Hack the box - Reminiscent

Suspicious traffic was detected from a recruiter's virtual PC. A memory dump of the offending VM was captured before it was removed from the network for imaging and analysis. Our recruiter mentioned he received an email from someone regarding their resume. A copy of the email was recovered and is provided for reference. Find and decode the source of the malware to find the flag.

Note: Find and Decode the source of the malware to find the flag. The reading the email file we know following information

Filename: resume.zip
IP: http://10.10.99.55:8080/resume.zip

Used following command to analyze the process

Found some suspicious stuff

Used netscan plugin to analyze the network connection and identified that process powershell is connecting to the Malicious IP address found the email. The malicious process is powershell 2752.

Lets perform a filescan and see if we can find the resume file in the memory.

We have some hits - lets dump them out and do strings on them.

Lets do strings on the dumped files.

There is some data in Base 64 - lets use cyberchef to decode it.

The output of base 64 has another base64 encoding in it. Looks like someone is running powershell

Finally we got some readable text and I can see the flag HTB{$_j0G_y0uR_M3m0rY_$}  in it.