• Home

  • Software

  • Investigating Malware using Memory Forensics
8
Investigating Malware using Memory Forensics

Investigating Malware using Memory Forensics

Embed Size (px)

Citation preview

Page 1: Investigating Malware using Memory Forensics

Investigating Malware using Memory Forensics

Page 2: Investigating Malware using Memory Forensics

Monnappa K A

Info Security Investigator - Cisco CSIRTCo-founder Cysinfo - Cyber Security CommunityAuthor of Limon SandboxMalware Analysis, Reverse Engineering, Memory ForensicsConferences - Black Hat, FIRST, 4SICSArticles - eForensics, Hakin9, Hack Insight

Who am I

Page 3: Investigating Malware using Memory Forensics

Finding and extracting forensic artifacts Helps in malware analysis Determining process, network, registry activities Reconstructing original state of the system Assists with unpacking, rootkit detection and reverse

engineering Sophisticated actors Critical data exists in memory

Why Memory Forensics?

Page 4: Investigating Malware using Memory Forensics

Memory acquisition - Dumping the memory of a target machine

Memory analysis - Analyzing the memory dump for forensic artifacts

Steps in Memory Forensics

Page 5: Investigating Malware using Memory Forensics

Process of Acquiring Volatile memory to non volatile storage

On Physical Machines(Tools): KnTTools F-Response Mandiant Memoryze HBGary FastDump MoonSols Windows Memory Toolkit(DumpIt)

On Virtual Machines: Suspend the VM (.vmem)

Memory Acquisition and tools

Page 6: Investigating Malware using Memory Forensics

Your security device alerts on a http communication from 192.168.1.100 to a domain livedieoslix.com which resolves to 192.168.1.3, you suspect 192.168.1.100 to infected. You are asked to investigate the machine.- To start with, acquire the memory image “infected.dmp” from 192.168.1.100, using memory acquisition

tools- Analyze the memory dump “infected.dmp”

Demo-Scenario

Page 7: Investigating Malware using Memory Forensics

Video Demo

Page 8: Investigating Malware using Memory Forensics

Thank You !

@monnappa22

http://malware-unplugged.blogspot.in

[email protected]

Twitter:

Blog:

Gmail:


Investigating Malware Propagation and Behaviour Using

Investigating Malware Propagation and Behaviour Using

Documents
Forensics Book 4: Investigating Network Intrusions and Cybercrime

Forensics Book 4: Investigating Network Intrusions and Cybercrime

Documents
Detecting Malware With Memory Forensics - Deer Run

Detecting Malware With Memory Forensics - Deer Run

Documents
Practical Reversing III – Malware Memory Forensics

Practical Reversing III – Malware Memory Forensics

Documents
Mobile security, forensics & malware analysis with …2013.appsecusa.org/2013/wp-content/uploads/2013/12/viaForensics... · Mobile security, forensics & malware analysis with Santoku

Mobile security, forensics & malware analysis with …2013.appsecusa.org/2013/wp-content/uploads/2013/12/viaForensics... · Mobile security, forensics & malware analysis with Santoku

Documents
Leveraging NTFS Timeline Forensics during the Analysis of Malware

Leveraging NTFS Timeline Forensics during the Analysis of Malware

Technology
Bringing Science to the Evaluation of Malware Forensics

Bringing Science to the Evaluation of Malware Forensics

Documents
Few Malware Anti- Forensics e. Techniques - · PDF fileFew Malware Anti-Forensics Techniques H2HC University 2016 By Alexandre Borges 1 es – e

Few Malware Anti- Forensics e. Techniques - · PDF fileFew Malware Anti-Forensics Techniques H2HC University 2016 By Alexandre Borges 1 es – e

Documents
Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 4: Router Forensics

Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 4: Router Forensics

Documents
Investigating the Tamil Tigers - HUB Forensics

Investigating the Tamil Tigers - HUB Forensics

Documents
Reversing & malware analysis training part 8 malware memory forensics

Reversing & malware analysis training part 8 malware memory forensics

Technology
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Mobile (Smartphone) Forensics - · PDF fileMobile (Smartphone) Forensics ... Malware-Analysen. Copyright © 2009 –2017 Auditron GmbH ... 2017_MSI_Smartphone-Forensics

Mobile (Smartphone) Forensics - · PDF fileMobile (Smartphone) Forensics ... Malware-Analysen. Copyright © 2009 –2017 Auditron GmbH ... 2017_MSI_Smartphone-Forensics

Documents
Memory Forensics Malware Detection - GitHub Pagestristartom.github.io/teaching/15s-cis700/others/memanalysis.pdf · Memory Forensics Per Wikipedia, Memory forensics is forensic analysis

Memory Forensics Malware Detection - GitHub Pagestristartom.github.io/teaching/15s-cis700/others/memanalysis.pdf · Memory Forensics Per Wikipedia, Memory forensics is forensic analysis

Documents
Advanced Malware Analysis Training Session 7 - Malware Memory Forensics

Advanced Malware Analysis Training Session 7 - Malware Memory Forensics

Technology
ANALISA NETWORK FORENSICS PADA SERANGAN BOTNET€¦ · Botnet’s attack and payload identification according to Network Forensics Analysis. Keywords: Malware, Botnet, Network Forensics

ANALISA NETWORK FORENSICS PADA SERANGAN BOTNET€¦ · Botnet’s attack and payload identification according to Network Forensics Analysis. Keywords: Malware, Botnet, Network Forensics

Documents
Malware forensics 2016 - UNIL · The objectives of this training are to give an introduction to malware forensics with a particular focus on malware detection using memory forensics

Malware forensics 2016 - UNIL · The objectives of this training are to give an introduction to malware forensics with a particular focus on malware detection using memory forensics

Documents
Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 5: Investigating DoS Attacks

Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 5: Investigating DoS Attacks

Documents
Memory Forensics: Collecting & Analyzing Malware Artifacts from … · 2016. 10. 23. · Memory Forensics: Collecting and Analyzing Malware Artifacts from RAM . Volatility Modules

Memory Forensics: Collecting & Analyzing Malware Artifacts from … · 2016. 10. 23. · Memory Forensics: Collecting and Analyzing Malware Artifacts from RAM . Volatility Modules

Documents
Mobile Malware defense and possibly Anti-forensics

Mobile Malware defense and possibly Anti-forensics

Technology
Tools and techniques for cleaning malware incidents · Tools and techniques for cleaning malware incidents Martin Overton – IBM Security Services Malware/Anti-Malware SME, Forensics,

Tools and techniques for cleaning malware incidents · Tools and techniques for cleaning malware incidents Martin Overton – IBM Security Services Malware/Anti-Malware SME, Forensics,

Documents
(160820) #fitalk fileless malware forensics

(160820) #fitalk fileless malware forensics

Technology
Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara

Memory Forensics -  · Memory Forensics An introduction ... Practical Malware Analysis ... Cuckoo Sandbox Yara

Documents
Malware Forensics Field Guide for Linux Systems: Digital Forensics …cdn.ttgtmedia.com/rms/security/Malware Forensics Field... · 2014-09-02 · 164 MALWARE FORENSICS FIELD GUIDE

Malware Forensics Field Guide for Linux Systems: Digital Forensics …cdn.ttgtmedia.com/rms/security/Malware Forensics Field... · 2014-09-02 · 164 MALWARE FORENSICS FIELD GUIDE

Documents
Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Technology
Investigating Labelless Drift Adaptation for Malware Detection

Investigating Labelless Drift Adaptation for Malware Detection

Documents
Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 3: Investigating Web Attacks

Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 3: Investigating Web Attacks

Documents
Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 2: Investigating Network Traffic

Forensics Book 4: Investigating Network Intrusions and Cybercrime Chapter 2: Investigating Network Traffic

Documents
Malware Memory Forensics

Malware Memory Forensics

Documents
Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Documents