# Defensive Security Tooling: REMnux: Getting Started

In this article, I will write a write-up for REMnux: Getting Started that covers Machine Access, File Analysis, Fake Network to Aid Analysis, and Memory Investigation: Evidence Preprocessing.

1. What Python tool analyzes OLE2 files, commonly called Structured Storage or Compound File Binary Format? [`oledump.py`](http://oledump.py/)
    
2. What tool parameter we used in this task allows you to select a particular data stream of the file we are using it with? `-s`
    
3. During our analysis, we were able to decode a PowerShell script. What command is commonly used for downloading files from the internet? `Invoke-WebRequest`
    
4. What file was being downloaded using the PowerShell script? `Doc-3737122pdf.exe`
    
5. During our analysis of the PowerShell script, we noted that a file would be downloaded. Where will the file being downloaded be stored? `$TempFile`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728162236/2c184504-0ed4-40ed-bec8-c78e1d0fc77c.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728143831/a0cef77a-d695-47e1-b8ea-f71cc91807e7.png align="center")
    
6. Using the tool, scan another file named **possible\_malicious.docx** located in the `/home/ubuntu/Desktop/tasks/agenttesla/` directory. How many data streams were presented for this file? `16`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730727997815/a1a7f988-47a9-42ce-affb-aee91048949a.png align="center")
    
7. Using the tool, scan another file named **possible\_malicious.docx** located in the `/home/ubuntu/Desktop/tasks/agenttesla/` directory. At what data stream number does the tool indicate a macro present? `8`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728029228/17dff394-df00-4cea-ba23-81f95e5a6f1c.png align="center")
    
8. Download and scan the file named **flag.txt** from the terminal using the command **sudo wget https://MACHINE\_IP/flag.txt --no-check-certificate**. What is the flag? `Tryhackme{remnux_edition}`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728064602/096fbd7e-0339-4e1f-8f31-9a4b840e187d.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728213192/cc156974-86f3-4012-a6bd-91a5f05de162.png align="center")
    
9. After stopping the inetsim, read the generated report. Based on the report, what URL Method was used to get the file flag.txt? `GET`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728107870/b8cac9a8-1db6-4f10-b660-558909edb356.png align="center")
    
10. What plugin lists processes in a tree based on their parent process ID? `PsTree`
    
11. What plugin is used to list all currently active processes in the machine? `PsList`
    
12. What Linux utility tool can extract the ASCII, 16-bit little-endian, and 16-bit big-endian strings? `strings`
    
13. By running vol3 with the Malfind parameter, what is the first (1st) process identified suspected of having an injected code? `csrss.exe`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728304588/80c85e13-7b0c-4f11-8022-41cae201aedc.png align="center")
    
14. Continuing from the previous question (Question 6), what is the second (2nd) process identified suspected of having an injected code? `winlogon.exe`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728352942/31b1cbc6-dfbd-4c39-a423-b680992e9074.png align="center")
    
15. By running vol3 with the DllList parameter, what is the file path or directory of the binary @WanaDecryptor@.exe? `C:\\Intel\\ivecuqmanpnirkt615`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1730728257709/17b9f729-97be-4dfe-b866-893864e2d272.png align="center")
    

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the Lab THM challenges.