See also Mem­ProcFS

The foren­sic mem­o­ry frame­work Volatil­i­ty (Ver­sion 3 since 2019) offers a wide range of meth­ods to analyse mem­o­ry. See the blog post Retriev­ing mem­o­ry for meth­ods and tech­niques to obtain memory.

Start by get­ting gen­er­al infor­ma­tion about a mem­o­ry dump:

volatility -f image.mem imageinfo

Now use the fol­low­ing com­mands to get more information:

• pslist to show the run­ning processes
• netscan shows cur­rent net­work connections
• ldrmodules shows which modules/libraries/dlls are loaded and also how they were loaded. If a line con­tains “False False False”, then the mod­ule was prob­a­bly direct­ly inject­ed into the mem­o­ry like Meter­preter does it. This is a seri­ous sig­nal for a mali­cious process.
• vol -f dump windows.privileges --pid 42 get the priv­i­leges for a process.
• vol -f dump windows.callbacks shows the call­backs — should only be the default win­dows callbacks.
• vol -f dump windows.vadinfo --pid 42 shows the VAD vir­tu­al address descrip­tors, the per­mis­sions on the pages, e.g. READONLY, READWRITE, EXECUTE_WRITECOPY, … Sus­pi­cious, if there are pages EXECUTE_READWRITE, because nor­mal­ly pages are not set to con­tain exe­cute­able code which is also writeable.
• vol -f dump windows.registry.hivelist --dump exports the reg­istry keys.
• vol -f dump windows.cmdline --pid 42 returns the com­mand line his­to­ry. Use­full for cmd.exe or powershell.exe processes.
• vol -f dump windows.pstree shows the process tree, also with argu­ments of commands.

Exam­ple:

• Scan with windows.netscan open connections
• Look with windows.pslist for sus­pi­cious processes.
• Get more infor­ma­tion with oth­er plu­g­ins, e.g. with windows.cmdline see, what hap­pened in powershell.exe or cmd.exe.

• Detect sys­tem type for the profile:
• volatil­i­ty ‑f /root/lab.notes/10.11.1.238/238.ram imageinfo
• Get Certs:
• volatil­i­ty ‑f /root/lab.notes/10.11.1.238/238.ram dumpcerts ‑D certs

volatil­i­ty ‑f /tmp/Linux64.mem –profile=Linuxd2018-1x6 linux_ifconfig