Malware Forensics
Hands-On Lab

Process injection triad: VirtualAllocEx allocates memory in another process, WriteProcessMemory writes shellcode into that memory, and CreateRemoteThread executes it. Together, these three are the textbook API sequence for classic DLL/shellcode injection (T1055.002).

What the cmd string does: net user helpdesk Tr0ub4dor&3 /add creates a local account called "helpdesk" with password "Tr0ub4dor&3", then net localgroup administrators helpdesk /add elevates it to admin. The attacker now has a backdoor account that survives malware removal if the eradication step misses it.

IOCs to record: C2 IP 185.220.101.47, URL http://185.220.101.47/update/gate.php, Run key value WinUpdateSvc, copy path %APPDATA%\Microsoft\Windows\winupd.exe, rogue account helpdesk / password Tr0ub4dor&3.

The beacon: Every ~30 seconds, the malware POSTs to /update/gate.php with the victim's hostname, OS version, username, domain name, AV product, and malware version. This is a classic AgentTesla check-in — it registers the victim in the attacker's panel and keeps the session alive.

Why beacon interval matters: A perfectly regular 30-second interval (zero jitter) is a strong detection signal. Human web browsing is irregular; malware beaconing is clockwork. A detection rule can fire on any process making HTTP POST requests to the same endpoint at a consistent sub-60-second interval. Sophisticated malware adds jitter (random variation) to evade this — AgentTesla's version here does not.

Port 4444: The server-sends-first pattern followed by large client responses is the signature of a reverse shell where the victim connects out, the attacker types commands (small packets), and the victim returns output (large packets). The short duration (12 seconds) suggests the attacker ran a few commands and terminated — check memory for what those commands were.

Process tree story: explorer.exe (the user's desktop) spawned winupd.exe (PID 5512) — meaning jdawson ran or was tricked into running it directly (likely via a phishing attachment or social engineering). winupd.exe then spawned cmd.exe which ran two net.exe commands: (1) create local account "helpdesk", (2) add "helpdesk" to Administrators. It also spawned powershell.exe which opened the reverse shell.

Malfind — injected PE: The MZ header (the first two bytes of any Windows executable, 4D 5A = "MZ") found inside a PAGE_EXECUTE_READWRITE region means a complete second executable was written into winupd.exe's own memory and is running there. Legitimate code doesn't need memory that is simultaneously writable AND executable — that combination is the exact signature of shellcode staging and process hollowing (T1055).

Port 4444 CLOSE_WAIT: The powershell.exe connection to port 4444 shows CLOSE_WAIT — the attacker closed their end of the shell 2 minutes before memory acquisition. The shell session ran for ~12 seconds (per PCAP). Decode the PowerShell base64 to confirm what the reverse shell payload was.

Two persistence chains, not one: HKCU points to %APPDATA%\Microsoft\Windows\winupd.exe (runs as jdawson on login). HKLM points to C:\ProgramData\Microsoft\winupd.exe (runs for any user who logs in). This means even after jdawson's account is remediated, another user login would re-execute the malware — eradication must remove both.

PowerShell payload decoded: It opens a TCP connection to 185.220.101.47:4444. The attacker types a command → it's received as bytes → iex $data (Invoke-Expression) executes the received string as PowerShell — this is a fully interactive reverse shell. The output is sent back. This is T1059.001 (PowerShell) + T1071.001 (C2 over TCP).

HKLM privilege: Writing to HKLM requires local Administrator rights. The sequence is: winupd.exe runs as jdawson (standard user) → cmd.exe runs net user helpdesk /add and net localgroup administrators helpdesk /add → the attacker now has a local admin account → uses that (or UAC bypass) to write the HKLM key. This confirms privilege escalation occurred within 2 minutes of infection.