search

Volatility3 Exercise 2

hashtag
01. Introduction

Your company's webserver and database with critical data were hacked. During live response a memory dump was taken. Your task is to analyze the memory dump and determine whether any malicious program is running.

Tasks:

  1. Discover which operating system the image was taken from.

  2. Discover how you can use environment variables to optimize volatility.

  3. Find malicious process(es)

  4. Find the suspicious connection from the webserver.

Ressources:

LogoMemoryForensic.zipDropboxchevron-right
Memory Image
LogoVolatility 3 CheatSheetonfvpchevron-right
Volatility Cheatsheet

hashtag
02. Detect Operating system

The output shows that the memdump image is a Windows10. Volatilty2 suggests everytime more than one profile with different versions. Volatility3 seems to have a different profile system.

hashtag
03. PSlist und PsTree

Processes can be listed with the PSList and PsTree command. I always prefere the PsTree command because you can see the parent / child structure of the processes.

By manually checking the process hierarchy we find out that the processes with the following PIDs have a susipicious hierarchy: 1240 this is the svchost.exe which has a parent of cmd.exe which definately looks suspicious. PID 6288 also svchost, has the other svchost.exe with PID 1240 as partent this also is suspicious.

hashtag
04. Netscan plugin

Now we can use the windows.netscan plugin to list the network connections.

There is a closed connection to a remote ip 207.154.250.59.

hashtag
5. Conclusion

The check with the pstree plugin shows that the malicious process has no parent process.

The following processes are likely to be malicious: 1240 and 6288 because of the late start times, incorrect parent processes and the network connection to a server in the internet belonging to digital ocean.

PreviousVolatility3 Exercise 1NextVolatility3 Exercise 3

Last updated