Memory dump analysis
Memory dump analysis is the most common type of challenge that creators give to participants. They might provide a .raw or .mem file, and you are required to conduct analysis and solve the challenge's questions.
Here are the tools you need for this type of challenge:
Volatility3 or Volatility Workbench
MemProcFS
EVTXtract
Noted that in the industry, we don't just get a memory dump file; we get both disk images and memory dumps. However, for the sake of challenge puzzles, the challenge creator might give you only a memory dump to make it more challenging.
But before we use all these actual weapons, please give a shot with strings
command with grep context_strings
on the mem dump. For example:
Strategy
Check running processes
Check commands
Check Network connections
Check injected process
Check files
Check registry
MemProcFS
Imagine you can "Mount" memory images and analyze them with Explorer and Notepad. This tool, MemProcFS will create a virtual file system representing the processes, file handles, registry, $MFT, and more.
To install and use MemProcFS, please install Dokan first at https://github.com/dokan-dev/dokany/releases
Then download the binaries from the release: https://github.com/ufrisk/MemProcFS/releases
Usage
Mount and forensics!
Navigate and explore the folders:
Directory | Description |
---|---|
Configuration and Status. | |
Forensic mode. | |
Miscellaneous functionality | |
name | Per-process directories listed by process name. |
pid | Per-process directories listed by process pid. |
py | Python based plugins. |
Registry information. | |
System information. | |
Virtual Machine (VM) information. |
Running Processes
Navigate to M:\sys\proc
where the files:
proc
= Show process in tree mode
proc-v
= Show process with command
Network connection
Navigate to M:\sys\net\
Investigate injected process
Navigate to M:\forensic\findevil
and find RWX section in the output result
Dump shellcode
Go to M:\pid\<PID number\vmemd
and then find the address that we're take note from the findevil result
Then, we can use shellcode emulator or shellcode launcher to know what the program does including:
Shellcode2exe
Blobrunner
SCDbg
speakeasy
Volatility WorkBench
Volatility Workbench is a graphical user interface (GUI) for the Volatility if you hate Linux command line version.
Basic Usage
Browse Image -> Choose Windows
Platform as option -> Refresh Process List > Choose Command
options -> Run -> Investigate the output
These is the plugins that I found crucial in analysis:
Plugin | Description |
---|---|
| Lists process command line arguments. |
| Lists the loaded modules in a particular Windows memory image. |
| Dumps cached file contents from Windows memory samples. |
| Displays process environment variables. |
| Scans for file objects present in a particular Windows memory image. |
| Lists process token SIDs. |
| Prints the SIDs owning each process. |
| Lists process open handles. |
| Lists process memory ranges that potentially contain injected code. |
| Scans for and parses potential Master Boot Records (MBRs). |
| Prints the memory map. |
| Scans for modules present in a particular Windows memory image. |
| Scans for mutexes present in a particular Windows memory image. |
| Scans for network objects present in a particular Windows memory image. |
| Traverses network tracking structures present in a particular Windows memory image. |
| Lists the processes present in a particular Windows memory image. |
| Scans for processes present in a particular Windows memory image. |
| Lists processes in a tree based on their parent process ID. |
| Lists the registry hives present in a particular memory image. |
| Scans for registry hives present in a particular Windows memory image. |
| Lists the registry keys under a hive or specific key value. |
| Prints UserAssist registry keys and information. |
| Lists processes with session information extracted from environmental variables. |
| Looks for signs of Skeleton Key malware. |
EVTXtract
This tool recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
The use case of this tool is when the challenge creator ask us to find something in the event log, but all he/she gives is a mem dump.
Download: https://github.com/williballenthin/EVTXtract
Usage
It's quite hard to read the XML output, you might need CTRL+F with context of the incident.
Last updated