This document provides an overview of analyzing memory forensics using Volatility 2.4. It demonstrates running various Volatility plugins like pstree to print processes, connscan to scan for TCP connections, printkey to print registry keys and values, and malfind to find hidden code injections. The document analyzes a Zeus memory sample, identifying processes, connections, registry keys used by the malware, and injected code, showing how Volatility can be used to analyze malware behavior and artifacts in memory forensics.

1. {
Null
Humla Session 0.1
Memory forensics with
Volatility2.4

2.  Usage
 Vol.py –f image --profile=(imageinfo) –plugins
 -f parameter
 It is used to locate the source memory image
 Vol.py –f sality.vmem
 imageinfo
 To identify the memory image
 Vol.py –f sality.vmem imageinfo
 Vol.py –f sality.vmem –proflie=WinXPSP2x86
connscan
Steps in Analysing

3. pstree
 Prints the process list in tree structure.
Vol.py –f zeus.vmem –profile =WinXPSP2x8 6 pstree

4. Connscan
 Scans for tcp connections
Vol.py –f zeus.vmem –profile =WinXPSP2x8 6
connscan

5.  Lets run the pstree command again…..
Interesting connections ??

6. Printkey
 Print a registry key and its subkey and values
Vol.py –f zeus.vmem –profile =WinXPSP2x8 6
printkey –K “MicrosoftWindowsCurrentVersionRun”
Vol.py –f zeus.vmem –profile =WinXPSP2x8 6
printkey –K “MicrosoftWindowsNTCurrentVersion
Winlogon”

7. Malfind
 Find hidden or injected code/Dll
Vol.py –f zeus.vmem –profile =WinXPSP2x86 malfind
–dump-dir ~/code-injections

8. Vol.py –f zeus.vmem –profile =WinXPSP2x86
malfind -p 856 –dump-dir ~/code-injections
Too much data ??
Let’s narrow it down !!!

9. Vol.py –f zeus.vmem printkey –K
“ControlSet001ServicesSharedAccess
ParametersFirewallPolicyStandard
Profile”
This malware shutdowns firewall also …..

10. EOF….
QUESTIONS …..