Instructor: Memory forensics. 2 2
Nowadays, a lot of malware is using fileless techniques. 3 3
This way they store most of their code 4 4
or all of their code inside of memory. 5 5
Now, fileless malware will execute 6 6
from memory without saving anything to the file system. 7 7
And if it does save anything to the file system, 8 8
it's very careful to delete that as quickly as possible. 9 9
This makes it harder to detect 10 10
and harder for you to do your threat hunting. 11 11
Now, fileless detection techniques are techniques 12 12
that require the analysis of the contents 13 13
of system memory and of the process behavior rather 14 14
than relying on scanning of the file system. 15 15
Because fileless malware doesn't leave a lot 16 16
of traces on the hard drive or the file system, 17 17
you have to use special techniques to find it. 18 18
In this lesson, that's what we're going to focus on. 19 19
Now, a memory analysis technique is going 20 20
to allow you to reverse engineer the code used 21 21
by the process. 22 22
It'll allow you to discover how the process interacts 23 23
with the file system, also known as the handles, 24 24
and how it interacts with the registry. 25 25
Also, it'll help you to examine network connections, 26 26
retrieve cryptographic keys 27 27
and extract strings from within the memory. 28 28
This can all be done 29 29
once you have a memory dump, and we've talked 30 30
about how to collect memory dumps all the way back 31 31
in our forensic lessons. 32 32
Now, what kind of strings could you extract 33 33
from one of these memory dumps? 34 34
Well, let's say I was making 35 35
a communications call over Skype. 36 36
As I place that call, 37 37
Skype is going to write a specific string to memory 38 38
for every message sent or every call that goes out. 39 39
So I could use that to be able to search that string 40 40
inside a memory to identify 41 41
where in that memory they have been storing those messages. 42 42
So if I was a bad actor, for instance, 43 43
and I was communicating with somebody else over Skype, 44 44
and you've collected an image of my computer, you could go 45 45
into that and figure out exactly what I was saying 46 46
and to who I was saying it to because that string would act 47 47
as a pointer to the rest of the message. 48 48
Now, if you think back to our forensic lessons, we talked 49 49
about FTK and EnCase. 50 50
Both of these are commercial and proprietary software 51 51
that are dedicated forensic suites 52 52
for collecting information. 53 53
Now, one of the functions they have 54 54
is a memory analysis module. 55 55
It allows you to collect the memory and then analyze it 56 56
for all of these different types of artifacts. 57 57
In addition to using FTK or EnCase, 58 58
you can also use several different open source 59 59
and freeware options that are out there. 60 60
For instance, we have one known as the volatility framework. 61 61
This is an open source memory forensics tool 62 62
that has many different modules 63 63
for analyzing specific elements 64 64
of memory, such as web browser module that looks 65 65
at your history, command prompt history modules that'll look 66 66
at your command prompt history, and many others. 67 67
When you load up the volatility framework, 68 68
it looks something like this. 69 69
This is a text-based command line interface tool. 70 70
It allows you to take a memory dump of a system and then go 71 71
through it for particular information. 72 72
In this example, I have a dump that was taken 73 73
from a Windows 7 virtual machine, and I'm going 74 74
into it using the volatility framework 75 75
and searching that dump for any processes that were running 76 76
at the time this memory dump was conducted. 77 77
Now notice here on the screen, 78 78
I'm using pslist, which is that module 79 79
to do that at the end of the first line. 80 80
This then loads up, searches the memory, 81 81
shows me the offset location, 82 82
the name of the processes that we're running, the PID, 83 83
the parent PID, the threads, the handles, the sessions 84 84
and then the information of when it was started. 85 85
If you see here, I've highlighted one called salter.exe. 86 86
As I've looked through this list, 87 87
that is the one process that looks suspicious to me. 88 88
So I would look at that process, 89 89
I would find out the information on that process 90 90
and then I would start doing some research to figure out 91 91
what is suspicious about it 92 92
and whether or not it's actually malicious in nature. 93 93
The reason I highlighted that process 94 94
is because that process is one that I don't recognize 95 95
as a legitimate process. 96 96
All of the other ones I see there are things 97 97
that I recognize as legitimate processes 98 98
as part of my baseline. 99 99
So now that I've identified that process, 100 100
I could take it one step further. 101 101
Notice the PID here, 1808 and I have 134 handles, 102 102
which means different files or parts of files 103 103
that are being touched by that process. 104 104
So as I dig a little deeper, 105 105
I'm going to want to identify what types 106 106
of files were being touched by salter.exe. 107 107
Now, as I do that, I'm going to use Volatility framework again, 108 108
going into that memory dump, and I'm going to look 109 109
at a specific PID and look at the handles for it 110 110
and the different object types, 111 111
which in this case are files. 112 112
So as I do that, 113 113
I'm seeing again all the ones for PID 1808. 114 114
Now, I've highlighted one that looks interesting to me 115 115
and I've actually blown that up here on the screen for you. 116 116
Notice that it has the name 9781642741292.pdf. 117 117
Now, why does that look interesting? 118 118
Well, as I look at the screen here, 119 119
everything else there looks pretty mundane 120 120
but this file has a really weird name. 121 121
How many people actually name their files 122 122
with a random string of digits like this? 123 123
Most people don't 124 124
but the people who do tend to have malicious intent 125 125
and so they're trying to send this information out 126 126
and they send out lots of different random files. 127 127
And this number, if there was malware embedded in it 128 128
might be the unique ID that beacons back and says, hey, 129 129
this machine is now known by that serial number 130 130
because that shield number will identify this part 131 131
of my botnet. 132 132
So let's take it one step further. 133 133
We've identified a process we thought was suspicious. 134 134
We've identified a handle to a file 135 135
that we think is suspicious, so what else might we look at? 136 136
Well, as we run Volatility again against this memory dump, 137 137
the next thing I'm going to look at is network activity. 138 138
So I'll use the net scan module. 139 139
Here you'll see I've highlighted one all the way 140 140
at the bottom of the screen. 141 141
Again, this is the same process, 1808 being run 142 142
by the salter.exe file. 143 143
You'll see we have a connection between two IP addresses. 144 144
And so now we can look at those two IP addresses. 145 145
We have the first IP, which is our local address, 146 146
10.1.0.101 coming from port 1095. 147 147
This is connecting to the foreign address. 148 148
The foreign address in this case is 192.168.2.192 149 149
and it's going on port 80. 150 150
And so this is essentially either a callout or a beacon 151 151
or a connection to download maybe a second stage malware. 152 152
We don't know exactly what it is yet 153 153
but we do know that this machine, the .101 154 154
has made a connection to this remote host over port 80. 155 155
And so we can look at that further and then dig in deeper 156 156
and keep doing our threat hunting as we dive in. 157 157
So as you can see here in this brief example 158 158
of using the Volatility framework, there is a lot 159 159
of information you can get and it's just a matter 160 160
of slicing and dicing that memory dump 161 161
in different ways using different modules. 162 162
First, we used the pslist to look at the processes. 163 163
Second, we looked at the files, and third, 164 164
we looked at net scan. 165 165
Now, in addition to the Volatility framework, 166 166
there is another open source tool out there 167 167
known as Memoryze. 168 168
It works a lot like the Volatility framework 169 169
but it does have a little bit of a cleaner interface. 170 170
Memoryze is a free memory forensic software tool 171 171
by FireEye that helps incident responders find evil 172 172
inside live memory. 173 173
Now, for the exam, do you need to know 174 174
how to use Volatility framework or Memoryze? 175 175
Well, no. 176 176
You should know what they do 177 177
but you're not expected to actually perform the analysis 178 178
like I did in this lesson. 179 179
If you become an incident responder 180 180
in the real world though, you will be doing threat hunting 181 181
and these tools will become invaluable to you.