Skip to main content

Memory dump analysis of Donny's System


This post solves the mystery of Donny's System  and outlines how to utilize memory forensics methodology to uncover artifacts from memory dumps

Tools: Volatility, Yara  & Windows Powershell


Six-step investigative methodology by SANS

  1. Identify rogue processes 
  2. Analyze process DLLs and handles  
  3. Review network artifacts 
  4. Look for evidence of code injection 
  5. Check for signs of rootkit
  6. Dump suspicious processes and drivers 
Run volatility imageinfo plugin  to identify profile 
PS C:\volatility> .\vol.exe -f .\unknown.vmem imageinfo

Run Volatility pslist plugin to see active running processes
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 pslist
Just to remind that all process creation and termination timings are specified in UTC. Ensure to change them to system timezone while correlating the events with other sources of evidence
game.exe clearly looks suspicious as it ran and exit in a short span of time. The most interesting part was explorer.exe spawned number of system commands.
Observe the creation time of processes followed by game.exe process
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 pslist | Select-String '1716'

Run Volatility dlllist plugin to identify the path from where it was executed  and dlls loaded by game.exe,  but the process was terminated and unable to read PEB
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 dlllist -p 1044
Run Volatility connections plugin to identify any active connections
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 connections
Suspicious game.exe PID 1044 established an active connection with remote host on port 4444. A quick search for port 4444 on google indicates that port 4444 deals with metasploit framework   ( Assuming the analyst doesn't have knowledge of metasploit)

It's been understood that meterpreter reverse shell uses port 4444 as by default for any incoming connections
To Confirm that game.exe process is a backdoor (created by msfvenom)which established connection back to the attacker's host, Run Volatility malfind Plugin to identify any sort of code injection.
Meterpreter uses Reflective DLL injection mechanism to inject DLL into legitimate victim process.
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 malfind
The legitimate explorer.exe PID 1716 process was injected  with an executable DLL, observe the PAGE_ EXECUTE_READWRITE permissions, VADS represents that there is no memory mapped file before at address space 0x3600000

Run Volatility malfind again to dump all memory injected regions.
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 malfind -D .\malfind\
Upload those malfind dumped files to Virustotal for a quick analysis
It's clear that meterpreter stage was injected into explorer.exe and any command performed through meterpreter session was disguised as legitimate explorer.exe process
Meanwhile running  a quick yara rule identified the memory dump as an opened meterpreter reverse shell to attacker's system
Run strings.exe on malfind dumped files to find meterpreter metsrv.dll stage 1 and meterpreter extension dlls stdapi and priv
Look for meterpreter extension DLL priv 

 Recommended to read about stage and stageless meterpreter payloads

Run Volatility userassist to find the executable which were run by Donny last time
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 userassist | Select-String 'game.exe' -Context 1,3

Note: Process creation time is in UTC 


Popular posts from this blog

Memory Analysis of WannaCry Ransomware

This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC) 

WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale.

You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a controlled environme…

Malicious document analysis Part - 1

A basic and quick approach to analyse phishing documents to identify indicators of maliciousness. FYI this post doesn't cover complete & in depth analysis of malicious documents

Didier Stevens Suite sudo pip install oletools Yara - A pattern matching Swiss knife Analysis  All document samples are pulled from Hybrid Analysis - a free malware analysis service for the community that detects and analyzes unknown threats using a unique Hybrid Analysis technology. 
Hash 1: e07c84f98332b07ae40a22f15c32cbf794586e26576a7539def667881e15beae

Download above mentioned sample and check the integrity
Check the file properties using native Linux file command which gives quick idea about sample
Download Didier Stevens Suite and check for yara rules.
Run various rules against the sample document to identify any sort of maliciousness
The below rule can identify an executable file embedded in OLE objects
 Run above yara rule against the downloaded document
Observe the below mald…