Memory dump analysis
Start¶
Start searching for malware inside the pcap. Use the tools mentioned in Malware Analysis.
Volatility¶
Volatility is the main open-source framework for memory dump analysis. This Python tool analyzes dumps from external sources or VMware VMs, identifying data like processes and passwords based on the dump's OS profile. It's extensible with plugins, making it highly versatile for forensic investigations.
Mini dump crash report¶
When the dump is small (just some KB, maybe a few MB) then it's probably a mini dump crash report and not a memory dump.
Note
If you have Visual Studio installed, you can open this file and bind some basic information like process name, architecture, exception info and modules being executed:
You can also load the exception and see the decompiled instructions
Anyway, Visual Studio isn't the best tool to perform an analysis of the depth of the dump.
You should open it using IDA or Radare to inspection it in depth.
Volatility - CheatSheet¶
If you want something fast and crazy that will launch several Volatility plugins on parallel you can use: https://github.com/carlospolop/autoVolatility
python autoVolatility.py -f MEMFILE -d OUT_DIRECTORY -e /home/user/tools/volatility/vol.py # It will use the most important plugins (could use a lot of space depending on the size of the memory)
Installation¶
volatility3¶
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h
volatility2¶
- Method1
- Method2
git clone https://github.com/volatilityfoundation/volatility.git
cd volatility
python setup.py install
Volatility Commands¶
Access the official doc in Volatility command reference
A note on “list” vs. “scan” plugins¶
Volatility has two main approaches to plugins, which are sometimes reflected in their names. “list” plugins will try to navigate through Windows Kernel structures to retrieve information like processes (locate and walk the linked list of _EPROCESS structures in memory), OS handles (locating and listing the handle table, dereferencing any pointers found, etc). They more or less behave like the Windows API would if requested to, for example, list processes.
That makes “list” plugins pretty fast, but just as vulnerable as the Windows API to manipulation by malware. For instance, if malware uses DKOM to unlink a process from the _EPROCESS linked list, it won’t show up in the Task Manager and neither will it in the pslist.
“scan” plugins, on the other hand, will take an approach similar to carving the memory for things that might make sense when dereferenced as specific structures. psscan for instance will read the memory and try to make_EPROCESS objects out of it (it uses pool-tag scanning, which is searching for 4-byte strings that indicate the presence of a structure of interest). The advantage is that it can dig up processes that have exited, and even if malware tampers with the _EPROCESS linked list, the plugin will still find the structure lying around in memory (since it still needs to exist for the process to run). The downfall is that “scan” plugins are a bit slower than “list” plugins, and can sometimes yield false positives (a process that exited too long ago and had parts of its structure overwritten by other operations).
From: http://tomchop.me/2016/11/21/tutorial-volatility-plugins-malware-analysis/
OS Profiles¶
Volatility3¶
As explained inside the readme you need to put the symbol table of the OS you want to support inside volatility3/volatility/symbols. Symbol table packs for the various operating systems are available for download at:
- https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip
- https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip
- https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip
Volatility2¶
External Profile¶
You can get the list of supported profiles doing:
If you want to use a new profile you have downloaded (for example a linux one) you need to create somewhere the following folder structure: plugins/overlays/linux and put inside this folder the zip file containing the profile. Then, get the number of the profiles using:
./vol --plugins=/home/kali/Desktop/ctfs/final/plugins --info
Volatility Foundation Volatility Framework 2.6
Profiles
--------
LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 - A Profile for Linux CentOS7_3.10.0-123.el7.x86_64_profile x64
VistaSP0x64 - A Profile for Windows Vista SP0 x64
VistaSP0x86 - A Profile for Windows Vista SP0 x86
You can download Linux and Mac profiles from https://github.com/volatilityfoundation/profiles
In the previous chunk you can see that the profile is called LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64, and you can use it to execute something like:
./vol -f file.dmp --plugins=. --profile=LinuxCentOS7_3_10_0-123_el7_x86_64_profilex64 linux_netscan
Discover Profile¶
Differences between imageinfo and kdbgscan¶
From here: As opposed to imageinfo which simply provides profile suggestions, kdbgscan is designed to positively identify the correct profile and the correct KDBG address (if there happen to be multiple). This plugin scans for the KDBGHeader signatures linked to Volatility profiles and applies sanity checks to reduce false positives. The verbosity of the output and the number of sanity checks that can be performed depends on whether Volatility can find a DTB, so if you already know the correct profile (or if you have a profile suggestion from imageinfo), then make sure you use it from .
Always take a look at the number of processes that kdbgscan has found. Sometimes imageinfo and kdbgscan can find more than one suitable profile but only the valid one will have some process related (This is because to extract processes the correct KDBG address is needed)
# GOOD
PsActiveProcessHead : 0xfffff800011977f0 (37 processes)
PsLoadedModuleList : 0xfffff8000119aae0 (116 modules)
# BAD
PsActiveProcessHead : 0xfffff800011947f0 (0 processes)
PsLoadedModuleList : 0xfffff80001197ac0 (0 modules)
KDBG¶
The kernel debugger block, referred to as KDBG by Volatility, is crucial for forensic tasks performed by Volatility and various debuggers. Identified as KdDebuggerDataBlock and of the type _KDDEBUGGER_DATA64, it contains essential references like PsActiveProcessHead. This specific reference points to the head of the process list, enabling the listing of all processes, which is fundamental for thorough memory analysis.
What is conhost.exe¶
reference to：conhost.exe 是 Windows 操作系统中的一个进程，主要作用是为控制台窗口（Command Prompt 或 PowerShell 等）提供支持和管理。具体来说： - suv789 - 博客园
reference¶
reference to:Volatility - CheatSheet | HackTricks