CyberDefendersEndpoint ForensicsEasyRetiredVolatility 3 · Strings
Scenario: As a member of the Security Blue Team, the assignment was to analyze a memory dump using Volatility to trace the steps taken by an attacker on a compromised machine and determine how they bypassed the Network Intrusion Detection System (NIDS). The investigation needed to identify the malware family used, its behavior, and any indicators left behind by the attacker.
Q1What is the name of the suspicious process?
vol -f MemoryDump.mem windows.malfind
What is the name of the suspicious process?
A hidden MZ header inside an executable memory region that doesn't belong there is a classic sign of process hollowing or code injection — the malware hid its code inside a normal-looking process.
answeroneetx.exe
Q2What is the child process name of the suspicious process?
vol -f MemoryDump.mem windows.pstree
What is the child process name of the suspicious process?
oneetx.exe (PID 5896) spawned rundll32.exe (PID 7732) — a standard Windows utility frequently abused by attackers to masquerade as legitimate system activity while executing malicious payloads.
answerrundll32.exe
Q3What is the memory protection applied to the suspicious process memory region?
Already visible in the Q1 malfind output above.
answerPAGE_EXECUTE_READWRITE
Q4What is the name of the process responsible for the VPN connection?
vol -f MemoryDump.mem windows.netscan && vol -f MemoryDump.mem windows.pstree
What is the name of the process responsible for the VPN connection?
What is the name of the process responsible for the VPN connection?
Both Outline.exe and tun2socks.exe share PID 6724 — the attacker tunneled traffic through the legitimate Outline VPN client to slip past the NIDS.
answerOutline.exe
Q5What is the attacker's IP address?
vol -f MemoryDump.mem windows.netscan
What is the attacker's IP address?
A closed TCP connection from oneetx.exe (PID 5896) on port 80 reveals the C2 host.
answer77.91.124.20
Q6What is the full URL of the PHP file that the attacker visited?
strings MemoryDump.mem | grep "http://77.91.124.20"
What is the full URL of the PHP file that the attacker visited?
Raw string extraction from the memory image surfaces every URL touched by the malware, including its callback endpoint.
answerhttp://77.91.124.20/store/games/index.php
Q7What is the full path of the malicious executable?
vol -f MemoryDump.mem windows.filescan | grep -i "oneetx.exe"
What is the full path of the malicious executable?
filescan locates every file object referenced in the memory image, including the dropped payload's on-disk path.
answerC:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe

IOC Summary

ItemValue
Suspicious Processoneetx.exe (PID 5896)
Malicious Child Processrundll32.exe (PID 7732)
Memory ProtectionPAGE_EXECUTE_READWRITE
VPN / Tunneling ProcessOutline.exe / tun2socks.exe (PID 6724)
Attacker IP77.91.124.20
C2 URLhttp://77.91.124.20/store/games/index.php
Malicious Executable PathC:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe
Lessons learned: windows.malfind is the fastest way to spot process hollowing — an MZ header sitting inside a PAGE_EXECUTE_READWRITE region is rarely legitimate. Once the parent process was identified, pstree revealed the full execution chain down to the LOLBin (rundll32.exe) used to blend in with normal system activity. netscan tied the malware to both its C2 channel and the Outline VPN client the attacker used to tunnel traffic past the NIDS — a reminder that legitimate-looking network tools are a common bypass method. Raw string extraction from the memory image surfaced the exact C2 URL, and filescan pinpointed the dropped payload's path on disk for IOC documentation.