Analyze a memory dump using Volatility to identify a malicious process, extract network IOCs, file hash, and compilation timestamp, correlating with external threat intelligence.
Our intrusion detection system has alerted us to suspicious behavior on a workstation, pointing to a likely malware intrusion. A memory dump of this system has been taken for analysis. Your task is to analyze this dump, trace the malware’s actions, and report key findings.
Easy - Endpoint Forensics | Completion Achievement
We are provided with a memory.dmp file. To interact with it, we will be using the Volatility framework.
- To download Volatility 2, visit the archived GitHub repo, download the Linux standalone zip file and extract the executable. You can delete everything else and keep the executable.
- To download Volatility 3, simply use
gitin the terminal to clone the repo:git clone https://github.com/volatilityfoundation/volatility3.git. Use thevol.pyfile to interact with Volatility.
- What is the name of the process responsible for the suspicious activity?
Let's look at the list of process running inside the memory dump with windows.pstree. We can filter the processes shown using grep. A sign of a suspicious executable is its path location. Many executables do not run inside user-owned directories. Let's try filtering our list of event with | grep Users
The first process looks quite standard, but the second process looks suspicious... Let's keep looking deeper into it.
- What is the exact path of the executable for the malicious process?
The full path for the executable is shown in the windows.pstree output.
- Identifying network connections is crucial for understanding the malware's communication strategy. What IP address did the malware attempt to connect to?
We can filter the output of the windows.netstat module to show only information relevant to the PID 4628 using grep.
$ ./volatility3/vol.py -f memory.dmp windows.netstat | grep 4628
0xca82b8bc2b30.0TCPv4 192.168.19.133an49682fin58.64.204.181 5202 SYN_SENT 4628 ChromeSetup.ex 2024-02-01 19:48:51.000000 UTCEven though there's an issue with the whitespace, the foreign address is visible here.
- To determine the specific geographical origin of the attack, Which city is associated with the IP address the malware communicated with?
We can use online IP geolocation tools for this task. Using an online tool, I found the city associated with the IP being contacted by the malware:
- Hashes serve as unique identifiers for files, assisting in the detection of similar threats across different machines. What is the SHA1 hash of the malware executable?
First, we need to find the address where the malware file is stored. We can use windows.filescan to find this address:
$ ./volatility3/vol.py -f memory.dmp windows.filescan | grep Chrome
0xca82b85307f0.0\Users\alex\Downloads\ChromeSetup.exe
0xca82b85325a0 \Users\alex\Downloads\ChromeSetup.exe
0xca82b85341c0 \Users\alex\Downloads\ChromeSetup.exeThen, we can use the windows.filedump module to dump these files from memory.
$ ./volatility3/vol.py -f memory.dmp -o chrome-dump windows.dumpfiles --virtaddr 0xca82b85307f0
Volatility 3 Framework 2.28.1
Progress: 100.00 PDB scanning finished
Cache FileObject FileName Result
DataSectionObject 0xca82b85307f0 ChromeSetup.exe Error dumping file
ImageSectionObject 0xca82b85307f0 ChromeSetup.exe file.0xca82b85307f0.0xca82b7e06c80.ImageSectionObject.ChromeSetup.exe.imgSince the DataSectionObject dump failed, the executable must be on the .img file. Let's use the sha1sum utility to calculate the SHA1 hash:
$ sha1sum chrome-dump/file.0xca82b85307f0.0xca82b7e06c80.ImageSectionObject.ChromeSetup.exe.img
280c9d36039f9432433893dee6126d72b9112ad2 chrome-dump/file.0xca82b85307f0.0xca82b7e06c80.ImageSectionObject.ChromeSetup.exe.img- Examining the malware's development timeline can provide insights into its deployment. What is the compilation timestamp for the malware?
We can use the previously calculated SHA1 hash to find more information about the malware in VirusTotal. Inside the report, we can navigate to Details > Portable Executable Info > Header and retrieve the Compilation Timestamp:
- Identifying the domains associated with this malware is crucial for blocking future malicious communications and detecting any ongoing interactions with those domains within our network. Can you provide the domain connected to the malware?
Inside the same VirusTotal report, we can navigate to the Relations tab and immediately notice that the malware is contacting a known malicious domain:
