Locker - Warmup

Home
← Previous | BelkaCTF #7 | Next →

Challenge

Locker.png

Task

There is something rogue running on this machine.
What is the malware executable file name?

Tools

Solution

FindEvil

There is an infinite amount of ways to find out what executable is the malware but the simplest way to get some leads is the MemProcFS function findevil. What it effectively does is it checks all the running binaries in the dump for common signs of malware. You can read about what exactly it detects and how it does that, as well as how to use it here MemProcFS/wiki/FS_FindEvil . So lets see what it dredges up.

First you need to enable the forensic tools. You can read more about them here MemProcFS/wiki/FS_Forensic.

echo "4" > forensic/forensic_enable.txt

We have to wait for it to finish and then we can read the output of findevil.

cat forensic/findevil/findevil.txt | less

It is small enough that we can look through it manually and there are obviously some false positives. However epxlorer.exe definitely seems like the most suspicious. The name itself is a common malware trick, naming the binary something close to a program that is safe, in this example explorer.exe.

Effectively that is enough to solve the task because this is a CTF after all and we have infinite attempts to guess the answer. And epxlorer.exe is the flag. Though I would like to dig a bit deeper and find out more about this malware.

Answer
epxlorer.exe

Mail

As a basic first step we can look through the dump with strings and grep.

strings BelkaCTF_7_CASE250722_KTSOAERO.mem | grep 'epxlorer.exe'

Obviously this has a huge output and sorting through all of it is not feasible but even with a quick glance we can find out a few things. We can notice an often recurring block of text:

After a bit more grepping we can find the full version

If we clean it up we get this :

Note

REQUIRES IMMEDIATE ATTENTION AND ACTION
We wish to draw your immediate attention to an emerging global incident currently affecting numerous Windows-based computer systems across various industries and locations worldwide. Specifically, Windows machines are experiencing critical instability, resulting in frequent occurrences of the Blue Screen of Death (BSOD), an error state rendering affected systems temporarily unusable, with potential risks including significant operational downtime and data loss.

In response to this critical situation, our Information Technology Department has conducted a thorough assessment and has urgently identified and prepared an internal software update designed explicitly to mitigate this vulnerability. This software update is essential in safeguarding your workstation and ensuring the continued stability, security, and integrity of our organizational systems.

Mandatory Action Required

It is imperative that you install the provided software update at your earliest convenience—ideally immediately upon receipt of this notification. Prompt compliance will significantly reduce the likelihood of your workstation being compromised by the current global BSOD event.

Software Update Installation Procedure

  1. Download the necessary update using this one-time link: https://limewire[.]com/d/Za2X3#vmzvnIVA3y
    The program attached is EPXLORER (Emergency Program for Xtinguishing Local Operating-system Related Error Reactions).
  2. Save epxlorer.exe to any folder on your computer. Verify that the executable is 1,111,552 bytes in size.
  3. Immediately run epxlorer.exe.

Should you encounter any difficulties or require further clarification, please do not hesitate to immediately contact the IT Support Desk by replying to this email.

We greatly appreciate your immediate cooperation and attention to this critical matter. Your diligence will play an integral role in maintaining the operational efficiency and resilience of our organization during this challenging situation.

If we check the web history through MemProcFS we can see that this s exactly how the binary got downloaded

cat forensic/web/web.txt | grep epxlorer.exe

Output :

ID PID Timestamp (UTC) Browser Activity URL Page title
c 7984 2025-07-22 18:52:03 EDGE VISIT https://limewire.com/d/Za2X3#vmzvnIVA3y Download epxlorer.exe | LimeWire
d 7984 2025-07-22 18:51:57 EDGE VISIT https://limewire.com/d/Za2X3#vmzvnIVA3y Download epxlorer.exe | LimeWire
e 7984 2025-07-22 18:51:57 EDGE VISIT https://limewire.com/d/Za2X3#vmzvnIVA3y Download epxlorer.exe | LimeWire
f 7984 2025-07-22 18:51:57 EDGE VISIT https://limewire.com/d/Za2X3?lmwr-ftv=1#vmzvnIVA3y Download epxlorer.exe | LimeWire

Conclusion

We found the malware and even found out how it got onto the system. We could find out a lot more about it but I find this proof enough and so does the CTF.