Memory Analysis - Documentation

Link to this headingMemory Forensics and Analysis

Link to this headingVolatility

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples

Show Options and Supported plugins
vol.py -h

Show plugin usage
vol.py <plugin> -h

Identify System Profile
vol.py -f mem.img imageinfo

Identify Rogue Process
vol.py pslist -f mem.img

Scan memory for EPROCESS Blocks
vol.py psscan -f mem.img

Display parent-process relationships
vol.py pstree -f mem.img

Look for Evidence of Code Injection
vol.py malfind --dump-dir ./output_dir

ldrmodules
vol.py ldrmodules -p 868 -v

Link to this headingCheck for Signs of a Rootkit

Find Hidden processes using cross-view
vol.py psxview

Scan Memory for loaded, unloaded and Unlinked drivers
vol.py modscan

Link to this headingFind API/DLL Function hooks

vol.py apihooks
vol.py apihooks -p 868 (Specific PID)
vol.py apihooks -Q (Only Critical Processes)

Hooks in System Service Descriptor Table
vol.py ssdt | grep -v '(ntoskrnl|win32k)'

Display Interrupt Descriptor Table
vol.py idt

#Identify I/O Request Packet (IRP) hooks
vol.py driverip -r tcpip

Link to this headingAnalyze Process DLLs and Handles

List of loaded dlls by process
vol.py dlllist -p 4,868

Print process security indentifiers
vol.py getsids -p 868

List of open handles for each process

-t Display handles of a certain type {Process, Thread, Key, Event, File, Mutant, Token, Port} vol.py handles -p 58 -t Process, Mutant

Scan memory for FILE_OBJECT handles
vol.py filescan

Scan for Windows Service Information
vol.py svcscan

Link to this headingDump Suspicious Processes and Drivers

Extract DLLs from Specific Processes (dlldump)

-p Dump DLLs only for specific PIDs -b Dump DLLs from process at physical memory offset -r Dump DLLs matching REGEX name --dump-dir Directory to save extracted files vol.py dlldump --dump-dir ./output –r metsrv

Link to this headingExtract kernel drivers

moddump

-o Dump driver using offset address (from modscan) -r Dump drivers matching REGEX name --dump-dir Directory to save extracted files vol.py moddump --dump-dir ./output –r gaopdx

#Dump process to executable sample

#procmemdump -p Dump only specific PIDs -o Specify process by physical memory offset --dump-dir Directory to save extracted files vol.py procmemdump --dump-dir ./output –p 868

#Dump every memory section into a file

-p Dump memory sections from these PIDs --dump-dir Directory to save extracted files vol.py memdump –dump-dir ./output –p 868

Link to this headingReview Network Artifacts

[XP] List of open TCP connections
vol.py connections

[XP] ID TCP connections, including closed
vol.py connscan

[XP] Print listening sockets (any protocol)
vol.py sockets

[XP] ID sockets, including closed/unlinked
vol.py sockscan

[Win7] Scan for connections and sockets
vol.py netscan

Link to this headingMemory Acquisition

Windows Operating Systems

Win32dd (x86)
Win64dd (x64)

c:\> win32dd.exe /f E:\memory.img

MemoryDD.bat
c:\> MemoryDD.bat --output E:\

Converting Hibernation Files and Crash Dumps

-f Name of Source File -O Output file Name --profile Source OS from imageinfo vol.py imagecopy -f hiberfil.sys -O hiber.img --profile=Win7SP1x64 vol.py imagecopy -f Memory.dmp -O memdmp.img --profile=Win7SP1x64

Memory Artifact Timelining

The Volatility Timeliner plugin parses time-stamped objects found in memory images. Output is sorted by:

Process creation time
Thread creation time
Driver compile time
DLL / EXE compile time
Network socket creation time
Memory resident registry key last write time
Memory resident event log entry creation time

timeliner
‐‐output‐file Optional file to write output (v2.1)
‐‐output=body bodyfile format for mactime (v2.3)

vol.py -f mem.img timeliner --output-file out.csv --profile=Win7SP1x86

Registry Analysis Volatility Plugins

hivelist - Find and list available registry hives
vol.py hivelist

hivedump - Print all keys and subkeys in a hive

-o Offset of registry hive to dump (virtual offset) vol.py hivedump –o 0xe1a14b60

printkey - Output a registry key, subkeys, and values

-K “Registry key path” vol.py printkey –K “Software\Microsoft\Windows\CurrentVersion\Run”

userassist - Find and parse userassist key values
vol.py userassist

hashdump - Dump user NTLM and Lanman hashes

-y Virtual offset of SYSTEM registry hive (from hivelist) -s Virtual offset of SAM registry hive (from hivelist) vol.py hashdump –y 0x8781c008 –s 0x87f6b9c8

Link to this headingDump KeePass

Find keepass proxy from

wmic /node:"host" process list

get password and database from memory KeeTheif