Finding malware in memory images

MrBrian · Oct 7, 2014

From paper "Comparative Analysis of Operational Malware Dynamic Link Library (DLL) Injection Live Response vs. Memory Image" (2012):

Abstract:

One advanced tactic used to deliver a malware payload to a target operating system is Dynamic Link Library (DLL) injection, which has the capabilities to bypass many security settings. In cases of compromise involving DLL injection, volatile memory contains critical evidence, as these attacks typically leave no footprint on the hard disk. In this paper, we describe the results of our comparative analysis between a particular live response utility, Redline, and a particular memory image utility, Volatility, in cases where malware is using DLL injection. We show that Redline is significantly limited, by comparison with Volatility, in its ability to collect relevant evidence from memory. Based upon these observations, we draw general conclusions about the advantages of memory image analysis over live response.
Click to expand...

Paper is available at hxxp://ijitcs.com/volume%204_No_1/Ahmed+Alasiri.pdf .

----------

A few of the many Volatility Framework commands:

psxview:

This plugin helps you detect hidden processes
Click to expand...

malfind:

You can use it to find hidden or injected code/DLLs in user mode memory, based on characteristics such as VAD tag and page permissions.
Click to expand...

Have any of you tried Volatility Framework?

MrBrian · Oct 8, 2014

If you're interesting in this topic, there's an 886 page book called "The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory" (2014).

Log in or Sign up

Finding malware in memory images

MrBrian Registered Member

MrBrian Registered Member

Log in or Sign up

Finding malware in memory images

MrBrian Registered Member

MrBrian Registered Member

Useful Searches