Memory Forensics
Guides and Theory
Dump full process memory
(procdump requires systinternals procdump.exe)
1
procdump -ma [processID]
Copied!
Powershell Memory Capture
Where the Microsoft Storage namespace is available (known not to be available in Win7), PowerShell can be used to invoke a native live memory dump.
1
$ss = Get-CimInstance -ClassName MSFT_StorageSubSystem -Namespace Root\Microsoft\Windows\Storage;
2
Invoke-CimMethod -InputObject $ss -MethodName "GetDiagnosticInfo" -Arguments @{DestinationPath="[LOCATION]\dmp"; IncludeLiveDump=$true};
Copied!
Live Triage of Memory
Shout-out to Matt Graeber, Jared Atkinson and Joe Desimone for the awesome work that has gone into these scripts. Note: Not all tested, appears to work with a standard Meterpreter payload, and by default with Cobalt Strike.
Locate Possible Shellcode within process via Injected Thread
1
Import-Module .\Get-InjectedThread.ps1
2
Get-InjectedThread
Copied!
Obtain Possible Shellcode within process as Hex
1
(Get-InjectedThread|Select -exp Bytes|ForEach-Object ToString X2) -join ''
2
(Get-InjectedThread|? {$_.ThreadId -match '{PID}'}|Select -exp Bytes|ForEach-Object ToString X2) -join ''
Copied!
Obtain Possible Shellcode within process as Hex
1
(Get-InjectedThread|Select -exp Bytes|ForEach-Object ToString X2) -join '\x'
2
(Get-InjectedThread|? {$_.ThreadId -match '{PID}'}|Select -exp Bytes|ForEach-Object ToString X2) -join '\x'
Copied!
Basic Memory Analysis via PowerShellArsenal
1
import-module .\PowerShellArsenal.psd1
2
Find-ProcessPEs
3
Get-ProcessStrings
4
Get-ProcessMemoryInfo -ProcessID {PID}
5
Get-VirtualMemoryInfo
Copied!
Locate Possible Shellcode Address Space
1
Get-ProcessMemoryInfo {PID} | ? {$_.AllocationProtect -eq "PAGE_EXECUTE_READWRITE"}
Copied!
Find Meterpreter in Process Memory:
1
Find-ProcessPEs {PID} | ?{$_.ModuleName -eq "metsrv.dll" -OR $_.ModuleName -eq "ext_server_stdapi.dll" -OR $_.ModuleName -like "ext_server_*.dll"} | FL ProcessID,ModuleName,Imports;
2
$A=$(gps | Select -exp Id); foreach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq "metsrv.dll"} | FL ProcessID,ModuleName,Imports};
3
$A=$(gps | Select -exp Id); foreach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq "metsrv.dll" | FL ProcessID,ModuleName,Imports};
4
$A=$(gps | Select -exp Id); foreach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq "metsrv.dll" -OR $_.ModuleName -eq "ext_server_stdapi.dll" -OR $_.ModuleName -like "ext_server_*.dll"} | FL ProcessID,ModuleName,Imports};
Copied!
Find Cobalt Strike in Process Memory:
1
Find-ProcessPEs {PID} | ?{$_.ModuleName -eq "beacon.dll" -OR $_.ModuleName -eq "beacon x64.dll" -OR $_.ModuleName -eq "beacon.x64.dll"} | FL ProcessID,ModuleName,Imports;
2
$A=$(gps | Select -exp Id); foreach ($process in $A){Find-ProcessPEs $process | ?{$_.ModuleName -eq "beacon.dll"} | FL ProcessID,ModuleName,Imports};
Copied!
In memory files locked by OS
hiberfil.sys (RAM stored during machine hibernation)
- %SystemRoot%\hiberfil.sys
pagefile.sys (Virtual memory used by Windows)
- %SystemDrive%\pagefile.sys
swapfile.sys (Virtual memory used by Windows Store Apps)
- %SystemDrive%\swapfile.sys
Volatility
Other Tools
- Belkasoft Live RAM Capture Tool - Belkasoft Live RAM Capturer is a tiny free forensic tool that allows to reliably extract the entire contents of computer’s volatile memory—even if protected by an active anti-debugging or anti-dumping system.
- Redline - Redline®, FireEye's premier free endpoint security tool, provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis and the development of a threat assessment profile.
- Memoryze - Mandiant’s Memoryze™ is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images and on live systems can include the paging file in its analysis.
- MAGNET RAM Capture - MAGNET RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.
- Volexity Surge - Volexity’s Surge Collect offers flexible storage options and an intuitive interface that any responder can run to eliminate the issues associated with the corrupt data samples, crashed target computers, and ultimately, unusable data that commonly results from using other tools.
- LiveKD - Written by the Legendary Mark Russinovich, LiveKD allows you to run the Kd and Windbg Microsoft kernel debuggers, which are part of the Debugging Tools for Windows package, locally on a live system. Execute all the debugger commands that work on crash dump files to look deep inside the system.
- aeskeyfind - Illustrates automatic techniques for locating 128-bit and 256-bit AES keys in a captured memory image.
- rsakeyfind - rsakeyfind is a tool that locates BER-encoded RSA private keys in MEMORY-IMAGE. If a MODULUS-FILE is specified, it will locate private and public keys matching the hex-encoded modulus read from this file.
1
winpmem.exe -o test.aff4 -dd
2
winpmem.exe -o test.raw --format raw -dd
Copied!
Resources
- SANS Memory Forensics CheatSheet
Last modified 6mo ago
Copy link
Contents
Guides and Theory
Dump full process memory
Powershell Memory Capture
Live Triage of Memory
Locate Possible Shellcode within process via Injected Thread
Obtain Possible Shellcode within process as Hex
Obtain Possible Shellcode within process as Hex
Basic Memory Analysis via PowerShellArsenal
Locate Possible Shellcode Address Space
Find Meterpreter in Process Memory:
Find Cobalt Strike in Process Memory:
In memory files locked by OS
Volatility
Other Tools
Resources