Ransomémoire 3/3 - Doppelgänger

Description

You don’t understand how the agent you found in Ransomware 2/3 - Début d'investigation could be on the machine (Note: you don’t need to have solved this challenge to solve Ransomware 3/3 - Doppelgänger). You suspect that there is a sleeping agent, hiding somewhere in memory…

The flag is case insensitive and follows the format FCSC{<pid>:<ip>:<port>} where:

• <pid> is the PID of the malicious process and
• <ip> and <port> are the parameters of the connection with the C&C.

This challenge has been split into four parts:

• Ransomémoire 0/3 - Pour commencer.
• Ransomémoire 1/3 - Mon précieux.
• Ransomémoire 2/3 - Début d’investigation.
• Ransomémoire 3/3 - Doppelgänger.