A forensic investigator at a financial institution receives an urgent callout. The SIEM has flagged unusual activity originating from a workstation with access to sensitive financial data. The machine belongs to a user named Elon. A memory dump has been acquired — the task is to figure out what happened before the evidence degrades further.
This is a pure memory forensics investigation — no disk image, no email archive, no network logs. Just a snapshot of RAM at a single point in time, and everything we need to know is buried somewhere inside it. The challenge is knowing where to look.
Before hunting for anything suspicious, the first step is always establishing the baseline — what machine is this, what OS, when was the dump taken. windows.info gave us everything we needed.
Running pslist and pstree revealed a large number of running processes — a typical Windows 10 environment generates significant process noise. Identifying something malicious purely by eye from a process list is harder than it sounds. Legitimate-looking process names, plausible parent-child relationships, nothing obviously screaming "malware."
When pslist and pstree don't immediately reveal the threat, malfind is the next weapon. It scans memory for regions that have suspicious characteristics — executable code in regions that shouldn't have it, mismatched PE headers, memory sections marked as both writeable and executable (a classic injection indicator).
Four flagged processes. PowerShell is the obvious starting point — it's the Swiss Army knife of Windows attack chains. But note that thunderbird.exe is also on the list. We'll come back to that.
The cmdline plugin revealed exactly how PowerShell was invoked — and it confirmed malicious intent immediately:
-windowstyle hidden is one of the most common malicious PowerShell flags. It suppresses the terminal window entirely — the process runs silently in the background with zero visual indicator. Combined with an orphaned parent process, this is a deliberate effort to ensure the victim never sees what's executing on their machine. MITRE ATT&CK: T1564.003 — Hide Artifacts: Hidden Window.
pstree output for PID 3692 revealed hidden network activity. The net use command embedded in the PowerShell execution connected to an external server:
The semicolon in the PowerShell command allowed two instructions to execute on a single line — the net use connection followed immediately by the payload execution. The second command is where it gets sophisticated:
rundll32.exe is a trusted, signed Windows binary present on every Windows machine. By loading the malicious DLL through rundll32 rather than dropping and executing it directly, the attacker bypasses many AV and EDR controls that would flag an unknown executable. The DLL is also never written to disk — it's loaded directly over the WebDAV connection from the C2 server. Fileless execution. MITRE ATT&CK: T1218.011 — Signed Binary Proxy Execution: Rundll32.
The getsids plugin identified which user account the malicious process was running under:
With the C2 IP identified, the final step was attribution. A VirusTotal lookup on 45.9.74.32 connected the malicious file to a well-documented and actively developed malware family:
Remember thunderbird.exe — the email client that appeared in the malfind output alongside powershell.exe? That wasn't coincidence. That was the entire point.
StrelaStealer is not general-purpose malware. It is a credential stealer specifically engineered to target email clients — primarily Mozilla Thunderbird and Microsoft Outlook. It was first documented in late 2022 and has been in active development since, with multiple campaigns targeting organizations across Europe and the United States.
Its primary objective: extract email account credentials stored locally by the email client — usernames, passwords, server configurations — and exfiltrate them to the attacker's C2 infrastructure.
The presence of thunderbird.exe in the malfind output wasn't a red herring. StrelaStealer had already injected into or was monitoring Thunderbird's process — the email client on a financial institution workstation was the prize. Whatever email credentials Elon's Thunderbird had stored — corporate email access, potentially financial system notifications, internal communications — StrelaStealer was there to take them.
The hidden PowerShell window, the WebDAV C2 channel, the rundll32 LOLBin execution, the fileless DLL — all of it was infrastructure built for one purpose: to get StrelaStealer's hooks into that Thunderbird process without triggering an alert.
| Indicator | Value | Type | Confidence |
|---|---|---|---|
| C2 Server | 45.9.74.32 | IP | HIGH |
| WebDAV Share | \\45.9.74.32@8888\davwwwroot\ | Network | HIGH |
| Malicious DLL | 3435.dll (loaded via rundll32) | File | HIGH |
| Malware Family | StrelaStealer | Attribution | HIGH |
| Malicious Process | powershell.exe PID 3692 | Process | HIGH |
| Execution Flag | -windowstyle hidden | Behavior | HIGH |
| Target Process | thunderbird.exe (credential theft target) | Process | HIGH |
| Suspect User | Elon | Identity | HIGH |
| C2 Port | 8888 (WebDAV) | Network | HIGH |
The malicious DLL — 3435.dll — was never written to disk. It was loaded directly from a WebDAV share into memory, executed, and left no file system artifact. A traditional disk forensics investigation would have found nothing. The only place this attack was visible was in memory — in the process list, in the network connections, in the command line arguments. This is why memory forensics is indispensable for modern threat detection.
pslist and pstree alone would not have cracked this case — the process list was too noisy. It was malfind that surfaced the right processes, cmdline that revealed the hidden execution flag, and getsids that identified the user. Each Volatility plugin answers a different question. Knowing which question to ask next is the real skill.
Using rundll32.exe to load a malicious DLL is effective precisely because rundll32 is legitimate, signed, and present on every Windows installation. Many security controls whitelist it by default. The lesson for defenders: monitor rundll32 execution that loads DLLs from network paths, and flag any -windowstyle hidden PowerShell invocation for immediate investigation.
The presence of thunderbird.exe was not background noise — it was the target. StrelaStealer's designers built it specifically to hunt email client credentials because email access is a master key. Corporate email contains authentication tokens, password resets, sensitive communications, and in the case of a financial institution — potential access to systems far beyond what a single workstation credential would provide. Always follow the malware's specific targeting logic. It tells you exactly what the attacker actually wants.
Volatility 3 — windows.info, pslist, pstree, malfind, cmdline, getsidsVirusTotal — IP reputation lookup and malware family attributionMITRE ATT&CK — TTP mapping and technique identification