Pulling Threads

As a continuation of the "Introduction to Memory Forensics" series, this episode walks through the analysis of a Windows 10 memory image potentially infected with malware. We’ll use Volatility to look for suspicious processes, and then we’ll look at network artifacts to discover any potentially malicious traffic. We’ll discuss ways to detect process injection and process hollowing (some of which we’ve covered in a previous episode in this series), and finally, we’ll dump one of the identified suspicious processes to disk for further analysis and reverse engineering.

While this isn’t an exhaustive and comprehensive analysis, it does cover some of the most common Volatility plugins that can help us quickly obtain solid findings and generate investigative leads. In a future episode, we’ll expand on the topics here and cover analysis of suspicious DLLs associated with processes, suspicious handles, registry keys, and rootkit detection techniques.

-----

Contest Information:
The giveaway mentioned within this video is in no way sponsored, endorsed or administered by, or associated with YouTube, Twitter, or any other social media platform on which it may be promoted. This giveaway complies with all YouTube contest rules listed at https://support.google.com/youtube/answer/1620498?hl=en. No YouTube subscription, social media sharing, or purchase is necessary to enter, only your Twitter username so we can contact you if you win. The contest complies with all local laws. You must be 18 to be awarded a valid entry. Privacy: Your name and Twitter username will NOT be shared.

To enter, download the memory sample below, extract the password for the “13cubed” user, and send a Twitter Direct Message (DM) to @davisrichardg. The first submission will win a 13Cubed T-Shirt (men’s and women’s sizes available, along with various colors and designs). See the 13Cubed Merch link below for product details.

-----

*** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. ***

13Cubed Merch:
https://www.amazon.com/s/ref=w_bl_sl_s_ap_web_7141123011?ie=UTF8&node=7141123011&field-brandtextbin=13Cubed

Introduction to Memory Forensics – Playlist:
https://www.youtube.com/watch?v=1PAGcPJFwbE&list=PLlv3b9B16Zaf-uDlgouB0DMiPNYU_sJFN

Memory Sample Used in This Episode:
https://drive.google.com/drive/folders/1wDj2KjHhRHVJBc9dpK54Zy2uhGjOs73Y?usp=sharing

Background Music Courtesy of Anders Enger Jensen:
https://www.youtube.com/user/HariboOSX

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #MemoryForensics #MalwareAnalysis #Malware