RogueOne a HTB Writeup

This writeup documents my analysis of the RogueOne sherlock on Hackthebox. In this challenge we are given a memory dump of a machine suspected to be compromised. Let’s analyze it…

Please identify the malicious process and confirm the process ID of the malicious process.

Parsing the memory dump using volatility3’s windows.cmdline, a conspicuous process immediately stands out. svchost.exe is a core Windows process that enables running background services from DLL files and typically lives in “C:\WINDOWS\system32\svchost.exe” and is often run with the -k argument. This process does neither of that, and the fact that it resides in the Downloads folder confirms this is the malicious process. The answer here is the PID, which is 6812.

The SOC team believe the malicious process may have spawned another process which enabled the threat actor to execute commands. What is the process ID of that child process?

Running the volatility3 windows.pstree plugin and searching for PID 6812, the only child process it spawned is cmd.exe with a PID of 4364.

** 6812 7436 svchost.exe 0x9e8b87762080 3 - 1 False 2023-08-10 11:30:03.000000 UTC N/A \Device\HarddiskVolume3\Users\simon.stark\Downloads\svchost.exe "C:\Users\simon.stark\Downloads\svchost.exe" C:\Users\simon.stark\Downloads\svchost.exe
**** 4364 6812 cmd.exe 0x9e8b8b6ef080 1 - 1 False 2023-08-10 11:30:57.000000 UTC N/A \Device\HarddiskVolume3\Windows\System32\cmd.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe

The reverse engineering team need the malicious file sample to analyze. Your SOC manager instructed you to find the hash of the file and then forward the sample to the reverse engineering team. What’s the MD5 hash of the malicious file?

Scanning for the malicious file using the windows.filescan plugin:

python3 vol.py -f ./RogueOne/20230810.mem windows.filescan | grep -i "svchost"

Identifying the offset for the malicious svchost executable, we can dump it using the windows.dumpfiles plugin and calculate the MD5 hash of the file, giving us the answer 5bd547c6f5bfc4858fe62c8867acfbb5.

In order to find the scope of the incident, the SOC manager has deployed a threat hunting team to sweep across the environment for any indicators of compromise. It would be a great help to the team if you are able to confirm the C2 IP address and ports so our team can utilise these in their sweep.

For this we can simply use the volatility3 windows.netstat plugin. Searching for the malicious PID 6812, we can see that the C2 IP is 13.127.155.166:8888.

0x9e8b8cb58010 TCPv4 172.17.79.131 64254 13.127.155.166 8888 ESTABLISHED 6812 svchost.exe 2023-08-10 11:30:03.000000 UTC

We need a timeline to help us scope out the incident and help the wider DFIR team perform root cause analysis. Can you confirm the time the process was executed and the C2 channel was established?

From the previous question, we can see that the socket to the C2 server was created at 10/08/2023 11:30:03.

What is the memory offset of the malicious process?

We can simply run the volatility3 windows.pslist plugin and fetch the offset from there.

PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output
6812 7436 svchost.exe 0x9e8b87762080 3 - 1 False 2023-08-10 11:30:03.000000 UTC N/A Disabled

You successfully analyzed a memory dump and received praise from your manager. The following day, your manager requests an update on the malicious file. You check VirusTotal and find that the file has already been uploaded, likely by the reverse engineering team. Your task is to determine when the sample was first submitted to VirusTotal.

Searching VirusTotal with the MD5 hash of the malicious process, I found the first submission date to be 2023-08-10 11:58:10.

Alright, that marks the end of the sherlock. This was a short one but still valuable. Stay safe.