1 1 00:00:00,210 --> 00:00:02,100 Memory forensics. 2 2 00:00:02,100 --> 00:00:06,060 Nowadays, a lot of malware is using fileless techniques. 3 3 00:00:06,060 --> 00:00:08,100 This way they store most of their code 4 4 00:00:08,100 --> 00:00:10,470 or all of their code inside of memory. 5 5 00:00:10,470 --> 00:00:12,390 Now, fileless malware will execute 6 6 00:00:12,390 --> 00:00:15,150 from memory without saving anything to the file system. 7 7 00:00:15,150 --> 00:00:17,220 And if it does save anything to the file system, 8 8 00:00:17,220 --> 00:00:20,400 it's very careful to delete that as quickly as possible. 9 9 00:00:20,400 --> 00:00:22,080 This makes it harder to detect 10 10 00:00:22,080 --> 00:00:24,360 and harder for you to do your threat hunting. 11 11 00:00:24,360 --> 00:00:26,760 Now, fileless detection techniques are techniques 12 12 00:00:26,760 --> 00:00:28,860 that require the analysis of the contents 13 13 00:00:28,860 --> 00:00:32,190 of system memory and of the process behavior rather 14 14 00:00:32,190 --> 00:00:34,380 than relying on scanning of the file system. 15 15 00:00:34,380 --> 00:00:36,690 Because fileless malware doesn't leave a lot 16 16 00:00:36,690 --> 00:00:39,360 of traces on the hard drive or the file system, 17 17 00:00:39,360 --> 00:00:41,730 you have to use special techniques to find it. 18 18 00:00:41,730 --> 00:00:44,460 In this lesson, that's what we're going to focus on. 19 19 00:00:44,460 --> 00:00:46,530 Now, a memory analysis technique is going 20 20 00:00:46,530 --> 00:00:48,690 to allow you to reverse engineer the code used 21 21 00:00:48,690 --> 00:00:49,860 by the process. 22 22 00:00:49,860 --> 00:00:51,960 It'll allow you to discover how the process interacts 23 23 00:00:51,960 --> 00:00:54,570 with the file system, also known as the handles, 24 24 00:00:54,570 --> 00:00:56,970 and how it interacts with the registry. 25 25 00:00:56,970 --> 00:00:59,340 Also, it'll help you to examine network connections, 26 26 00:00:59,340 --> 00:01:00,840 retrieve cryptographic keys 27 27 00:01:00,840 --> 00:01:03,870 and extract strings from within the memory. 28 28 00:01:03,870 --> 00:01:04,830 This can all be done 29 29 00:01:04,830 --> 00:01:07,230 once you have a memory dump, and we've talked 30 30 00:01:07,230 --> 00:01:09,300 about how to collect memory dumps all the way back 31 31 00:01:09,300 --> 00:01:11,100 in our forensic lessons. 32 32 00:01:11,100 --> 00:01:12,960 Now, what kind of strings could you extract 33 33 00:01:12,960 --> 00:01:14,880 from one of these memory dumps? 34 34 00:01:14,880 --> 00:01:16,050 Well, let's say I was making 35 35 00:01:16,050 --> 00:01:18,450 a communications call over Skype. 36 36 00:01:18,450 --> 00:01:20,010 As I place that call, 37 37 00:01:20,010 --> 00:01:22,320 Skype is going to write a specific string to memory 38 38 00:01:22,320 --> 00:01:25,140 for every message sent or every call that goes out. 39 39 00:01:25,140 --> 00:01:27,780 So I could use that to be able to search that string 40 40 00:01:27,780 --> 00:01:29,430 inside a memory to identify 41 41 00:01:29,430 --> 00:01:32,310 where in that memory they have been storing those messages. 42 42 00:01:32,310 --> 00:01:34,110 So if I was a bad actor, for instance, 43 43 00:01:34,110 --> 00:01:36,480 and I was communicating with somebody else over Skype, 44 44 00:01:36,480 --> 00:01:39,030 and you've collected an image of my computer, you could go 45 45 00:01:39,030 --> 00:01:41,520 into that and figure out exactly what I was saying 46 46 00:01:41,520 --> 00:01:44,340 and to who I was saying it to because that string would act 47 47 00:01:44,340 --> 00:01:46,530 as a pointer to the rest of the message. 48 48 00:01:46,530 --> 00:01:48,960 Now, if you think back to our forensic lessons, we talked 49 49 00:01:48,960 --> 00:01:51,060 about FTK and EnCase. 50 50 00:01:51,060 --> 00:01:53,790 Both of these are commercial and proprietary software 51 51 00:01:53,790 --> 00:01:55,350 that are dedicated forensic suites 52 52 00:01:55,350 --> 00:01:56,940 for collecting information. 53 53 00:01:56,940 --> 00:01:58,380 Now, one of the functions they have 54 54 00:01:58,380 --> 00:02:00,330 is a memory analysis module. 55 55 00:02:00,330 --> 00:02:02,910 It allows you to collect the memory and then analyze it 56 56 00:02:02,910 --> 00:02:05,010 for all of these different types of artifacts. 57 57 00:02:05,010 --> 00:02:07,230 In addition to using FTK or EnCase, 58 58 00:02:07,230 --> 00:02:09,630 you can also use several different open source 59 59 00:02:09,630 --> 00:02:11,610 and freeware options that are out there. 60 60 00:02:11,610 --> 00:02:15,300 For instance, we have one known as the volatility framework. 61 61 00:02:15,300 --> 00:02:17,670 This is an open source memory forensics tool 62 62 00:02:17,670 --> 00:02:19,200 that has many different modules 63 63 00:02:19,200 --> 00:02:20,880 for analyzing specific elements 64 64 00:02:20,880 --> 00:02:23,460 of memory, such as web browser module that looks 65 65 00:02:23,460 --> 00:02:26,310 at your history, command prompt history modules that'll look 66 66 00:02:26,310 --> 00:02:29,160 at your command prompt history, and many others. 67 67 00:02:29,160 --> 00:02:30,930 When you load up the volatility framework, 68 68 00:02:30,930 --> 00:02:32,940 it looks something like this. 69 69 00:02:32,940 --> 00:02:36,360 This is a text-based command line interface tool. 70 70 00:02:36,360 --> 00:02:39,690 It allows you to take a memory dump of a system and then go 71 71 00:02:39,690 --> 00:02:41,790 through it for particular information. 72 72 00:02:41,790 --> 00:02:44,310 In this example, I have a dump that was taken 73 73 00:02:44,310 --> 00:02:47,520 from a Windows 7 virtual machine, and I'm going 74 74 00:02:47,520 --> 00:02:49,590 into it using the volatility framework 75 75 00:02:49,590 --> 00:02:52,590 and searching that dump for any processes that were running 76 76 00:02:52,590 --> 00:02:55,230 at the time this memory dump was conducted. 77 77 00:02:55,230 --> 00:02:56,760 Now notice here on the screen, 78 78 00:02:56,760 --> 00:02:58,950 I'm using pslist, which is that module 79 79 00:02:58,950 --> 00:03:01,350 to do that at the end of the first line. 80 80 00:03:01,350 --> 00:03:03,660 This then loads up, searches the memory, 81 81 00:03:03,660 --> 00:03:05,580 shows me the offset location, 82 82 00:03:05,580 --> 00:03:08,400 the name of the processes that we're running, the PID, 83 83 00:03:08,400 --> 00:03:13,170 the parent PID, the threads, the handles, the sessions 84 84 00:03:13,170 --> 00:03:15,780 and then the information of when it was started. 85 85 00:03:15,780 --> 00:03:19,770 If you see here, I've highlighted one called salter.exe. 86 86 00:03:19,770 --> 00:03:21,000 As I've looked through this list, 87 87 00:03:21,000 --> 00:03:23,940 that is the one process that looks suspicious to me. 88 88 00:03:23,940 --> 00:03:25,440 So I would look at that process, 89 89 00:03:25,440 --> 00:03:27,420 I would find out the information on that process 90 90 00:03:27,420 --> 00:03:30,420 and then I would start doing some research to figure out 91 91 00:03:30,420 --> 00:03:31,920 what is suspicious about it 92 92 00:03:31,920 --> 00:03:34,770 and whether or not it's actually malicious in nature. 93 93 00:03:34,770 --> 00:03:36,360 The reason I highlighted that process 94 94 00:03:36,360 --> 00:03:38,910 is because that process is one that I don't recognize 95 95 00:03:38,910 --> 00:03:40,530 as a legitimate process. 96 96 00:03:40,530 --> 00:03:42,270 All of the other ones I see there are things 97 97 00:03:42,270 --> 00:03:44,160 that I recognize as legitimate processes 98 98 00:03:44,160 --> 00:03:45,690 as part of my baseline. 99 99 00:03:45,690 --> 00:03:47,880 So now that I've identified that process, 100 100 00:03:47,880 --> 00:03:49,800 I could take it one step further. 101 101 00:03:49,800 --> 00:03:54,630 Notice the PID here, 1808 and I have 134 handles, 102 102 00:03:54,630 --> 00:03:57,360 which means different files or parts of files 103 103 00:03:57,360 --> 00:03:59,340 that are being touched by that process. 104 104 00:03:59,340 --> 00:04:00,930 So as I dig a little deeper, 105 105 00:04:00,930 --> 00:04:02,790 I'm going to want to identify what types 106 106 00:04:02,790 --> 00:04:06,360 of files were being touched by salter.exe. 107 107 00:04:06,360 --> 00:04:09,450 Now, as I do that, I'm going to use Volatility framework again, 108 108 00:04:09,450 --> 00:04:11,580 going into that memory dump, and I'm going to look 109 109 00:04:11,580 --> 00:04:14,280 at a specific PID and look at the handles for it 110 110 00:04:14,280 --> 00:04:15,570 and the different object types, 111 111 00:04:15,570 --> 00:04:17,520 which in this case are files. 112 112 00:04:17,520 --> 00:04:18,540 So as I do that, 113 113 00:04:18,540 --> 00:04:21,870 I'm seeing again all the ones for PID 1808. 114 114 00:04:21,870 --> 00:04:24,300 Now, I've highlighted one that looks interesting to me 115 115 00:04:24,300 --> 00:04:26,940 and I've actually blown that up here on the screen for you. 116 116 00:04:26,940 --> 00:04:31,413 Notice that it has the name 9781642741292.pdf. 117 117 00:04:34,860 --> 00:04:36,990 Now, why does that look interesting? 118 118 00:04:36,990 --> 00:04:38,490 Well, as I look at the screen here, 119 119 00:04:38,490 --> 00:04:40,680 everything else there looks pretty mundane 120 120 00:04:40,680 --> 00:04:43,020 but this file has a really weird name. 121 121 00:04:43,020 --> 00:04:44,580 How many people actually name their files 122 122 00:04:44,580 --> 00:04:46,590 with a random string of digits like this? 123 123 00:04:46,590 --> 00:04:47,790 Most people don't 124 124 00:04:47,790 --> 00:04:50,820 but the people who do tend to have malicious intent 125 125 00:04:50,820 --> 00:04:52,560 and so they're trying to send this information out 126 126 00:04:52,560 --> 00:04:54,810 and they send out lots of different random files. 127 127 00:04:54,810 --> 00:04:57,270 And this number, if there was malware embedded in it 128 128 00:04:57,270 --> 00:05:00,990 might be the unique ID that beacons back and says, hey, 129 129 00:05:00,990 --> 00:05:03,870 this machine is now known by that serial number 130 130 00:05:03,870 --> 00:05:05,970 because that shield number will identify this part 131 131 00:05:05,970 --> 00:05:06,960 of my botnet. 132 132 00:05:06,960 --> 00:05:09,210 So let's take it one step further. 133 133 00:05:09,210 --> 00:05:11,520 We've identified a process we thought was suspicious. 134 134 00:05:11,520 --> 00:05:13,620 We've identified a handle to a file 135 135 00:05:13,620 --> 00:05:16,950 that we think is suspicious, so what else might we look at? 136 136 00:05:16,950 --> 00:05:20,040 Well, as we run Volatility again against this memory dump, 137 137 00:05:20,040 --> 00:05:22,470 the next thing I'm going to look at is network activity. 138 138 00:05:22,470 --> 00:05:24,480 So I'll use the net scan module. 139 139 00:05:24,480 --> 00:05:26,490 Here you'll see I've highlighted one all the way 140 140 00:05:26,490 --> 00:05:27,840 at the bottom of the screen. 141 141 00:05:27,840 --> 00:05:31,620 Again, this is the same process, 1808 being run 142 142 00:05:31,620 --> 00:05:33,390 by the salter.exe file. 143 143 00:05:33,390 --> 00:05:36,060 You'll see we have a connection between two IP addresses. 144 144 00:05:36,060 --> 00:05:38,460 And so now we can look at those two IP addresses. 145 145 00:05:38,460 --> 00:05:40,860 We have the first IP, which is our local address, 146 146 00:05:40,860 --> 00:05:44,640 10.1.0.101 coming from port 1095. 147 147 00:05:46,050 --> 00:05:48,150 This is connecting to the foreign address. 148 148 00:05:48,150 --> 00:05:53,150 The foreign address in this case is 192.168.2.192 149 149 00:05:53,310 --> 00:05:54,930 and it's going on port 80. 150 150 00:05:54,930 --> 00:05:58,050 And so this is essentially either a callout or a beacon 151 151 00:05:58,050 --> 00:06:00,810 or a connection to download maybe a second stage malware. 152 152 00:06:00,810 --> 00:06:02,400 We don't know exactly what it is yet 153 153 00:06:02,400 --> 00:06:05,640 but we do know that this machine, the .101 154 154 00:06:05,640 --> 00:06:09,210 has made a connection to this remote host over port 80. 155 155 00:06:09,210 --> 00:06:12,120 And so we can look at that further and then dig in deeper 156 156 00:06:12,120 --> 00:06:14,940 and keep doing our threat hunting as we dive in. 157 157 00:06:14,940 --> 00:06:16,920 So as you can see here in this brief example 158 158 00:06:16,920 --> 00:06:19,500 of using the Volatility framework, there is a lot 159 159 00:06:19,500 --> 00:06:21,540 of information you can get and it's just a matter 160 160 00:06:21,540 --> 00:06:23,430 of slicing and dicing that memory dump 161 161 00:06:23,430 --> 00:06:26,220 in different ways using different modules. 162 162 00:06:26,220 --> 00:06:28,800 First, we used the pslist to look at the processes. 163 163 00:06:28,800 --> 00:06:31,410 Second, we looked at the files, and third, 164 164 00:06:31,410 --> 00:06:32,880 we looked at net scan. 165 165 00:06:32,880 --> 00:06:34,890 Now, in addition to the Volatility framework, 166 166 00:06:34,890 --> 00:06:37,110 there is another open source tool out there 167 167 00:06:37,110 --> 00:06:38,340 known as Memoryze. 168 168 00:06:38,340 --> 00:06:40,860 It works a lot like the Volatility framework 169 169 00:06:40,860 --> 00:06:43,440 but it does have a little bit of a cleaner interface. 170 170 00:06:43,440 --> 00:06:46,140 Memoryze is a free memory forensic software tool 171 171 00:06:46,140 --> 00:06:49,230 by FireEye that helps incident responders find evil 172 172 00:06:49,230 --> 00:06:51,210 inside live memory. 173 173 00:06:51,210 --> 00:06:53,220 Now, for the exam, do you need to know 174 174 00:06:53,220 --> 00:06:56,310 how to use Volatility framework or Memoryze? 175 175 00:06:56,310 --> 00:06:57,510 Well, no. 176 176 00:06:57,510 --> 00:06:58,680 You should know what they do 177 177 00:06:58,680 --> 00:07:01,080 but you're not expected to actually perform the analysis 178 178 00:07:01,080 --> 00:07:02,880 like I did in this lesson. 179 179 00:07:02,880 --> 00:07:04,200 If you become an incident responder 180 180 00:07:04,200 --> 00:07:06,720 in the real world though, you will be doing threat hunting 181 181 00:07:06,720 --> 00:07:09,020 and these tools will become invaluable to you.