TrueSecrets — HackTheBox

Description

Our cybercrime unit has been investigating a well-known APT group for several months. The group has been responsible for several high-profile attacks on corporate organizations. However, what is interesting about that case, is that they have developed a custom command & control server of their own. Fortunately, our unit was able to raid the home of the leader of the APT group and take a memory capture of his computer while it was still powered on. Analyze the capture to try to find the source code of the server.

Files

• TrueSecrets.raw — 200MB Windows memory dump (extracted from ZIP with password hackthebox)

Analysis

Step 1: Initial Analysis — OS Identification

Used Volatility3 windows.info to identify the system:

• Windows 7 SP1 32-bit (build 7601)

python3 -m volatility3 -f TrueSecrets.raw windows.info

Step 2: Process Analysis

Ran windows.pslist and identified key processes:

PID	Process	Significance
2128	TrueCrypt.exe	TrueCrypt disk encryption — the challenge name hint
2176	7zFM.exe	7-Zip, opened backup_development.zip
3212	DumpIt.exe	Memory acquisition tool

python3 -m volatility3 -f TrueSecrets.raw windows.pslist

Step 3: File Discovery & Extraction

Ran windows.filescan and found two critical files:

Offset	File
0xbbf6158	\Users\IEUser\Documents\backup_development.zip
0xc50c550	\Users\IEUser\Documents\development.tc

Extracted backup_development.zip (304KB) from memory:

python3 -m volatility3 -f TrueSecrets.raw windows.dumpfiles --virtaddr 0xbbf6158

Unzipped to get development.tc — a 300KB TrueCrypt encrypted container.

Step 4: TrueCrypt Password Recovery from Process Memory

This is the critical step. TrueCrypt caches passwords in process memory as a struct:

• 4-byte length field + password bytes (up to 64) + null padding

Dumped TrueCrypt process memory (PID 2128):

...