Guest Blogger: Kokab Rasool

Memory forensics is becoming more essential in incident response and threat analysis as new threats and sophistication arise in the changing cybersecurity landscape. Memory forensics, as opposed to traditional approaches that rely on hard drive analysis, explores volatile memory to find evidence of malware infections and other criminal actions that leave fingerprints in a system’s RAM.

Memory forensics is used by investigators to extract useful data and evidence from hacked computers. Threat actors use a variety of strategies to avoid detection, and malware without files is especially difficult to detect. This approach allows malicious code to be executed directly in memory rather than being written on the disk. Memory forensics is highly useful in these scenarios.

Memory forensics is the process of examining the contents of a computer’s memory to uncover potential security threats or forensic evidence. This analysis is useful right after a security breach or as part of a thorough, proactive security evaluation.

Conventional digital forensics involves analysts gathering data from a computer’s hard drive, which may contain valuable artifacts such as logs, registry entries, and program data. However, many attacks and occurrences are intended to be transitory, leaving little to no record on the hard drive. Attackers may employ techniques such as file less malware or in-memory injection to avoid detection by typical antivirus software or endpoint detection and response (EDR) solutions.
Memory forensics is a method of analyzing a system’s current state, allowing researchers to detect malicious processes and network connections that may be lying in plain sight. Furthermore, memory forensics can provide information about an attacker’s tactics, methods, and procedures (TTPs), allowing defenders to better understand their opponent and possibly avoid future attacks.

Popular Tools for Manual Memory Forensics 

There are several memory forensics tools available, many of which are open source. Let me now discuss some of the manual analysis possibilities. (We’ll look at one more tool for automated memory analysis at the end of this blog.)

Volatility Framework

With a set of tools for extracting digital artifacts from memory samples, the Volatility Framework is one of the most widely used frameworks for memory forensics. Its features can be expanded by a multitude of community plugins, and it supports a wide range of file formats. Additionally, Volatility offers a plugin for Intezer that makes memory dump analysis quick and easy.

Additionally, Volatility facilitates the examination of Unix device memory dumps, and the forensics industry has created a large number of plugins.

Volatility had a drawback in that, for the tool to function, a “profile” matching the operating system of the device it was captured from had to be set. But Volaitlity3 has now fixed this, and creating a profile is no longer necessary, making the tool even simpler to use.

Rekall

Rekall and Volatility are both open-source command-line tools; which one you choose to use is a matter of taste.

Redline

It is a free memory analysis tool that is entirely GUI-driven, one drawback of Redline is that it is limited to Windows device analysis; in contrast to Volatility and Rekall.
Memory analysis can be made much simpler and more accessible by filtering on particular operations, as the graphic below illustrates.

YARA

Although it is primarily recognized for its proficiency in signature-based malware identification, YARA is also a vital tool in memory forensics. YARA makes it simple for forensic investigators to find and analyze malware that lives only in RAM. Because of its adaptability and simplicity of use, YARA is a widely used tool for quickly and accurately identifying harmful objects in volatile memory dumps.

WinPmem

WinPmem is an open-source memory acquisition tool that was originally included in the Rekall Framework and is used to dump a machine’s volatile memory. To support thorough forensic investigation and incident response, analysts can use WinPmem to obtain a snapshot of the system’s memory state, including active processes, open networks, and loaded kernel modules.

Memoryze

Mandiant offers Memoryze as a free tool for gathering and analyzing data. It offers built-in analysis features that are comparable to some of Volatility’s plugins, and it can capture memory images.

GRR

Google maintains GRR, an open-source incident response system with a focus on remote live forensics. The way it operates is that an administrator can query the live system by installing an agent on the target systems. GRR employed YARA for detection in addition to the physical memory analysis features from the Rekall Forensics Framework.

inVtero.net

A high-speed (Gbps) forensics, memory integrity, and assurance platform is inVtero.net. incorporates both defensive and offensive memory functions. Identify and retrieve programs and hypervisors, including hierarchical ones, from memory dumps by utilizing virtual machine observation methodologies that are independent of architecture.

KeeFarce

It makes it possible to retrieve password database information for KeePass 2.x from memory. The plain text data is poured into a CSV file located in %AppData% and includes usernames, passwords, notes, and URLs.

MemProcFS

MemProcFS is a simple and free practical approach to see files in a virtual file system instead of real memory.
Simple simplistic memory analysis that only requires a few simple clicks and no complex commandline inputs! Use files in a mounted virtual file system or an advanced application library to access memory content and artifacts for use in your own applications!
Examine memory dump files, live memory from virtual computers or PCILeech FPGA hardware devices in read-write mode, and live memory via DumpIt or WinPMEM!

Even greater latency low bandwidth connections can be used to connect to a remote LeechAgent memory acquisition agent over a protected connection, enabling remote live memory incident response! Examine Virtual Machines using VMware, LiveCloudKd, or MemProcFS!

All of your preferred memory analysis tools, like hex editors, PowerShell and Python scripts, WinDbg, disassemblers, and debuggers, will function flawlessly with MemProcFS just by reading and writing files!