Scenario: As a member of the Security Blue Team, the assignment was to analyze a memory dump
using Volatility to trace the steps taken by an attacker on a compromised machine and determine how they
bypassed the Network Intrusion Detection System (NIDS). The investigation needed to identify the malware
family used, its behavior, and any indicators left behind by the attacker.
Q1What is the name of the suspicious process?
vol -f MemoryDump.mem windows.malfind
A hidden
MZ header inside an executable memory region that doesn't belong there is a classic sign of process hollowing or code injection — the malware hid its code inside a normal-looking process.answeroneetx.exe
Q2What is the child process name of the suspicious process?
vol -f MemoryDump.mem windows.pstree
oneetx.exe (PID 5896) spawned rundll32.exe (PID 7732) — a standard Windows utility frequently abused by attackers to masquerade as legitimate system activity while executing malicious payloads.
answerrundll32.exe
Q3What is the memory protection applied to the suspicious process memory region?
Already visible in the Q1 malfind output above.
answerPAGE_EXECUTE_READWRITE
Q4What is the name of the process responsible for the VPN connection?
vol -f MemoryDump.mem windows.netscan && vol -f MemoryDump.mem windows.pstree
Both
Outline.exe and tun2socks.exe share PID 6724 — the attacker tunneled traffic through the legitimate Outline VPN client to slip past the NIDS.answerOutline.exe
Q5What is the attacker's IP address?
vol -f MemoryDump.mem windows.netscan
A closed TCP connection from
oneetx.exe (PID 5896) on port 80 reveals the C2 host.answer77.91.124.20
Q6What is the full URL of the PHP file that the attacker visited?
strings MemoryDump.mem | grep "http://77.91.124.20"
Raw string extraction from the memory image surfaces every URL touched by the malware, including its callback endpoint.
answerhttp://77.91.124.20/store/games/index.php
Q7What is the full path of the malicious executable?
vol -f MemoryDump.mem windows.filescan | grep -i "oneetx.exe"
filescan locates every file object referenced in the memory image, including the dropped payload's on-disk path.
answerC:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe
IOC Summary
| Item | Value |
|---|---|
| Suspicious Process | oneetx.exe (PID 5896) |
| Malicious Child Process | rundll32.exe (PID 7732) |
| Memory Protection | PAGE_EXECUTE_READWRITE |
| VPN / Tunneling Process | Outline.exe / tun2socks.exe (PID 6724) |
| Attacker IP | 77.91.124.20 |
| C2 URL | http://77.91.124.20/store/games/index.php |
| Malicious Executable Path | C:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe |
Lessons learned:
windows.malfind is the fastest way to spot process hollowing —
an MZ header sitting inside a PAGE_EXECUTE_READWRITE region is rarely legitimate. Once the parent process was
identified, pstree revealed the full execution chain down to the LOLBin (rundll32.exe) used to blend
in with normal system activity. netscan tied the malware to both its C2 channel and the Outline VPN
client the attacker used to tunnel traffic past the NIDS — a reminder that legitimate-looking network tools are a
common bypass method. Raw string extraction from the memory image surfaced the exact C2 URL, and
filescan pinpointed the dropped payload's path on disk for IOC documentation.