Ramnit

Ramnit is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Volatility 3, VirusTotal, Execution, Defense Evasion, Command and Control.

Learning Objectives

Analyze a memory dump using Volatility to identify a malicious process, extract network IOCs, file hash, and compilation timestamp, correlating with external threat intelligence.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Execution, Defense Evasion, Command and Control.

Tools: Volatility 3, VirusTotal.

Difficulty: easy.