search

BankingTroubles - Memory Image Forensics

What was the local IP address for the victim's machine?

$ volatility -f Bob.vmem imageinfo
Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
                     AS Layer2 : FileAddressSpace (/home/hnl/Desktop/ctf/cyberdefenders/banking-trouble/Bob.vmem)
                      PAE type : PAE
                           DTB : 0x319000L
                          KDBG : 0x80544ce0L
          Number of Processors : 1
     Image Type (Service Pack) : 2
                KPCR for CPU 0 : 0xffdff000L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2010-02-27 20:12:38 UTC+0000
     Image local date and time : 2010-02-27 15:12:38 -0500

$ volatility -f Bob.vmem --profile=WinXPSP2x86 connections
Volatility Foundation Volatility Framework 2.6
Offset(V)  Local Address             Remote Address            Pid
---------- ------------------------- ------------------------- ---
0x81c6a9f0 192.168.0.176:1176        212.150.164.203:80        888
0x82123008 192.168.0.176:1184        193.104.22.71:80          880
0x81cd4270 192.168.0.176:2869        192.168.0.1:30379         1244
0x81e41108 127.0.0.1:1168            127.0.0.1:1169            888
0x8206ac58 127.0.0.1:1169            127.0.0.1:1168            888
0x82108890 192.168.0.176:1178        212.150.164.203:80        1752
0x82210440 192.168.0.176:1185        193.104.22.71:80          880
0x8207ac58 192.168.0.176:1171        66.249.90.104:80          888
0x81cef808 192.168.0.176:2869        192.168.0.1:30380         4
0x81cc57c0 192.168.0.176:1189        192.168.0.1:9393          1244
0x8205a448 192.168.0.176:1172        66.249.91.104:80          888

What was the OS variable value?

What was the Administrator's password?

Which process was most likely responsible for the initial exploit?

What is the extension of the malicious file retrieved from the process responsible for the initial exploit?

Suspicious processes opened network connections to external IPs. Provide the two external IP addresses. (comma-separated without spaces, ascending)

A suspicious URL was present in process svchost.exe memory. Provide the full URL that points to a PHP page hosted over a public IP (no FQDN).

Extract files from the initial process. One file has an MD5 hash ending with "528afe08e437765cc. When was this file first submitted for analysis on VirusTotal?

What was the PID of the process that loaded the file PDF.php?

The JS includes a function meant to hide the call to function eval(). Provide the name of that function.

The payload includes 3 shellcodes for different versions of Acrobat reader. Provide the function name that corresponds to Acrobat v9.

Process winlogon.exe hosted a popular malware that was first submitted for analysis at VirusTotal on 2010-03-29 11:34:01. Provide the MD5 hash of that malware.

What is the name of the malicious executable referenced in registry hive '\WINDOWS\system32\config\software', and is variant of ZeuS trojan?

The shellcode for Acrobat v7 downloads a file named e.exe from a specific URL. Provide the URL.

The shellcode for Acrobat v8 exploits a specific vulnerability. Provide the CVE number.

PreviousMemory ForensicsNextDumpMe - Memory Image Forensics

Last updated