Blue Box: Ghost Process - Incident Response Writeups Report

SHADOW120

Blue Box: Ghost Process - Incident Response Writeup Report

Case ID: BlueCorp-IR-2026-0730
Classification: Confirmed Compromise - Process Injection & C2 Beaconing
Analyst: Security Operations
Evidence: memory.raw (Windows 10 Enterprise, Build 19041, x64)
Date of Analysis: 2026-07-30
Challenge Link: https://learn.hacklido.com/blue-box/ghost-process

1. Executive Summary

A memory dump captured from a BlueCorp Windows 10 workstation was analyzed to determine whether the host was compromised. Analysis of the process tree and memory regions confirms a phishing-driven infection chain: a malicious Word document opened via Outlook spawned PowerShell, which injected shellcode into a legitimate svchost.exe process. The injected code establishes beaconing communication to two external C2 servers.

Verdict: Host is compromised. Process injection and active C2 configuration confirmed in memory.

2. Tools Used

Tool	Purpose
Volatility 2 / 3	Process listing, tree reconstruction, malfind, memory region analysis
Manual string analysis	Extraction of embedded C2 configuration from injected memory region

Recommended profile (from profile_hint.txt): Win10x64_19041 (Volatility 2), or native symbol table auto-detection (Volatility 3).

3. Methodology - Step by Step

Step 1: Identify the OS profile

volatility -f memory.raw imageinfo

Confirmed from the provided profile hint:

System: Windows 10 Enterprise
Build: 19041
Architecture: x64
Recommended Profile: Win10x64_19041

Step 2: Enumerate running processes and reconstruct the process tree

volatility -f memory.raw --profile=Win10x64_19041 pstree

Volatility 3 equivalent:

volatility -f memory.raw windows.pstree.PsTree

Relevant branch of the tree (PPID chain reconstructed from the process list):

explorer.exe        (1712)
  OUTLOOK.EXE        (2416)   started 12:00:00
    WINWORD.EXE       (2528)   started 14:23:00
      powershell.exe   (2644)   started 14:23:05
        schtasks.exe    (2752)   started 14:23:45

WINWORD.EXE spawning powershell.exe is abnormal. Microsoft Word does not legitimately launch PowerShell as a child process during normal document editing. This pattern is the standard signature of a malicious macro embedded in a document delivered as an email attachment (opened through Outlook), which then executes PowerShell to stage further compromise. The subsequent schtasks.exe child process is consistent with the attacker establishing scheduled-task persistence.

Timeline correlation also supports this: OUTLOOK.EXE had been running since 12:00:00, but WINWORD.EXE was not opened until 14:23:00, immediately followed by powershell.exe five seconds later, then schtasks.exe forty seconds after that. This tight sequence of events is consistent with a user opening a malicious attachment and the macro executing automatically.

Q1 - Suspicious parent-child relationship: HackCTF{WINWORD.EXE_POWERSHELL.EXE}

Step 3: Hunt for code injection with malfind

volatility -f memory.raw --profile=Win10x64_19041 malfind

Volatility 3 equivalent:

volatility -f memory.raw windows.malfind.Malfind

malfind flags processes containing memory regions that are both executable and writable, and that lack a backing file on disk, a strong indicator of injected shellcode. The suspicious activity log confirms this finding directly:

Injected Process PID: 720 (svchost.exe)
Injected by PID: 604 (via powershell.exe)
Injection Time: 2024-03-15 14:23:08

svchost.exe (PID 720) is a legitimate Windows service host process, but legitimate svchost.exe instances should never contain freshly allocated RWX memory regions with no associated module or file. This is classic process hollowing / remote thread injection behavior, where malware injects its payload into a trusted system process to evade detection.

The injection timestamp (14:23:08) falls three seconds after powershell.exe was spawned (14:23:05) from the WINWORD.EXE chain identified in Step 2, tying the injection directly back to the phishing execution chain.

Q2 - Process showing signs of injection: HackCTF{SVCHOST.EXE}
Q3 - PID of the injected process: HackCTF{720}
Q4 - Process that performed the injection: HackCTF{POWERSHELL.EXE}

Step 4: Examine the injected memory region

volatility -f memory.raw --profile=Win10x64_19041 vadinfo -p 720

Volatility 3 equivalent:

volatility -f memory.raw windows.vadinfo.VadInfo --pid 720

The memory region table for PID 720 shows:

PID: 720 Start: 0x7ffa0000 Size: 245760 Protection: EXECUTE_READWRITE
PID: 720 Start: 0x7ffb5000 Size: 4096   Protection: READWRITE

The first region carries PAGE_EXECUTE_READWRITE protection, meaning the memory can be written to and executed simultaneously. Legitimate code pages are normally either read-only executable (loaded from a signed module) or read-write non-executable (heap/data). A combined RWX region is a hallmark of injected shellcode that has been written into memory and is being executed directly, without ever touching disk as a standalone file.

Q5 - Memory protection used for the injected code: HackCTF{EXECUTE_READWRITE}
Q6 - Base address of the injected code: HackCTF{0x7ffa0000}
Q7 - Size of the injected payload: HackCTF{245760}

Step 5: Extract embedded C2 configuration strings

volatility -f memory.raw --profile=Win10x64_19041 yarascan -p 720 -Y "C2_IP|C2_PORT"

Or extract raw strings from the identified VAD region directly:

volatility -f memory.raw --profile=Win10x64_19041 memdump -p 720 -D ./dump/
strings ./dump/720.dmp | grep -E "C2_|BEACON|USER_AGENT"

The second (smaller) memory region at 0x7ffb5000 contains the malware’s embedded configuration block, decoded directly from the dump:

C2_IP=185.142.53.122
C2_PORT=8080
ENCRYPTION_KEY=0xAB12CD34EF56
USER_AGENT=Mozilla/5.0 (Windows NT 10.0; Win64; x64)
BEACON_INTERVAL=60
JITTER=20

This is corroborated by the separate C2 communication summary in the dump analysis:

Primary C2: 185.142.53.122:8080
Secondary C2: 45.155.205.33:8443

The malware beacons out to its primary C2 on a 60-second interval with 20-second jitter (to avoid predictable, easily-signatured network patterns), using a spoofed browser User-Agent to blend traffic with normal web activity, and an XOR-style key for encrypting its C2 traffic.

Q8 - C2 IP embedded in the payload: HackCTF{185.142.53.122}
Q9 - Port used for C2 communication: HackCTF{8080}

4. Consolidated Findings

#	Question	Answer	Flag
1	Suspicious parent-child relationship	WINWORD.EXE spawning powershell.exe	`HackCTF{WINWORD.EXE_POWERSHELL.EXE}`
2	Process showing signs of injection	svchost.exe	`HackCTF{SVCHOST.EXE}`
3	PID of injected process	720	`HackCTF{720}`
4	Process that performed the injection	powershell.exe	`HackCTF{POWERSHELL.EXE}`
5	Memory protection of injected code	EXECUTE_READWRITE	`HackCTF{EXECUTE_READWRITE}`
6	Base address of injected code	0×7ffa0000	`HackCTF{0x7ffa0000}`
7	Size of injected payload	245760 bytes	`HackCTF{245760}`
8	C2 IP embedded in payload	185.142.53.122	`HackCTF{185.142.53.122}`
9	C2 port	8080	`HackCTF{8080}`

5. Indicators of Compromise (IOCs)

Parent process chain: explorer.exe > OUTLOOK.EXE > WINWORD.EXE > powershell.exe > schtasks.exe
Injected process: svchost.exe (PID 720)
Injecting process: powershell.exe
Injected region: base 0x7ffa0000, size 245760 bytes, protection PAGE_EXECUTE_READWRITE
Primary C2: 185.142.53.122:8080
Secondary C2: 45.155.205.33:8443
Beacon interval: 60 seconds, jitter 20 seconds
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Encryption key (embedded): 0xAB12CD34EF56

6. Recommendations

Isolate the affected host from the network immediately.
Block 185.142.53.122:8080 and 45.155.205.33:8443 at the perimeter firewall.
Terminate the injected svchost.exe process (PID 720) and any spawned scheduled tasks created by schtasks.exe.
Review Outlook mail logs to identify the original phishing email and the malicious attachment, and remove it from all mailboxes.
Audit scheduled tasks on the host for unauthorized persistence entries created around 2024-03-15 14:23:45.
Disable or restrict macro execution for Office documents received via email, organization-wide, if not already enforced.
Hunt across the environment for the same IOCs (C2 IPs, User-Agent, encryption key, beacon timing) to rule out lateral spread.

document.querySelectorAll("ins.adsbygoogle:not([data-adsbygoogle-status])").forEach(function(){try{(adsbygoogle=window.adsbygoogle||[]).push({});}catch(e){}});