Investigating system compromises through memory analysis
When analyzing malware and exploits (or troubleshooting issues), you’ll find
it in memory—even if it can’t be found on disk. Memory will give you a look
at the exact state of a device at a specific time; this is why memory analysis,
or memory forensics, is important to DFIR (Digital Forensics and Incident
Response). Memory capture and analysis is an important step of DFIR
before rebooting a machine or device because implants may not be
persistent, as mentioned recently by Sen. Angus King.
In paragraph 5.2.1.2 they profess, “On most systems, it is not possible to
avoid alteration of RAM when running a utility that attempts to make a copy
of RAM. Instead, the goal is to perform the copying with as small a footprint
as possible to minimize the disruption of RAM”. As the NIST has explained
in this document, the need to gather memory, and be minimally invasive in
obtaining it, is such an important part of DFIR that it cannot be overlooked.
Despite being a critical step, it’s often left out due to poor user experience,
the required operating system internals knowledge, and reliance on manual
operations because of the lack of automation.
Comae has been developed to help in memory analysis—learn more about
how you can use it in incident response, threat hunting, and compromise
assessment.
Acquisition
Firstly, when you access the Comae platform, you’ll have the option to
download DumpIt which is our memory acquisition tool. One of the
specificities of DumpIt is that it will create a full memory crash dump file
(.dmp) which is interoperable with Microsoft WinDbg as it is a native
Microsoft Windows format.
A lot of legacy memory acquisition tools will do a 1:1 memory copy of the
physical address space and fill reserved memory spaces by other devices
with null bytes resulting in unnecessary memory usage that has nothing to
do with the RAM. On top of that, another sacrifice done by legacy raw
memory images is that fact that while they require a driver to access the
memory of a live system, they do not leverage this to collect a lot of the
information required for analysis which later results in carving memory for
key structures required for analysis. When using an existing format such as
Microsoft crash dump files, or ELF core dumps – modern acquisition tools
leverage structured data required for analysis just like debuggers have been
doing for the past decades.
Another option to generate memory dumps as supported by Comae memory
analysis platform is to leverage process minidumps which can be generated
either by utilities like Microsoft Process Explorer, ProcDump, or even some
of the EDR agents like Microsoft ATPs which let you target which suspicious
process you want to target for an acquisition. There are also other scenarios
where process dumps can
be leveraged, for instance in the case of serverless web jobs on Microsoft
Azure App Services (w3wp.exe).
Compact acquisition utilities are very practical as they are easy to deploy by
leveraging pre-installed agents to deploy and run DumpIt.
Cloud Security. Where pre-installed agents are already present in
virtual machines such as the AWS Systems Manager Agent (SSM
Agent) that runs on Amazon instances and equivalent.
Enterprise Security. Where EDR/XDR agents are already present on
the machines and where security response features such as
CarbonBlack LiveResponse, CrowdStrike Real Time Response, and
SentinelOne Remote Script Orchestration (RSO), etc.
Memory dumps are very useful for compromise assessments, but also for
retro-hunting – especially in scenarios where you historically collect and
keep full system images of your critical assets in order to have the option to
go back to them whenever you are aware of a new IOC or new threat actor
to cover gaps that EDRs and XDRs were not able to cover at the time.
Assuming breach is a mindset but being able to verify breach at a later
point in time is the equivalent of having a time machine for compromise
assessment. As we know, EDRs are best effort technology in terms of active
protection – it is very important for enterprises to have complementary
scenarios for when protection fails.
Analysis & Hunting
Having data is great, but the main question for any analyst or security
researcher is often, how can I browse and query this data efficiently? As we
move forward with a smooth user experience that allows us to get a bird’s
eye view perspective on a system, we wanted to focus on having the ability
to ask questions to a memory image and to have repeatable operations to
selectively and swiftly be able to categorize images while investigating a
case.
Memory analysis is a powerful technique for malware detection and
investigation. It involves examining the contents of a computer's volatile
memory, such as RAM, to identify and analyze malicious code, processes,
and artifacts. Memory analysis can reveal hidden or obfuscated malware, as
well as valuable information about its behavior, configuration, and
persistence. In this article, you will learn some of the best ways to use
memory analysis for malware detection, such as:
Choosing the right tools
There are many tools available for memory analysis, but not all of them are
suitable for every situation. You should choose a tool that matches your
operating system, memory format, and analysis objectives. Some of the
most popular and reliable tools are Volatility, Rekall, Redline, and Mandiant
Memoryze. These tools can help you extract and parse various data from
memory dumps, such as processes, modules, network connections, registry
keys, strings, and malware signatures.
Selecting appropriate memory analysis tools is paramount for effective
malware detection. Tools like Volatility Framework, Rekall, and WinDbg are
widely used for memory forensics. Consider the specific features each tool
offers, such as volatility plugins, platform compatibility, and community
support. Tailor your tool selection to the type of memory analysis required,
whether it's for Windows, Linux, or other operating systems, and ensure
they align with the goals of your malware detection strategy.
In addition to considering the compatibility of tools with your operating
system, memory format, and analysis goals, it's crucial to factor in the
specific requirements of your investigation. For instance, if you are dealing
with a complex incident involving advanced persistent threats, Mandiant
Memoryze might be the go-to choice due to its robust capabilities in
identifying sophisticated malware signatures. On the other hand, if your
focus is on rapid analysis and real-time response, Redline could be the
preferred option with its emphasis on live memory analysis. Choosing the
right tool is not just about technical specifications but aligning the tool's
strengths with the unique demands of your memory analysis scenario.
Acquiring the memory image
Before you can analyze the memory, you need to acquire a memory image
from the target system. This can be done in different ways, depending on
your access and permissions. You can use a live acquisition tool, such as
FTK Imager or DumpIt, to capture the memory from a running system.
Alternatively, you can use a physical acquisition tool, such as WinPMEM or
LiME, to access the memory from a powered-off or crashed system. You
should always verify the integrity of the memory image by calculating its
hash value.
In considering the acquisition of memory images, it's crucial to weigh the
implications of the chosen method on both access and permissions. Live
acquisition tools like FTK Imager offer the advantage of capturing memory
from a running system, while physical tools like WinPMEM provide access
to powered-off or crashed systems. However, one should underscore the
significance of validating memory image integrity through hash value
calculations, ensuring the reliability of the acquired data.
Acquiring a reliable memory image is the foundation of memory analysis.
It’s essential to use appropriate tools to capture this image accurately,
ensuring the integrity of data for analysis.
Identifying suspicious processes
One of the first steps in memory analysis is to identify any suspicious or
malicious processes running on the system. You can use tools like Volatility
or Rekall to list all the processes and their attributes, such as PID, name,
path, parent, and command line. You should look for any processes that
have unusual or mismatched names, paths, or parent processes, as well as
any processes that are hidden, injected, or hooked by malware. You can also
use tools like Yara or ClamAV to scan the processes for known malware
signatures.
In memory analysis, spotting suspicious processes is a primary step.
Identifying processes with unusual behaviors or characteristics often leads
to uncovering malicious activities.
Identifying suspicious processes is a critical step in memory analysis for
effective malware detection. Utilizing tools like Volatility or Rekall is
essential, as they provide comprehensive lists of processes along with key
attributes - PID, name, path, parent process, and command line details. The
focus should be on spotting anomalies: processes with mismatched names,
unusual paths, or irregular parent processes. Additionally, attention should
be paid to processes that exhibit signs of being hidden, injected, or
manipulated by malware. To further strengthen this analysis, employing
signature-based tools like Yara or ClamAV is advisable. These tools scan for
known malware signatures.
Analyzing process memory
Once you have identified the suspicious processes, you can analyze their
memory to find more evidence of malware activity. You can use tools like
Volatility or Rekall to dump the process memory and examine its contents.
You should look for any indicators of compromise, such as malicious code,
configuration files, encryption keys, network addresses, or command and
control commands. You can also use tools like Strings or Binwalk to extract
any readable or embedded data from the process memory.
To enhance malware detection through memory analysis, consider
integrating behavioral analysis techniques. It involves monitoring memory
for malware-related behavior patterns, such as unusual system calls or
network connections. Utilizing ML algorithms can automate anomaly
detection, significantly improving your security system's efficiency and
accuracy. Regularly update your analysis tools and techniques to keep pace
with evolving malware strategies. Implementing a layered security
approach, combining memory analysis with other security measures like
firewalls and IDS, creates a more robust defense against sophisticated
cyber threats.
Analyzing the memory of identified suspicious processes can reveal deeper
insights into malware activities. This involves looking for specific indicators
of compromise within the process memory.
Investigating memory artifacts
Another way to use memory analysis for malware detection is to investigate
the various artifacts that malware leaves behind in the memory. These
artifacts can include registry keys, files, drivers, services, network
connections, event logs, and browser history. You can use tools like
Volatility or Rekall to enumerate and analyze these artifacts and look for
any anomalies or traces of malware activity. You can also use tools like
Timeline or Mactime to correlate the artifacts with the timeline of the
infection.
Investigating various memory artifacts is also crucial. These artifacts can
offer valuable clues about malware presence and activities, helping to build
a comprehensive understanding of the threat.
In my experience, investigating memory artifacts is a pivotal aspect of using
memory analysis for malware detection. Malware often leaves behind a trail
in the form of registry keys, files, drivers, services, network connections,
event logs, and browser history. Tools like Volatility or Rekall are
indispensable in this process, enabling the enumeration and detailed
analysis of these artifacts. The key is to identify anomalies or indications of
malware activity within these elements. Additionally, temporal correlation
of these artifacts is crucial. Tools like Timeline or Mactime are highly
effective in aligning these artifacts with the infection timeline, providing a
clearer picture of the attack sequence and impact.
Comparing memory snapshots
A final way to use memory analysis for malware detection is to compare the
memory snapshots of the same system taken at different points in time. This
can help you identify any changes or modifications that malware has made
to the memory, such as creating, deleting, or altering processes, modules,
or artifacts. You can use tools like VolDiff or Memtriage to compare the
memory snapshots and highlight the differences. You can also use tools like
Diff or Diffy to compare the individual files or data extracted from the
memory snapshots.
Memory analysis is a valuable skill for cybersecurity professionals who want
to detect and investigate malware. By using the right tools and techniques,
you can uncover the secrets and evidence of malware hidden in the
memory. You can also use memory analysis to complement other methods of
malware analysis, such as static or dynamic analysis, to gain a deeper
understanding of the malware's capabilities and intentions.
