↓ Skip to main content
bubka hacks stuff

Endpoint Forensic

CDEF-Ramnit

Endpoint Forensic Memory Analysis Volatility3 Windows
Memory forensics of a compromised Windows host revealed ChromeSetup.exe spawned under explorer.exe, establishing a C2 connection to a Hong Kong-based IP. The dumped binary was identified as the Ramnit worm - flagged by 68/72 VirusTotal vendors.