Investigating Malware using Memory Forensics

  • View
    2.678

  • Download
    3

  • Category

    Software

Preview:

Click to see full reader

Citation preview

Investigating Malware using Memory Forensics

Monnappa K A

Info Security Investigator - Cisco CSIRTCo-founder Cysinfo - Cyber Security CommunityAuthor of Limon SandboxMalware Analysis, Reverse Engineering, Memory ForensicsConferences - Black Hat, FIRST, 4SICSArticles - eForensics, Hakin9, Hack Insight

Who am I

Finding and extracting forensic artifacts Helps in malware analysis Determining process, network, registry activities Reconstructing original state of the system Assists with unpacking, rootkit detection and reverse

engineering Sophisticated actors Critical data exists in memory

Why Memory Forensics?

Memory acquisition - Dumping the memory of a target machine

Memory analysis - Analyzing the memory dump for forensic artifacts

Steps in Memory Forensics

Process of Acquiring Volatile memory to non volatile storage

On Physical Machines(Tools): KnTTools F-Response Mandiant Memoryze HBGary FastDump MoonSols Windows Memory Toolkit(DumpIt)

On Virtual Machines: Suspend the VM (.vmem)

Memory Acquisition and tools

Your security device alerts on a http communication from 192.168.1.100 to a domain livedieoslix.com which resolves to 192.168.1.3, you suspect 192.168.1.100 to infected. You are asked to investigate the machine.- To start with, acquire the memory image “infected.dmp” from 192.168.1.100, using memory acquisition

tools- Analyze the memory dump “infected.dmp”

Demo-Scenario

Video Demo

Thank You !

@monnappa22

http://malware-unplugged.blogspot.in

monnappa22@gmail.com

Twitter:

Blog:

Gmail:

Recommended

Reversing & malware analysis training part 8 malware memory forensics
Technology
Malware Forensics Field Guide for Linux Systems: … Forensics Field... · Chapter | 3 ostmortem Forensics 165 u The hard drive of a Linux computer can contain traces of malware in
Documents
Detecting Malware With Memory Forensicshal/Detect_Malware_w_Memory_Forensics.pdfDetecting Malware With Memory Forensics Hal Pomeranz SANS Institute . Why Memory Forensics? Everything
Documents
Detecting Malware With Memory Forensics - Deer Run
Documents
Malware forensics 2016 - UNIL · The objectives of this training are to give an introduction to malware forensics with a particular focus on malware detection using memory forensics
Documents
Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics
Technology
Detecting Malware With Memory Forensics - Deer Runhal/Detect_Malware_w_Memory_Forensics.pdf · 2012-10-01 · Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute
Documents
Mobile Malware defense and possibly Anti-forensics
Technology
SBC 2012 - Malware Memory Forensics (Nguyễn Chấn Việt)
Technology
Leveraging NTFS Timeline Forensics during the Analysis of Malware
Technology
Reversing malware analysis training part8 malware memory forensics
Technology
Investigating Labelless Drift Adaptation for Malware Detection
Documents
Mobile (Smartphone) Forensics - · PDF fileMobile (Smartphone) Forensics ... Malware-Analysen. Copyright © 2009 –2017 Auditron GmbH ... 2017_MSI_Smartphone-Forensics
Documents
Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara
Documents
Memory Forensics: Defeating Disk Encryption, Skilled Attackers, and Advanced Malware
Technology
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics
Technology
Detecting Malware With Memory Forensics - Deer Run Associates
Documents
Advanced malware analysis training session 7 malware memory forensics
Technology
Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 5: Investigating DoS Attacks
Documents
ANALISA NETWORK FORENSICS PADA SERANGAN BOTNET€¦ · Botnet’s attack and payload identification according to Network Forensics Analysis. Keywords: Malware, Botnet, Network Forensics
Documents