Analyse mémoire 4/5 - Un échelon de plus dans la chaîne

Description

Following your analysis, our teams decided to completely reinstall the operating system on the machine to clean it. However, after the system was reinstalled, the same malware you identified is still present and continues to communicate with the attacker’s C2 server. We therefore suspect that a deeper persistence mechanism is present on the user’s system, and we believe a Device has been registered to pre-position itself during system startup.

The flag is in the format FCSC{<device_name>} where:

• <device_name> is the name of the malicious Device.

For example: FCSC{MyVirtualMouse}.

This challenge is part of a serie that should be solved sequentially:

• Analyse mémoire 1/5 - Exfiltration
• Analyse mémoire 2/5 - Origine de la menace
• Analyse mémoire 3/5 - Où est le pansement ?
• Analyse mémoire 4/5 - Un échelon de plus dans la chaîne
• Analyse mémoire 5/5 - Le commencement