Volatility memory forensics

Volatility Memory Forensics (RAM Analysis)

When to Use

• Following a critical incident where a machine is isolated, and a RAM dump (.dmp, .raw, .vmem) is acquired before shutdown.
• When hunting for Fileless Malware, Advanced Persistent Threats (APTs), or In-Memory execution (e.g., Cobalt Strike Beacons, Meterpreter).
• To recover decrypted passwords, registry keys, or historical command lines that were stored in RAM and never written to disk.
• When analyzing systems suspected of harboring Kernel-level Rootkits.

Prerequisites

• Memory dump or forensic image acquired from the compromised system
• Volatility 2/3 framework installed with appropriate OS profiles
• Chain of custody documentation maintained for legal admissibility
• Understanding of the target OS memory management and process architecture

Workflow

Phase 1: Environment Setup and Profile Identification

# Concept: Volatility 3 (Python 3) doesn't require "profiles" like Volatility 2,
# it automatically downloads symbol tables based on the OS kernel structure.

# Ensure Volatility 3 is updated
python3 vol.py -h

# 1. Identify the Operating System and Architecture of the Memory Dump
python3 vol.py -f suspicious_machine.raw windows.info

# Output will confirm if it is Windows 10, Windows 7, Linux, etc., and list
# crucial kernel pointers (KDBG, PsActiveProcessHead) needed for deep analysis.

Phase 2: Process Enumeration & Anomaly Hunting

# Concept: We need to see what programs were running. Malware often
# pretends to be legitimate Windows processes (e.g., svchost.exe) or hides entirely.

# 1. List all active processes (equivalent to Task Manager)
python3 vol.py -f suspicious_machine.raw windows.pslist

# 2. Find hidden processes (Rootkits unlinking from the active process list)
# Compare pslist (standard linked list) vs psscan (carving memory for process headers).
# If a process appears in psscan but NOT pslist -> IT IS HIDDEN / MALICIOUS.
python3 vol.py -f suspicious_machine.raw windows.psscan

# 3. View the Process Tree (Parent/Child relationships)
# Anomalies: `cmd.exe` spawning from `explorer.exe` is normal.
# `cmd.exe` spawning from `services.exe` or `spoolsv.exe` is highly suspicious.
# `svchost.exe` spawning from anything other than `services.exe` is malicious.
python3 vol.py -f suspicious_machine.raw windows.pstree

# 4. View detailed command-line arguments passed to running processes
# e.g., finding `powershell -enc JABzAD0ATgBlAHcALQBPAGIAagBl...`
python3 vol.py -f suspicious_machine.raw windows.cmdline

Phase 3: Malicious Injection Detection

# Concept: Advanced malware injects itself into legitimate processes (Process Hollowing, 
# DLL Injection) to hide from defensive scrutiny.

# 1. Malfind (Malware Find)
# Scans memory for injected code (specifically, memory segments containing executable code 
# that are NOT backed by a physical file on disk). 
# Critical for finding Cobalt Strike beacons and shellcode!
python3 vol.py -f suspicious_machine.raw windows.malfind

# Warning: Malfind produces false positives (JIT compilers like .NET or browsers).
# Review the hex dump output: Look for "MZ" headers (4D 5A) starting the injected segment.

# 2. Dump the injected suspicious memory segment for reverse engineering
python3 vol.py -f suspicious_machine.raw windows.malfind --dump --pid 4452
# Resulting file (process.4452.0xXYZ.dmp) can be loaded into IDA Pro or Ghidra.

Phase 4: Network Artifact Recovery

# Concept: Current and terminated network connections can reveal Command and Control (C2) IPs.

# 1. Retrieve Active and Terminated TCP/UDP Connections
python3 vol.py -f suspicious_machine.raw windows.netstat

# Compare the suspicious process PIDs found in Phase 2/3 with their active network connections.
# Example: If `notepad.exe` (PID 1234) has an established connection to a Russian IP on port 443, it is definitively compromised.

# 2. Check the historical DNS cache memory (Requires custom plugin or Vol2)
# Often reveals domains the machine queried recently before the dump occurred.

Phase 5: Credential Extraction (Mimikatz in Memory)

# Concept: Passwords and NTLM hashes are temporarily stored in the LSASS.exe process memory.

# 1. Dump cached passwords from the registry (SAM and SYSTEM hives in RAM)
python3 vol.py -f suspicious_machine.raw windows.hashdump

# 2. Dump cleartext passwords and Kerberos tickets directly from LSASS (mimikatz wrapper)
python3 vol.py -f suspicious_machine.raw windows.lsadump.lsa

Phase 6: Deep Forensic Artifacts

# 1. Extract the full Master File Table (MFT) from RAM to rebuild the filesystem
python3 vol.py -f suspicious_machine.raw windows.mftscan

# 2. View loaded DLLs for a suspected process (look for malicious unbacked DLLs)
python3 vol.py -f suspicious_machine.raw windows.dlllist --pid 4452

# 3. YARA Scanning
# Scan the entire memory dump for specific malware signatures
python3 vol.py -f suspicious_machine.raw windows.vadyarascan --yara-file lokibot.yara

🔵 Blue Team Detection & Defense

• Memory analysis is primarily a post-incident tool. However, defenders rely on Endpoint Detection and Response (EDR) platforms that perform miniature, real-time "malfind" checks (monitoring for VirtualAlloc calls with PAGE_EXECUTE_READWRITE permissions).
• Credential Guard: Windows 10/11 Enterprise feature utilizing Virtualization-Based Security (VBS) to isolate the LSASS process, completely defeating Phase 5 extraction techniques.

Key Concepts

Concept	Description
RAM / Memory Dump	A complete, byte-for-byte snapshot of the physical RAM of a computer at a given instant
Process Hollowing	Malware technique where a legitimate process is started, paused, emptied, and replaced with malicious code
VAD	Virtual Address Descriptor; memory structures Windows uses to track memory allocated to processes
Fileless Malware	Malware that operates entirely in memory (RAM) and leaves no permanent executable file on the hard drive

Output Format

Incident Response Memory Forensics Report
=========================================
Asset ID: WIN-ACCTG-04
Date Acquired: 2024-X-X
Analysis Engine: Volatility 3

Executive Summary:
Analysis of the provided memory dump confirms the host was compromised via Fileless Malware (suspected Cobalt Strike Beacon).

Key Findings:
1. Anomalous Processes: Process `spoolsv.exe` (PID 3342) is running without `services.exe` as its parent, violating core Windows architecture. Parent process was identified as `powershell.exe` which terminated prior to the dump.
2. Code Injection: The `windows.malfind` plugin identified a hidden, executable memory page (`PAGE_EXECUTE_READWRITE`) at address `0x60000` inside PID 3342. The segment begins with an `MZ` header (Portable Executable) not backed by disk.
3. Network Traffic: `windows.netstat` confirms PID 3342 held an established HTTPS connection to `192.168.x.x:443`.
4. Credential Theft: Unrelated, `windows.hashdump` successfully extracted NTLM hashes for 5 standard users indicating lateral movement risk.

Forensic Action:
The injected shellcode at address `0x60000` was dumped to file (`pid.3342.dmp`) and submitted to the reverse engineering team for C2 configuration extraction.

🛡️ Remediation & Mitigation Strategy

• Input Validation: Sanitize and strictly type-check all inputs.
• Least Privilege: Constrain component execution bounds.

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• Volatility Foundation: Volatility 3 Documentation
• SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics