attackers IP address ?

The port number the victim is connecting back to ?

The URL the user visited that let to the initial infection ?

And was provided with the memory dump "memoryisthekey.dmp"

So the above file is a RAM dump of the system after the infection, so then volatility is the best tool in further analyzing the dump

First we need to identify what profile we need to use with volatility. example: WINXP or 7, etc

So then i picked "Win7SP0x86", since there was not much changes between SP1 and SP0 memory storage

Lets check the process tree to identify the malicious process

Now the following processes were the ones i suspected. especially cmd.exe

So the user has did some operation in internet explorer (iexplore.exe) at 12:30, Which then spawned a new sub process rundll32.exe under the explorer.exe tree along with a cmd.exe process.

Lets check the established connections at that time

the process rundll32.exe has established a rogue connection with an foreign address at port 4444. Which is clearly abnormal. Also by default metasploit create handles on port 4444.

So at this point we have almost harvested 5/6 key informations needed. the next one is fetching the URL that the user visited which got him infected in first place

we can get the URL with a couple of ways

1. iexplore plugin (Lot of white noise)

2. yara scan (good if you define the process id as well)

3. wintree plugin (perfect when defined the process id)

Above is the example of the yarascan, which is hard to interpret. but if we use the wintree plugin we achieve the following result

So all the artefacts were collected and summary of them

The Process ID of the malicious process. - 2952

The Process ID of any spawned child processes. - 3112

The date and time of when the initial Process ID was created. - 2015-10-10 12:51:48

The attackers IP address. - 192.168.50.128

The port number the victim is connecting back to. - 4444

The urls the victim visited which intiated the infection - http://192.168.50.128/