Dunkle Materie

Walkthrough summary

Dunkle Materie TryHackMe walkthrough with 10 answered prompts and lab methodology notes.

Sample prompts covered

• Provide the two PIDs spawned from the malicious executable. (In the order as they appear in the analysis tool)
  Open the walkthrough page to inspect the full answer and command flow.
• Provide the full path where the ransomware initially got executed? (Include the full path in your answer)
  Open the walkthrough page to inspect the full answer and command flow.
• This ransomware transfers the information about the compromised system and the encryption results to two domains over HTTP POST. What are the two C2 domains? (no space in the answer)
  Open the walkthrough page to inspect the full answer and command flow.
• What are the IPs of the malicious domains? (no space in the answer)
  Open the walkthrough page to inspect the full answer and command flow.
• Provide the user-agent used to transfer the encrypted data to the C2 channel.
  Open the walkthrough page to inspect the full answer and command flow.