This document discusses investigating a case involving a botnet commander using a custom Android application. The investigation process involved acquiring a memory dump from the suspect's Android device using LIME and analyzing it using Volatility. Key findings included identifying running processes of interest, extracting communication suggesting the origin and author of the application, and retrieving a copy of the malicious application. Challenges included limitations in Volatility's support for Android memory forensics and not having enough time to fully analyze the memory dump and application to identify such things as the command and control server IP address and details about the bots.

1. Android Memory Forensics
Shailendra Sadh – sxs5554
4055-841 Advanced Computer Forensics

2. Agenda
• The Scenario
• Technologies Used
• Investigation Process
• Questions & Results
• Challenges & Future Work
• Tech Pros & Cons

3. The Scenario
• Suspect  Botnet Commander
• Custom Android Application to determine Bot
status
• Feds go knocking on the door.

4. Evidence Retrieved

5. Technologies used
• LIME – Linux Memory Extractor (formerly
DMD)
• Volatility 2.3 (Beta)
Open Source
Extremely Capable
Wide Range of support for Win & Linux (
Android )
• Autopsy
• Investigator’s Swiss knife - HEXEDITOR

6. Investigation Process
Seize
Acquire
Analyze
Report
• Warrant
• Internal Investigation
• Hard Disk
• Memory
• PCAP/Logs
• Evidence Hashing
• Forensic Analysis
• Present findings
• Expert Witness

7. Acquire  Droid RAM Dump - Revelations!!
• Acquisition
ADB  Android Debug Bridge
KO  No it not Knockout! Kernel Object loadable as kernel
module
Insmod  Insert module command to load module in
kernel land

8. Acquisition over TCP Stream
On Host
$ adb push evo-lime.ko /sdcard/evo-lime.ko
$ adb forward tcp:4444 tcp:4444
$ adb shell
$ su
On Phone
$ su
$ insmod /sdcard/evo-lime.ko “path=tcp:4444 format=lime”

9. Acquisition on SD card
On Host
$ adb push evo-lime.ko /sdcard/evo-lime.ko
$ adb shell
$ su
On Phone
$ su
$ insmod /sdcard/evo-lime.ko “path= /sdcard/mdump.lime format=lime”

10. Analysis
• Calculate MD5/SHA1 hash of acquired evidence
• Document the processes followed
• Record and document suspicious or notable findings
• Don’t Give up!

11. Droid RAM Analysis – Revelations!!
• Volatility – 2.3 (Beta)
Profile used --LinuxEvo4Gx86
Find available commands by running:
python vol.py --profile=LinuxEvo4Gx86 -f Evo4GRodeo.lime --
info |grep linux_
 Complete list available at:
https://code.google.com/p/volatility/wiki/LinuxCommandRefere
nce23#linux_volshell

12. Questions & Results

13. 1) When was LiME run, and what were the exact
parameters used?
Python vol.py --profile=LinuxEvo4Gx86 –f Evo4GRodeo.lime linux_psaux |grep lime

14. Android Process Tree

15. 2) What was the device’s IP address?
Python vol.py --profile=LinuxEvo4Gx86 –f Evo4GRodeo.lime linux_ifconfig

16. 3) What are the IP and MAC address of the
device’s gateway?
Python vol.py --profile=LinuxEvo4Gx86 –f Evo4GRodeo.lime linux_arp

17. 4) Find a list of running processes. Do any appear to
be of interest? List them, along with time of
execution.
PID UID Process
712 10018 Com.smithmicro.DM
751 10066 Com.pv.wmdrmservice
780 1000 Com.pv.wmdrmproxy
1860 10093 Com.l33t.seccncviewer
659 10047 Htcloggerd
662 10047 ghost

19. 5) Find any communication that would suggest
information about the origin of the application and its
author. Acquire a copy of the application, if possible.

20. Sanitized email extract - From HexEditor
<div class="gm-sender-name" style="color:#00681c">Joe Sylve</div>
<div class="gm-sender-email">joe.sylve<span>
</span>gmail.com</div>
:
<div class="gm-date">Aug 4</div>
<div class="gm-time">1:33am</div>
:
<td class="gm-recipient-title">To:</td>
<td class="gm-recipient-list">rodeo.wrangler.2012<span></span>gmail.com</td>
:
<div class="gm-body">..<div class="gm-message-content" style="zoom:1.5">Hey man..
Here&#39;s the app, it shouldn&#39;t leave any evidence on the phone, so feel free to
burn it any time. Now please... send my money! I really need another ride on the
mechanical whale...<div><br></div><div><a href="http://db.tt/9UECzowS" target="_blank">
http://db.tt/9UECzowS</a><font color=#888888>
:
<br>..<div><br></div><div>-Joe</div></font></div>
</div>

21. 5) Find any communication that would suggest
information about the origin of the application and its
author. Acquire a copy of the application, if possible.
• File retrieved and executed – seccncviewer.apk

22. Active Bot Connections

23. Challenges
Q 6) What is the IP address of the server that the
application is connecting to?
Most volatility network commands didn’t give out any
result
Uninteresting/no IPs found in hex dump (.lime & .apk files)
Extracted RouteCache files. (Just too much data)
Tried to emulate the bot connection – potentially different
IP addresses found
Not Enough time and lack of forensics skill!!!

24. Challenges - Cont
Q 7) Recover any information about the Bots.?
Found files
• BOTStatusActivity.java (extract ELF file from Lime)
• Com.l33t.seccncviewer.PullToRefreshListActivity
• botInfo.xml- ( figure out the xml struct)
Distributed by Joe Sylve :P
Spread out to multiple location and it tries to connect
every few milliseconds (267 probably)
Not Enough time and lack of forensics & Reverse
Engineering skills!!!

25. Future Work
• Case Perspective
Search and extract ELF (exe linkable format) files to
possibly find source code of the application
 Find more traces for BotInfo.xml
Learn Assembly!!!
Encryption used. (Maybe RSA!)

26. Tech – Pros & Cons
• Volatility 2.3 Beta
Brilliant memory analysis toolkit
Nascent stages for android forensics
• Focus on Windows Forensics! (Well Obviously :P)
• Customization of open source tools (Time & Skills!)

27. Thank you!!