QBot

QBot is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects: Volatility 3, Initial Access, Execution, Command and Control.

Learning Objectives

Reconstruct the QBot malware infection timeline by analyzing memory dumps, identifying malicious processes, files, and network communications using Volatility3 and VirusTotal.

Categories: Endpoint Forensics.

MITRE ATT&CK Tactics: Initial Access, Execution, Command and Control.

Tools: Volatility 3.

Difficulty: medium.