Lab 18-19:

Memory Dump Tool (MoonSols Windows

Memory Toolkit)
Memory Analysis Tool (Volatility
Framework) I

Because teaching teaches

teachers to teach
 Memory Forensics
2

 Memory forensics refers to finding and extracting

forensic artifacts from a computer’s physical memory
(RAM). It contains critical information about the
runtime state of the system.
 By capturing an entire copy of RAM and analyzing it
on a separate computer, it is possible to reconstruct
the state of the original system:
 Applications were running.
 Network connections were active, and
 Many other artifacts.

2
 MoonSols
3

 MoonSols Windows Memory Toolkit supports

memory window OS.
 The attractive features:
 hashing with MD5, SHA-1, and SHA-256.
 Transmit memory dumps across the Network.
 map memory in three different ways.
 convert full memory dumps to Microsoft crash dumps
 convert hibernation files into memory dumps.
 support for scripting, dumping memory from a greater number
of OS versions, converting from an x64 architecture.

3
 Using MoonSols/win64dd
4

• Download MoonSols on
https://www.heise.de/download/product/
moonsols-windows-memory-toolkit-
81902/download/danke?id=81902-1

4
 Using MoonSols/win64dd
5

win64dd shows
details about the
computer’s
memory
configuration

5
 Using MoonSols/win64dd
6

win64dd shows
details about the
computer’s
memory
configuration

6
 Using MoonSols/dumpIT
7

Create dump file to

capture memory
win64dd -d /f
c:\memory.dmp

7
 Volatility
8

• Using volatility to examine the memory

file’s contents for malicious artifacts from
dump file.
• Download on
http://www.volatilityfoundation.org/relea
ses

8
 Volatility
9

• Using volatility to examine the memory

file’s contents for malicious artifacts from
dump file.
• Download on
http://www.volatilityfoundation.org/relea
ses
• Download dump memory on
http://www.jonrajewski.com/data/Malwa
re/stuxnet.vmem.zip

9
 Volatility
10

• To start, the dlldump plugin will be used

to extract the main application executable
and all* loaded DLLs inside of each**
process

10
Detection with ClamScan
11

11
 Advantages to this approach
12

 Speed: ClamAV can take anywhere from 1 minute

to 10 minutes to scan all files extracted from
memory samples that we regularly encounter.
 Scalability: Since the entire triage process
described in the writeup can be scripted and will
almost always be finished in less than 15 minutes,
this approach to detecting known malware is
highly scalable.

12
 Advantages to this approach
13

 Memory-Only Malware & Injected Code:

Through the use of malfind, we are able to find
code injected into memory that may never exist on
disk and that may have been injected in ways that
traditional endpoint security tools would have
missed.
 No Need to Upload Samples: By running your
testing local, you bypass the need to upload
potential targeted malware to services such as
VirusTotal or to your anti-virus vendor.

13
 Q&A

14