Memory Forensic

Brief description of topic

What is memory analysis?

Easy way how to learn more about the attackers.

Malicious binary may only be present in memory. No binary obfuscation present – the code has to run

How to acquire memory?

How to analyze it?

Sockets (connections/network artifacts)

Processes

Threads

Handles (files)

Mutexes

Libraries/modules

Filetypes 101/102

Executables

PE

COM

ELF

MACH-O

DOL

Documents

PDF

Multimedia files

SWF/Flash

JPG

BMP

PNG

GIF

TIFF (LE/BE)

PGM

PPM

XBM

WAV

Instructions

x86

x64

Tools

There is a lot of useful tools, SANS created cheet sheet describing usage of them.

volatility

# Image info
vol -f memory.dmp imageinfo

# Show me running processes
vol -f memory.dmp pslist

# Find injected code and dump it
vol -f memory.dmp malfind

# Dump process
vol -f memory.dmp procdump -p <PID>

rekall

The Rekall Memory Forensic Framework is a collection of memory acquisition and analysis tools

Useful rekall cheat sheet by SANS.

# Image info
rekal -f memory.dmp imageinfo

# Show running processes
rekal -f memory.dmp pslist
rekal -f memory.dmp pstree

# Show connections
rekal -f memory.dmp netscan
rekal -f memory.dmp netstat

# Find injected code and dump it
rekal -f memory.dmp malfind

# Dump process
vol -f memory.dmp procdump