RedLine Lab (CyberDefenders)

Scenario

As a member of the Security Blue team, your assignment is to analyze a memory dump using Redline and Volatility tools. Your goal is to trace the steps taken by the attacker on the compromised machine and determine how they managed to bypass the Network Intrusion Detection System (NIDS). Your investigation will identify the specific malware family employed in the attack and its characteristics. Additionally, your task is to identify and mitigate any traces or footprints left by the attacker.

Q1 : What is the name of the suspicious process?

I used Volatility 3, and The command used to analyze the memory dump in this case is as follows:

python vol.py -f MemoryDump.mem windows.pstree

While examining the process tree, one process stands out as suspicious: oneetx.exe.

Why Is oneetx.exe Suspicious?

The process oneetx.exe shows two suspicious indicators:

1. File Location: It is located in the user’s Temp directory, a location commonly abused by attackers to store and execute malicious files.
2. Parent Process: Its parent process is fontdrvhost.exe. Although this is a legitimate Windows process, this unusual parent-child relationship requires further investigation.

Answer:

oneetx.exe

Q2 : What is the child process name of the suspicious process?

To identify the child process of oneetx.exe, I filtered the process tree using its PID (5896).

python vol.py -f MemoryDump.mem windows.pstree | grep  "5896"

Answer:

rundll32.exe

Q3 : What is the memory protection applied to the suspicious process memory region?

To inspect suspicious memory regions within oneetx.exe, I used Volatility 3's windows.malfind plugin.

python vol.py -f MemoryDump.mem windows.malfind --pid 5896

Result

The output shows that the suspicious process oneetx.exe (PID 5896) has the following memory protection: PAGE_EXECUTE_READWRITE

Explanation

PAGE_EXECUTE_READWRITE is a Windows memory protection setting that allows a memory region to be:

• Read: Read data from memory.
• Write: Modify or write data into memory.
• Execute: Execute code stored in memory.

This permission can be abused by malware to store and execute injected code directly in memory.

Answer:

PAGE_EXECUTE_READWRITE

Q4 : What is the name of the process responsible for the VPN connection?

To identify the process responsible for the VPN connection, I examined the process tree and found tun2socks.exe running as a child process of Outline.exe.

Result

Get Youssef Mahrous’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The process tree shows that tun2socks.exe is running as a child process of Outline.exe.

Explanation

Outline.exe is the VPN client, while tun2socks.exe handles the network traffic tunneling by forwarding traffic between the virtual network interface and the proxy connection.

Therefore, tun2socks.exe is the process responsible for handling the VPN tunnel.

Answer:

Outline.exe

Q5 : What is the attacker’s IP address?

To identify the remote IP address associated with the suspicious process, I used Volatility 3’s windows.netscan plugin and filtered the results using the process PID (5896).

python vol.py -f MemoryDump.mem windows.netscan | grep "5896"

Result : The windows.netscan output shows a network connection associated with the suspicious process oneetx.exe (PID 5896).

• Local IP: 10.0.85.2
• Foreign IP: 77.91.124.20
• Foreign Port: 80
• Protocol: TCPv4
• State: CLOSED

Explanation : The Foreign IP address represents the remote endpoint that the process attempted to communicate with. Since the connection belongs to oneetx.exe, the remote IP 77.91.124.20 is identified as the attacker's IP address in this lab.

Answer:

77.91.124.20

Q6 : What is the full URL of the PHP file that the attacker visited?

To identify the URL visited by the attacker, I used the Strings utility to extract readable strings from the memory dump and filtered the results using the attacker’s IP address.

./strings64.exe MemoryDump.mem | grep 77.91.124.20

Answer:

http://77.91.124.20/store/games/index.php

Q7 : What is the full path of the malicious executable?

Use the Volatility filescan plugin to scan memory for file objects, then search the results for the suspicious executable to identify its complete file path.

python vol.py -f MemoryDump.mem windows.filescan | grep "oneetx.exe"

Answer:

 C:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe