Volatility3 Exercise 2
Last updated
Last updated
Your company's webserver and database with critical data were hacked. During live response a memory dump was taken. Your task is to analyze the memory dump and determine whether any malicious program is running.
Tasks:
Discover which operating system the image was taken from.
Discover how you can use environment variables to optimize volatility.
Find malicious process(es)
Find the suspicious connection from the webserver.
Ressources:
The output shows that the memdump image is a Windows10. Volatilty2 suggests everytime more than one profile with different versions. Volatility3 seems to have a different profile system.
Processes can be listed with the PSList and PsTree command. I always prefere the PsTree command because you can see the parent / child structure of the processes.
By manually checking the process hierarchy we find out that the processes with the following PIDs have a susipicious hierarchy: 1240 this is the svchost.exe which has a parent of cmd.exe which definately looks suspicious. PID 6288 also svchost, has the other svchost.exe with PID 1240 as partent this also is suspicious.
Now we can use the windows.netscan plugin to list the network connections.
There is a closed connection to a remote ip 207.154.250.59.
The check with the pstree plugin shows that the malicious process has no parent process.
The following processes are likely to be malicious: 1240 and 6288 because of the late start times, incorrect parent processes and the network connection to a server in the internet belonging to digital ocean.
