# Memory dump analysis

Memory dump analysis is the most common type of challenge that creators give to participants. They might provide a .raw or .mem file, and you are required to conduct analysis and solve the challenge's questions.

Here are the tools you need for this type of challenge:

1. Volatility3 or Volatility Workbench
2. MemProcFS
3. EVTXtract

Noted that in the industry, we don't just get a memory dump file; we get both disk images and memory dumps. However, for the sake of challenge puzzles, the challenge creator might give you only a memory dump to make it more challenging.

But before we use all these actual weapons, please give a shot with `strings` command with `grep context_strings`  on the mem dump. For example:

```sh
strings windows.mem | grep -i "flag{"
```

## Strategy

1. Check running processes
2. Check commands
3. Check Network connections
4. Check injected process
5. Check files
6. Check registry

## MemProcFS

Imagine you can "Mount" memory images and analyze them with Explorer and Notepad. This tool, MemProcFS will create a virtual file system representing the processes, file handles, registry, $MFT, and more.

To install and use MemProcFS, please install Dokan first at <https://github.com/dokan-dev/dokany/releases>

Then download the binaries from the release: <https://github.com/ufrisk/MemProcFS/releases>

### Usage

Mount and forensics!

```
memprocfs.exe -device memdump.mem -forensic 1
```

<figure><img src="/files/PrRG78V2H7g9VaHcFriz" alt=""><figcaption></figcaption></figure>

Navigate and explore the folders:

| Directory                                                        | Description                                     |
| ---------------------------------------------------------------- | ----------------------------------------------- |
| [conf](https://github.com/ufrisk/MemProcFS/wiki/FS_Conf)         | Configuration and Status.                       |
| [forensic](https://github.com/ufrisk/MemProcFS/wiki/FS_Forensic) | Forensic mode.                                  |
| [misc](https://github.com/ufrisk/MemProcFS/wiki/FS_Misc)         | Miscellaneous functionality                     |
| name                                                             | Per-process directories listed by process name. |
| pid                                                              | Per-process directories listed by process pid.  |
| py                                                               | Python based plugins.                           |
| [registry](https://github.com/ufrisk/MemProcFS/wiki/FS_Registry) | Registry information.                           |
| [sys](https://github.com/ufrisk/MemProcFS/wiki/FS_SysInfo)       | System information.                             |
| [vm](https://github.com/ufrisk/MemProcFS/wiki/VM)                | Virtual Machine (VM) information.               |

<figure><img src="/files/k7UqSfffM5La2IGHvrDW" alt=""><figcaption></figcaption></figure>

### Running Processes

Navigate to `M:\sys\proc` where the files:

`proc` = Show process in tree mode\
`proc-v` = Show process with command

<figure><img src="/files/1mp1txyPXBms10drs2bo" alt=""><figcaption></figcaption></figure>

### Network connection

Navigate to `M:\sys\net\`

<figure><img src="/files/y9oFNOqmZoHNqxlDNqvJ" alt=""><figcaption></figcaption></figure>

### Investigate injected process

Navigate to `M:\forensic\findevil` and find RWX section in the output result

<figure><img src="/files/ZKgkZQ9WQljVoJVF0fEv" alt=""><figcaption></figcaption></figure>

### Dump shellcode

Go to `M:\pid\<PID number\vmemd` and then find the address that we're take note from the findevil result

<figure><img src="/files/8KwPZKFqWrkkQqo2aUOT" alt=""><figcaption></figcaption></figure>

Then, we can use shellcode emulator or shellcode launcher to know what the program does including:

1. Shellcode2exe
2. Blobrunner
3. SCDbg
4. speakeasy

## Volatility WorkBench

Volatility Workbench is a graphical user interface (GUI) for the Volatility if you hate Linux command line version.

### Basic Usage

Browse Image -> Choose `Windows` Platform as option -> Refresh Process List > Choose `Command` options ->  Run -> Investigate the output

<figure><img src="/files/kZqOF5Al3mcpT6witVRW" alt=""><figcaption></figcaption></figure>

These is the plugins that I found crucial in analysis:

<table><thead><tr><th width="330">Plugin</th><th>Description</th></tr></thead><tbody><tr><td><code>windows.cmdline.CmdLine</code></td><td>Lists process command line arguments.</td></tr><tr><td><code>windows.dlllist.DllList</code></td><td>Lists the loaded modules in a particular Windows memory image.</td></tr><tr><td><code>windows.dumpfiles.DumpFiles</code></td><td>Dumps cached file contents from Windows memory samples.</td></tr><tr><td><code>windows.envars.Envars</code></td><td>Displays process environment variables.</td></tr><tr><td><code>windows.filescan.FileScan</code></td><td>Scans for file objects present in a particular Windows memory image.</td></tr><tr><td><code>windows.getservicesids.GetServiceSIDs</code></td><td>Lists process token SIDs.</td></tr><tr><td><code>windows.getsids.GetSIDs</code></td><td>Prints the SIDs owning each process.</td></tr><tr><td><code>windows.handles.Handles</code></td><td>Lists process open handles.</td></tr><tr><td><code>windows.malfind.Malfind</code></td><td>Lists process memory ranges that potentially contain injected code.</td></tr><tr><td><code>windows.mbrscan.MBRScan</code></td><td>Scans for and parses potential Master Boot Records (MBRs).</td></tr><tr><td><code>windows.memmap.Memmap</code></td><td>Prints the memory map.</td></tr><tr><td><code>windows.modscan.ModScan</code></td><td>Scans for modules present in a particular Windows memory image.</td></tr><tr><td><code>windows.mutantscan.MutantScan</code></td><td>Scans for mutexes present in a particular Windows memory image.</td></tr><tr><td><code>windows.netscan.NetScan</code></td><td>Scans for network objects present in a particular Windows memory image.</td></tr><tr><td><code>windows.netstat.NetStat</code></td><td>Traverses network tracking structures present in a particular Windows memory image.</td></tr><tr><td><code>windows.pslist.PsList</code></td><td>Lists the processes present in a particular Windows memory image.</td></tr><tr><td><code>windows.psscan.PsScan</code></td><td>Scans for processes present in a particular Windows memory image.</td></tr><tr><td><code>windows.pstree.PsTree</code></td><td>Lists processes in a tree based on their parent process ID.</td></tr><tr><td><code>windows.registry.hivelist.HiveList</code></td><td>Lists the registry hives present in a particular memory image.</td></tr><tr><td><code>windows.registry.hivescan.HiveScan</code></td><td>Scans for registry hives present in a particular Windows memory image.</td></tr><tr><td><code>windows.registry.printkey.PrintKey</code></td><td>Lists the registry keys under a hive or specific key value.</td></tr><tr><td><code>windows.registry.userassist.UserAssist</code></td><td>Prints UserAssist registry keys and information.</td></tr><tr><td><code>windows.sessions.Sessions</code></td><td>Lists processes with session information extracted from environmental variables.</td></tr><tr><td><code>windows.skeleton_key_check.Skeleton_Key_Check</code></td><td>Looks for signs of Skeleton Key malware.</td></tr></tbody></table>

## EVTXtract

This tool recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.

The use case of this tool is when the challenge creator ask us to find something in the event log, but all he/she gives is a mem dump.

Download: <https://github.com/williballenthin/EVTXtract>

### Usage

It's quite hard to read the XML output, you might need CTRL+F with context of the incident.

<figure><img src="/files/Qdr36P1cgmqEWLoZYoNA" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://fareedfauzi.gitbook.io/ctf-training/forensic/memory-dump-analysis.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.