Hunting malware via memory forensics

0Document Title
Hunting Malware via Memory Forensics
Sriram Krishnan
02-May-2015

1Document Title
About the Session
 The session is aimed at introducing the concept of memory forensics
 This presentation will provide insight into malware behavior and variety of stealth
technique used by malware authors
 We will focus on concepts and technique relating to Windows

2Document Title
Agenda
 Setting the Context
 Malware Potential
 Need for Memory Forensics
 Memory Forensics
 Demo

3Document Title
Setting the Context

4Document Title
Malware Attacks Making Headings

5Document Title
Malware Potential

6Document Title
Types of Malware
MalwareVirus
Worms
Trojan
Rootkit
Backdoor
Spyware
Scareware

7Document Title
Malware Behaviour
Backdoor
Botnet
RAT
Reverse-Shell
Credentials
Stealers
Hash Dumping
Key Logging
GINA Interception
Persistence
Mechanism
Windows Registry
DLL Load-Order
Hijacking
Trojanized System
Binaries

8Document Title
Impact
 Impact of malware attack is a worst-case-scenario for organizations
Command & Control
Data Theft
Consume network/system resource
Further exploitation of
network

9Document Title
Need for Memory Forensics

10Document Title
Limitation in Traditional Computer Forensics
 Traditional views of digital investigation focused on obtaining evidence without changing its state.
 Victim machine is powered off, the storage media is duplicated then analysed in controlled
environment.
 Evidence acquisition process focused on minimizing the distortion of the file system.
 Less or little focus provided to other critical sources such as RAM, device memory.
 Selective preservation of data may impact the reliability of derived evidences.
 Thus traditional digital forensics allows malware authors to exploit the limitation in the
investigation procedure.

11Document Title
Covert Operation
 As computing has become sophisticated, malware, has also evolved
 Malware authors have developed various techniques to blend malware into the normal system
functions to avoid detection
 Malware analysts need to understand code constructs and coding patterns to detect malware that
are covertly launched
 Malware covert loading techniques can be broadly classified as:
 Launchers
 Process Injections
 Hook Injections

12Document Title
Covert Operation
Launcher
 Often contain malware that are designed to load in the victim machine
 Goal of launcher is to set-up things so that malicious behaviour is concealed
from the user
 Common technique is loading malware stored in resource section (Windows
PE file format). For example icons, images, menus etc.
 Launcher uses resource manipulation API such as FindResource,
LoadResource, SizeofResource
DOS Header
PE Signature
COFF Header
Optional
Header
Section Table
Mappable
Section
IMAGE_DIRECTORY_ENTRY_RESOURCE : Location of the resource directory

13Document Title
Covert Operation
Process Injection
 Injecting malicious code into a running process in the victim’s machine
 Technique to conceal the malware behaviour from the user and malware protection software
 Process Injection can be classified into:
 DLL Injection
 Direct Injection
 Process Replacement

14Document Title
Example - DLL Injection
Hardware RAM
Launcher
Malware
Malicious DLL
Iexplore.exe
Launcher
Malware
Injection
Iexplore.exe
Malicious DLL
 Launcher obtains a handle to victim’s process
CreateToolhelp32Snapshot(), Process32First(), and
Process32Next()
 Retrieves the PID of target process OpenProcess()
 Creates memory space for malicious library string name
and writes the string into the allocated memory space
VirtualAllocEx(), WriteProcessMemory()
 Executes new thread for remote process
CreateRemoteThread()
 Malicious DLL will be loaded LoadLibrary()

15Document Title
Covert Operation
Hook Injection
 Achieve process injection via Windows Hook
mechanism
 Allows to run the malicious code whenever
particular message is intercepted by an application
 Technique used in malicious keylogger application
to record keystrokes of the victim
 SetWindowsHookEx() Win32 API is used to load
the malicious code as hook procedure into the hook
chain
 When appropriate event is received, the malicious
code will be executed by the target process
USER USER
Windows OS Windows OS
Threads
Application/
Process
Application/
Process
Event Event
Message
Malicious DLL
Message
Threads

16Document Title
Hence….Memory Forensics
 Provides unprecedented visibility into the runtime state of the system
 Enables the full reconstruction of the events and ability to understand the behaviour of the
malware
 Critical data only exist in the memory – hence enables the investigators to collect evidences that
cannot be found elsewhere in the system.
 Memory Forensics is certainly the most productive and challenging realm of digital forensics.

17Document Title
Memory Forensics

18Document Title
Overview
 Analysis of the data captured from the volatile memory of a victim machine
 Physical memory data (RAM) as well as Page File data are captured for the study
Memory
Acquisition
• Capture contents of RAM
• Extract data from Hibernation File / Page File
Establish
Context
• Set-up the environment
• Dump suspicious processes and drivers
• Identify memory offsets to be analyzed
Analysis
• Analyze the data (heuristic or another technique)
• Indicator of Compromise analysis

20Document Title
Stuxnet Malware
 Stuxnet is computer worm that targeted industrial control systems such as gas pipeline, power
plants etc.
 Stuxnet exploited zero-day vulnerabilities in Microsoft Windows operating systems – basically
targeted systems using Windows operating system
 According to various report the worm affected nuclear power plants of certain countries

21Document Title
Wrapping Up
 Any final questions?
 Thanks for listening
Sriram Krishnan
Sriramk.21@gmail.com
+91-98409-57647

Hunting malware via memory forensics

More Related Content

What's hot

Similar to Hunting malware via memory forensics

Recently uploaded

Hunting malware via memory forensics