Windows Memory Analysis

As a continuation of the “Introduction to Memory Forensics” video, we will use Volatility to analyze a Windows memory image that contains malware. We’ll first start by using some of the more common plugins that were covered in the previous video, including pstree, pslist, and psscan. As we sift through that data, we’ll look for any processes that stand out as being odd, or potentially malicious. Then, we’ll move on to a more advanced plugin called malfind. As the name implies, malfind helps us locate malicious code within our memory image, including hidden or injected code or DLLs. Next, we’ll look at a similar plugin called hollowfind, which won first place in the 2016 Volatility Plugin Contest, and is designed to automate detection of various process hollowing techniques you may encounter. Lastly, we’ll use procdump to dump a couple of the identified malicious processes. We’ll then hash them, and submit those hashes to VirusTotal to verify our findings.

Introduction to Memory Forensics:
https://www.youtube.com/watch?v=1PAGcPJFwbE

Volatility Memory Samples:
https://github.com/volatilityfoundation/volatility/wiki/Memory-Samples

Detecting Deceptive Process Hollowing Techniques:
https://cysinfo.com/detecting-deceptive-hollowing-techniques/
This website provides an analysis of the same memory image, and provides a great overview of process hollowing.

HollowFind:
https://github.com/monnappa22/HollowFind

Ten Process Injection Techniques:
https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #MemoryForensics