Stop pulling the plug
1 like764 views
The document outlines the importance and methodology of memory forensics in incident response, highlighting how memory analysis can reveal evidence of malicious activity. It details the process of memory acquisition, analysis of suspicious processes, and the use of tools like Redline and Volatility for analysis. The advantages of memory forensics include retrieving clear text passwords, identifying running processes, and examining network connections specifically to detect malware that may attempt to hide its presence.
Stop pulling the plug
- 1. Stop Pulling The Plug
- 2. Incident Response Preparation Identification and Analysis Containment Eradication Recovery Lessons learnt
- 3. Why Memory Forensics Everything in the OS traverses RAM Best place to identify malicious software activity Analyze and track recent activity on the system Collect evidence that cannot be found anywhere else
- 4. Artifacts that can be found in Memory Processes Logged Users Drivers Open files Kernel Modules Unsaved documents Socket Information Live registries Passwords Video Buffers (Screenshots) Crypto Passphrases BIOS Memory Decrypted Files VOIP Calls Execution State Malicious Code Clipboard Material IM chats Network Drive buffers Rootkit Footprints
- 5. Advantages of Memory Forensics Password in clear text in memory Programs running Open Documents / Files Open content of compressed programs (packers) Network Connections – current and recent Crypto Keys (BitLocker, PGP Whole Disk Encryption, TrueCrypt etc.) Command Line parameters (DOSKEY/cmd.exe)
- 6. The Malware Paradox Malware may be successful at either hiding or executing, but it is nearly impossible to do both! Malware can hide, but it has to execute to be effective.
- 7. Memory Forensics Acquisition • Executing Memory • Pagefile • Hibernation file Context • Find offset from the needed structures • Extract structures from memory • Isolate Processes
- 8. Memory Analysis Process 1. Identify Rouge processes 2. Analyze process DLLs and handles 3. Review Network Artifacts 4. Look for evidence of code injection 5. Check for signs of rootkit 6. Dump suspicious processes and drivers
- 9. Finding the First Hit Analyzing Processes Image Name Full Path Parent Process Command Line StartTime SIDs
- 10. Redline Free but not open source Identify Rouge processes Was the process started at boot? What user was logged on? Any other suspicious processes? Any further clues/string searches Explore more What did you collect so far…. Binaries/network connections/compromised user accounts……….Compare with live audit on the system
- 11. SIFT Forensic Workstation Download SANS SIFTWorkstation from http://computer- forensics.sans.org/community/downloads
- 12. Let’s start Login "sansforensics" Password "forensics" $ sudo su Elevate privileges to root while mounting disk images.
- 13. Volatility Free and open source Vol.py –f <image> <plugin> -- profile=<profile> Export VOLATILITY_LOCATION=file://<filepath> ExportVOLATILITY_PROFILE=<profile> Vol.py –f <image format 1> imagecopy –o <imageformat1.img>
- 14. It’s Show Time Memory Analysis using Redline Memory Analysis usingVolatility
- 15. What Next… Volatility RegistryAnalysis MemoryTimelining
- 16. References Windows Forensic AnalysisToolkit – Harlan Carvey https://www.mandiant.com/resources/downl oad/redline https://code.google.com/p/volatility/ https://code.google.com/p/volatility/wiki/Sa mpleMemoryImages https://http://computer- forensics.sans.org/community
- 17. THANK YOU Kamal Ranjan Incident Response/Forensic Analyst @ FIS