ShulkwiSEC Volatility Memory Forensics (RAM Analysis)
When to Use
- Following a critical incident where a machine is isolated, and a RAM dump (
.dmp,.raw,.vmem) is acquired before shutdown. - When hunting for Fileless Malware, Advanced Persistent Threats (APTs), or In-Memory execution (e.g., Cobalt Strike Beacons, Meterpreter).
- To recover decrypted passwords, registry keys, or historical command lines that were stored in RAM and never written to disk.
- When analyzing systems suspected of harboring Kernel-level Rootkits.
Prerequisites
- Memory dump or forensic image acquired from the compromised system
- Volatility 2/3 framework installed with appropriate OS profiles
- Chain of custody documentation maintained for legal admissibility
- Understanding of the target OS memory management and process architecture
Workflow
Phase 1: Environment Setup and Profile Identification
# Concept: Volatility 3 (Python 3) doesn't require "profiles" like Volatility 2,
# it automatically downloads symbol tables based on the OS kernel structure.
# Ensure Volatility 3 is updated
python3 vol.py -h
# 1. Identify the Operating System and Architecture of the Memory Dump
python3 vol.py -f suspicious_machine.raw windows.info
# Output will confirm if it is Windows 10, Windows 7, Linux, etc., and list
# crucial kernel pointers (KDBG, PsActiveProcessHead) needed for deep analysis.
Phase 2: Process Enumeration & Anomaly Hunting
# Concept: We need to see what programs were running. Malware often
# pretends to be legitimate Windows processes (e.g., svchost.exe) or hides entirely.
# 1. List all active processes (equivalent to Task Manager)
python3 vol.py -f suspicious_machine.raw windows.pslist
# 2. Find hidden processes (Rootkits unlinking from the active process list)
# Compare pslist (standard linked list) vs psscan (carving memory for process headers).
# If a process appears in psscan but NOT pslist -> IT IS HIDDEN / MALICIOUS.
python3 vol.py -f suspicious_machine.raw windows.psscan
# 3. View the Process Tree (Parent/Child relationships)
# Anomalies: `cmd.exe` spawning from `explorer.exe` is normal.
# `cmd.exe` spawning from `services.exe` or `spoolsv.exe` is highly suspicious.
# `svchost.exe` spawning from anything other than `services.exe` is malicious.
python3 vol.py -f suspicious_machine.raw windows.pstree
# 4. View detailed command-line arguments passed to running processes
# e.g., finding `powershell -enc JABzAD0ATgBlAHcALQBPAGIAagBl...`
python3 vol.py -f suspicious_machine.raw windows.cmdline
Phase 3: Malicious Injection Detection
# Concept: Advanced malware injects itself into legitimate processes (Process Hollowing,
# DLL Injection) to hide from defensive scrutiny.
# 1. Malfind (Malware Find)
# Scans memory for injected code (specifically, memory segments containing executable code
# that are NOT backed by a physical file on disk).
# Critical for finding Cobalt Strike beacons and shellcode!
python3 vol.py -f suspicious_machine.raw windows.malfind
# Warning: Malfind produces false positives (JIT compilers like .NET or browsers).
# Review the hex dump output: Look for "MZ" headers (4D 5A) starting the injected segment.
# 2. Dump the injected suspicious memory segment for reverse engineering
python3 vol.py -f suspicious_machine.raw windows.malfind --dump --pid 4452
# Resulting file (process.4452.0xXYZ.dmp) can be loaded into IDA Pro or Ghidra.
Phase 4: Network Artifact Recovery
# Concept: Current and terminated network connections can reveal Command and Control (C2) IPs.
# 1. Retrieve Active and Terminated TCP/UDP Connections
python3 vol.py -f suspicious_machine.raw windows.netstat
# Compare the suspicious process PIDs found in Phase 2/3 with their active network connections.
# Example: If `notepad.exe` (PID 1234) has an established connection to a Russian IP on port 443, it is definitively compromised.
# 2. Check the historical DNS cache memory (Requires custom plugin or Vol2)
# Often reveals domains the machine queried recently before the dump occurred.
Phase 5: Credential Extraction (Mimikatz in Memory)
# Concept: Passwords and NTLM hashes are temporarily stored in the LSASS.exe process memory.
# 1. Dump cached passwords from the registry (SAM and SYSTEM hives in RAM)
python3 vol.py -f suspicious_machine.raw windows.hashdump
# 2. Dump cleartext passwords and Kerberos tickets directly from LSASS (mimikatz wrapper)
python3 vol.py -f suspicious_machine.raw windows.lsadump.lsa
Phase 6: Deep Forensic Artifacts
# 1. Extract the full Master File Table (MFT) from RAM to rebuild the filesystem
python3 vol.py -f suspicious_machine.raw windows.mftscan
# 2. View loaded DLLs for a suspected process (look for malicious unbacked DLLs)
python3 vol.py -f suspicious_machine.raw windows.dlllist --pid 4452
# 3. YARA Scanning
# Scan the entire memory dump for specific malware signatures
python3 vol.py -f suspicious_machine.raw windows.vadyarascan --yara-file lokibot.yara
🔵 Blue Team Detection & Defense
- Memory analysis is primarily a post-incident tool. However, defenders rely on Endpoint Detection and Response (EDR) platforms that perform miniature, real-time "malfind" checks (monitoring for
VirtualAlloccalls withPAGE_EXECUTE_READWRITEpermissions). - Credential Guard: Windows 10/11 Enterprise feature utilizing Virtualization-Based Security (VBS) to isolate the LSASS process, completely defeating Phase 5 extraction techniques.
Key Concepts
| Concept | Description |
|---|---|
| RAM / Memory Dump | A complete, byte-for-byte snapshot of the physical RAM of a computer at a given instant |
| Process Hollowing | Malware technique where a legitimate process is started, paused, emptied, and replaced with malicious code |
| VAD | Virtual Address Descriptor; memory structures Windows uses to track memory allocated to processes |
| Fileless Malware | Malware that operates entirely in memory (RAM) and leaves no permanent executable file on the hard drive |
Output Format
Incident Response Memory Forensics Report
=========================================
Asset ID: WIN-ACCTG-04
Date Acquired: 2024-X-X
Analysis Engine: Volatility 3
Executive Summary:
Analysis of the provided memory dump confirms the host was compromised via Fileless Malware (suspected Cobalt Strike Beacon).
Key Findings:
1. Anomalous Processes: Process `spoolsv.exe` (PID 3342) is running without `services.exe` as its parent, violating core Windows architecture. Parent process was identified as `powershell.exe` which terminated prior to the dump.
2. Code Injection: The `windows.malfind` plugin identified a hidden, executable memory page (`PAGE_EXECUTE_READWRITE`) at address `0x60000` inside PID 3342. The segment begins with an `MZ` header (Portable Executable) not backed by disk.
3. Network Traffic: `windows.netstat` confirms PID 3342 held an established HTTPS connection to `192.168.x.x:443`.
4. Credential Theft: Unrelated, `windows.hashdump` successfully extracted NTLM hashes for 5 standard users indicating lateral movement risk.
Forensic Action:
The injected shellcode at address `0x60000` was dumped to file (`pid.3342.dmp`) and submitted to the reverse engineering team for C2 configuration extraction.
🛡️ Remediation & Mitigation Strategy
- Input Validation: Sanitize and strictly type-check all inputs.
- Least Privilege: Constrain component execution bounds.
📚 Shared Resources
For cross-cutting methodology applicable to all vulnerability classes, see:
_shared/references/elite-chaining-strategy.md— Exploit chaining methodology and high-payout chain patterns_shared/references/elite-report-writing.md— HackerOne-optimized report writing, CWE quick reference_shared/references/real-world-bounties.md— Verified disclosed bounties by vulnerability class
References
- Volatility Foundation: Volatility 3 Documentation
- SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics