evnchn@.180:~/szechuan/work$ vol -f citadeldc01.mem windows.netscan | grep ESTABLISHED
Offset(P) Proto LocalAddr LPort ForeignAddr FPort State PID Owner
0x20fc7590 TCPv4 10.42.85.10 62613 203.78.103.109 443 ESTABLISHED 3644 coreupdater.ex
0x60182590 TCPv4 10.42.85.10 62613 203.78.103.109 443 ESTABLISHED 3644 coreupdater.ex
└─ the only non-RFC1918 address in ~19,000 lines of socket scan. That's the C2.
evnchn@.180:~/szechuan/work$ vol -f citadeldc01.mem windows.malfind # spoolsv.exe (PID 3724)
Process: spoolsv.exe Protection: PAGE_EXECUTE_READWRITE Tag: VadS
4d 5a 41 52 55 48 89 e5 48 83 ec 20 48 83 e4 f0 MZARUH..H.. H... ← Meterpreter x64 reflective-loader stub
coreupdater migrated into the print spooler. Injection confirmed.