Investigating the Boogeyman 2: Memory Forensics & Fileless Persistence Case Study

TryHackMe | Boogeyman 2| Capstone Challenge | by Svetoslav Angelov

Executive Summary

Following a previous incident targeting the finance department, the threat actor known as “Boogeyman” returned with upgraded Tactics, Techniques, and Procedures (TTPs), this time targeting the Human Resources division of Quick Logistics LLC.

During this Incident Response engagement, I was provided with a memory dump (WKSTN-2961.raw) and the raw phishing email used in the attack. Using digital forensics tools, including olevba for macro analysis and Volatility 3 for advanced memory forensics, I traced the attack from the initial phishing payload to a sophisticated fileless persistence mechanism hidden within the Windows Registry.

This report details the execution flow, memory analysis, and the DFIR methodology utilised to uncover the Boogeyman’s Stage 2 payloads and Command & Control (C2) infrastructure.

List of Affected Entities

· Internal Source (Assigned): 10.10.49.181 (Assigned to Virtual Machine Host: WKSTN-2961)

· Target Identity: Maxine Beck (Human Resource Specialist at Quick Logistics LLC)

· Attacker IP: 128.199.95.189 (Boogeyman C2 Server)

· Identity: Maxine Beck (Local Account)

· External Actor: Boogeyman Threat Group

Phase 1: Initial Access (Spear-Phishing & Macro Forensics)

The breach originated from a targeted spear-phishing email masquerading as a job application. Using command-line text processing, I parsed the raw .eml file to extract the sender (westaylor23@outlook.com) and the intended victim (maxine.beck@quicklogisticsorg.onmicrosoft.com).

The email contained a malicious Microsoft Word document named Resume_WesleyTaylor.doc (MD5: 52c4384a0b9e248b95804352ebec6c5b).

Figure 1.0 Parsing the raw email headers to identify the spear-phishing vector and malicious attachment.

To uncover the document’s payload without executing it, I utilised the olevba forensics tool. The analysis revealed an AutoOpen() VBA macro embedded within the document. Upon the user enabling content, this macro was designed to silently reach out to https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.png.

Despite the .png extension, the macro saved the file locally as C:\ProgramData\update.js and utilised “Living off the Land” techniques by invoking the native Windows Script Host (wscript.exe) to execute the JavaScript payload.

Figure 1.1 Olevba extraction revealing the Stage 2 downloader and execution methodology.

Phase 2: Execution & Payload Staging (Memory Forensics)

With the initial vector identified, the investigation transitioned to analysing the volatile memory of Maxine’s compromised workstation (WKSTN-2961.raw) using Volatility 3.

I mapped the execution chain by analysing the process list (windows.pslist). The memory dump confirmed that wscript.exe (PID: 4260) was spawned directly by Microsoft Word (PID: 1124), confirming the macro execution timeline.

To determine what the update.js script did upon execution, I searched the raw memory dump for strings matching the attacker’s domain. The results revealed that the JavaScript acted as a downloader for the final Stage 3 payload, fetching a malicious binary from **https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.exe**.

Figure 2.0 String analysis of the raw memory dump uncovering the Stage 3 payload URL.

Phase 3: Command & Control (C2) Establishment

To confirm whether the malware successfully communicated with the attacker, I utilised Volatility’s windows.netscan plugin to review active and recently closed network connections.

The scan identified a suspicious process establishing a connection from the internal host (10.10.49.181) to the external attacker IP (128.199.95.189) over port 8080. The process responsible for this C2 beaconing was identified as updater.exe (PID: 6216).

To locate the binary on the disk, I ran the windows.dlllist plugin against PID 6216. This revealed the absolute path of the active malware: C:\Windows\Tasks\updater.exe.

Figure 3.0 Volatility network and DLL scanning isolating the active Command & Control process and its physical disk location.

Phase 4: Fileless Persistence Mechanism

A critical step in incident response is identifying how malware survives a system reboot. Initially, Volatility’s windows.cmdline plugin failed to produce the scheduled task commands, a common occurrence in memory forensics if a process has already terminated or memory has been paged out.

Adapting to this hurdle, I dumped the raw process memory and performed a targeted string search for schtasks (the native Windows scheduled task binary). This manual carving successfully recovered the attacker’s persistence mechanism.

The attacker created a Scheduled Task named Updater set to run daily at 09:00. However, instead of pointing the task to the updater.exe binary on the disk, the attacker utilised a highly sophisticated fileless persistence technique. They hid the malicious payload as a Base64-encoded string directly inside the Windows Registry and used PowerShell to decode and execute it dynamically into memory:

PowerShell:

schtasks /Create /F /SC DAILY /ST 09:00 /TN Updater /TR ‘C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NonI -W hidden -c \”IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))\”’

Figure 4.0 Manual memory carving exposing the fileless registry-based Scheduled Task persistence mechanism.

Conclusion & Indicators of Compromise (IoCs)

The Boogeyman 2 attack represents a significant escalation in tradecraft from their previous campaigns. By utilising malicious VBA macros to call native Windows binaries (wscript.exe and powershell.exe), the attackers actively employed “Living off the Land” techniques to evade traditional endpoint detection. Furthermore, the use of fileless, registry-based persistence demonstrates a highly evasive methodology designed to frustrate standard forensic disk imaging.

Verified IoCs:

File Hashes (MD5):

· 52c4384a0b9e248b95804352ebec6c5b (Resume_WesleyTaylor.doc)

Malicious Domains & URLs:

· https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.png

· https://files.boogeymanisback.lol/aa2a9c53cbb80416d3b47d85538d9971/update.exe

C2 Infrastructure:

· IP/Port: 128.199.95.189:8080

Host-Based Artefacts:

· Dropper Path: C:\ProgramData\update.js

· Payload Path: C:\Windows\Tasks\updater.exe

· Scheduled Task: Updater

· Compromised Registry Key: HKCU:\Software\Microsoft\Windows\CurrentVersion debug

Note: This memory forensics case study was conducted as part of the TryHackMe Boogeyman 2 Capstone Challenge.