Volatility3 Exercise 2
Last updated
Last updated
Your company's webserver and database with critical data were hacked. During live response a memory dump was taken. Your task is to analyze the memory dump and determine whether any malicious program is running.
Tasks:
Discover which operating system the image was taken from.
Discover how you can use environment variables to optimize volatility.
Find malicious process(es)
Find the suspicious connection from the webserver.
Ressources:
The output shows that the memdump image is a Windows10. Volatilty2 suggests everytime more than one profile with different versions. Volatility3 seems to have a different profile system.
Processes can be listed with the PSList
and PsTree
command. I always prefere the PsTree
command because you can see the parent / child structure of the processes.
By manually checking the process hierarchy we find out that the processes with the following PIDs have a susipicious hierarchy: 1240
this is the svchost.exe
which has a parent of cmd.exe which definately looks suspicious. PID 6288
also svchost, has the other svchost.exe with PID 1240
as partent this also is suspicious.
Now we can use the windows.netscan
plugin to list the network connections.
There is a closed connection to a remote ip 207.154.250.59
.
The check with the pstree plugin shows that the malicious process has no parent process.
The following processes are likely to be malicious: 1240
and 6288
because of the late start times, incorrect parent processes and the network connection to a server in the internet belonging to digital ocean
.