---
# System prepended metadata

title: RedLine Blue Team Challenge

---

# RedLine Blue Team Challenge

:::success
https://cyberdefenders.org/blueteam-ctf-challenges/106#nav-questions
:::


:::info
Scenario:

As a member of the Security Blue team, your assignment is to analyze a memory dump using Redline and Volatility tools. Your goal is to trace the steps taken by the attacker on the compromised machine and determine how they managed to bypass the Network Intrusion Detection System "NIDS". Your investigation will involve identifying the specific malware family employed in the attack, along with its characteristics. Additionally, your task is to identify and mitigate any traces or footprints left by the attacker.

Tools:

Volatility
:::



#### 1. What is the name of the suspicious process?
```
oneetx.exe
```


使用windows.info確認記憶體的OS版本，該主機使用的是windows10。
![截圖 2023-12-01 上午11.36.03](https://hackmd.io/_uploads/ryMhN0LHa.jpg)

使用windows.malfind指令可以快速列舉出可能是惡意程式的檔案(僅參考用)，使用後volatility顯示oneetx.exe(pid 5896)、smartscreen.ex(pid 7540)可能是惡意程式。

![截圖 2023-12-01 上午11.49.57](https://hackmd.io/_uploads/SkVxd0Urp.jpg)

將檔案dump下來用virustotal查詢，發現oneetx.exe是惡意程式(piperazine)

![截圖 2023-12-01 下午12.02.30](https://hackmd.io/_uploads/SJ8JoRUST.jpg)


![截圖 2023-12-01 下午12.05.03](https://hackmd.io/_uploads/H1xYiRIBp.jpg)


![截圖 2023-12-01 下午12.07.18](https://hackmd.io/_uploads/S1N-3R8Ha.jpg)



參考資料：
https://cpuu.hashnode.dev/an-introduction-to-volatility-3

https://volatility3.readthedocs.io/en/latest/vol2to3.html

https://volatility3.readthedocs.io/en/v2.0.1/volatility3.plugins.html

https://dfir.science/2022/02/Introduction-to-Memory-Forensics-with-Volatility-3

#### 2. What is the child process name of the suspicious process?
```
rundll32.exe
```

用windows.pstree查詢，可以看到oneetx會執行rundll32.exe
![截圖 2023-12-01 下午12.09.16](https://hackmd.io/_uploads/rJs_h0Ura.jpg)

#### 3. What is the memory protection applied to the suspicious process memory region?
```
PAGE_EXECUTE_READWRITE
```
承第1題，oneetx.exe的memory protection是PAGE_EXECUTE_READWRITE
![截圖 2023-12-01 上午11.49.57](https://hackmd.io/_uploads/SkVxd0Urp.jpg)


參考資料：
https://learn.microsoft.com/zh-tw/windows/win32/memory/memory-protection-constants

#### 4. What is the name of the process responsible for the VPN connection?
```
Outline.exe
```
用windows.netscan查詢，可以看到有一個process tun2socks.exe(pid 4628)，從檔名上看起來疑似和網路連線有關。
![截圖 2023-12-01 下午2.27.15](https://hackmd.io/_uploads/ByMRnxwrp.jpg)

用windows.pstree查詢，發現tun2socks.exe是由Outline.exe執行起來的。
![截圖 2023-12-01 下午1.51.04](https://hackmd.io/_uploads/ByPINlDST.jpg)

搜尋Outline.exe發現他是VPN軟體
![截圖 2023-12-01 下午2.30.50](https://hackmd.io/_uploads/rydsalPSp.jpg)


#### 5. What is the attacker's IP address?
```
77.91.124.20
```
用windows.netscan查詢，grep剛剛發現的幾個process，會看到ip 77.91.124.20與惡意程式oneetx.exe有關，另外ip 38.121.43.65與VPN有關。

![截圖 2023-12-01 下午2.39.34](https://hackmd.io/_uploads/rJL3yWvBT.jpg)


#### 6. Based on the previous artifacts. What is the name of the malware family?
```
RedLine Stealer
```

這一題沒辦從既有的證據去找出來，依據剛剛virustotal的結果，用piperazine.exe去搜尋會看到一筆anyrun的報告，其中threats資訊中有將它定義成redline stealer。
![截圖 2023-12-01 下午2.57.39](https://hackmd.io/_uploads/rkfxNZwH6.jpg)


#### 7. What is the full URL of the PHP file that the attacker visited?
```
http://77.91.124.20/store/games/index.php
```


在知道該主機有使用執行惡意程式oneetx.exe(pid 5896)後，利用windows.vadyarascan來查詢的相關紀錄。

首先需要寫一支yara檔，從答案輸入的格式提示我們可以知道url應該是http開頭，另外題目說明是php所以我們條件設定是php結尾，yara rules file如下：

```json
rule with_urls
{
        strings:
                $http_url_regex = /http?:\/\/([\w\.-]+)([\/\w \.-]*).php./
        condition:
                all of them
}
```

因為輸出會是hex dump，所以要再利用xxd將格式轉轉換

```
| awk '
   /^0x/{
         S=""
         for(i=5; i<NF; i++) {
               S=S sprintf("%s", $i)
         }
         print "PID:" $2 "\tRule:" $3 "\tComponent:" $4
         system("echo " S " | xxd -r -ps | xxd -o " $1 " | sed \"s/^/0x/\"")
         print ""
         next
    }
    /^Offset/{next}
    {print}
'

```


![截圖 2023-12-01 下午8.26.42](https://hackmd.io/_uploads/BkmfbLDHp.jpg)

和前面的題目發現的符合，有向http://77.91.124.20/store/games/index.php 連線的行為。

#### 8. What is the full path of the malicious executable?
```
C:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe
```

用windows.filescan查詢，grep 我們已知的惡意程式名稱oneetx.exe
![截圖 2023-12-01 下午8.43.58](https://hackmd.io/_uploads/HkpGSLvBp.jpg)
