Scenario

An after-hours alert from the Endpoint Detection and Response (EDR) system flags suspicious activity on a Windows workstation. The flagged malware aligns with the Amadey Trojan Stealer. Your job is to analyze the presented memory dump and create a detailed report for actions taken by the malware.

https://cyberdefenders.org/blueteam-ctf-challenges/amadey/

1- In the memory dump analysis, determining the root of the malicious activity is essential for comprehending the extent of the intrusion. What is the name of the parent process that triggered this malicious behavior?

lssass.exe

First, I ran the pstree plugin, and from the output, I noticed a process named lssass.exe, which is suspicious for several reasons. First, the name is misspelledlikely a form of masquerading. Second, the legitimate lsass.exe process should not spawn any child processes. However, here it spawned rundll32.exe, a tool commonly abused by attackers to execute malicious code via DLL files.

2- Once the rogue process is identified, its exact location on the device can reveal more about its nature and source. Where is this process housed on the workstation?

C:\Users\0XSH3R~1\AppData\Local\Temp\925e7e99c5\lssass.exe

We can obtain this information using either the filescan or cmdline plugin. The executable is located in the Temp directory, which immediately raises red flags. This location is commonly abused by malware to drop payloads because temporary folders are usually writable by standard users, making them an ideal target for attackers trying to bypass administrative privileges.

3- Persistent external communications suggest the malware's attempts to reach out C2C server. Can you identify the Command and Control (C2C) server IP that the process interacts with?

41.75.84.12

Using the netscan plugin and filtering either by the PID 2478 of lssass.exe or by the process name itself, we can observe two closed connections—both made to 41.75.84.12 over port 80, which is typically used for HTTP traffic. The use of port 80 suggests an attempt to blend malicious communication with regular web traffic, making it harder for firewalls and intrusion detection systems to detect the activity.