In this lecture we will learn about more with the list command or plugin so the responders can also
check that loaded files associated with the process.
This allows the analysis to determine whether a suspect process accessed these files when it was executed.
So, for example, if a responder would like to examine the DLL file associated with one of the suspect
processes, for example process ID
11640, then you will need to run the command volatility.
Uh, 60.
Yeah, 64.
And.
Okay, we'll take the 64 the first.
As you remember, we inserted the file here.
In this case, it's file in here.
And then we're going to select a profile.
As you remember, our profile was the win Windows XP Service Pack two.
Uh, and x 86 here.
And then we're going to use the P2P parameter to specify the process in this memory file, that running
process.
In this case, it's 1640.
And as you can see in Moderna's platform, yeah, there is no such an option with P volatility.
H here.
Oops.
Yeah.
Uh.
Help.
And as you can see here, we're going to have some commands named.
Peer help debug plugins.
Here.
Verbose here, key here.
And yeah, now we're going to use the.
The ll list and then p process.
1640.
Okay.
1640.
As you can see, there is a node process named 1614.
So now we're going to use the list to determine which process is.
Yeah, you need to pass list plugin.
Here.
Oh, why so.
Image info with with it.
Enter at the wrong image info operating system file profile.
Yeah it's.
Searching.
And as you can see, Windows XP Service Pack 286.
Okay.
It's same, actually.
Profile.
Okay.
As you can see here, we've listed our processes.
Run.
And we can find the associated executable or DLL files from it.
So, for example, if I want to get the.
The loss of here, for example.
Let's let's it's actually a reader Excel file is quite suspicious.
So that's why I'm going to choose the process to.
Yeah.
As you can see here, the process IDs is up here and we're going to choose the 228.
Okay.
As you can see here, we got these data files associated with the running process.
Here.
So this output indicates that there are several files that are loaded as part of the reader SL dot X
process.
Later in this lecture, the DLL files will be acquired for further examination here.
And we also have the handles plug in here.
So the handles plugin actually I will, I will copy this.
So for further examination and I will also share it with you so you can look at it.
Yeah.
This is the, let's mention it here that this is the output of.
This is the output of this command.
Okay.
So.
Now we're gonna use the handles.
Pro Handles plugin.
So let's.
Actually the close this and yeah.
So the handles plugin here allows analysis to view what type of handles are open in existing existing
process.
So these handles are references to resources that are managed by the operating system.
So this data provides to responder an understanding of the specific blocks of memory and application
or processes using.
So this includes a wide variety of information, including registry keys and files associated with that
process too.
And yeah, so to identify the open handles for process IDs, for example, our process ID in this case
228, and now we're going to use this process ID Okay.
First use this process here.
As you can see here, the, uh.
But in this case we are just going to delete the data list plugin because we are not going to use it
anymore.
And here, 228 and.
The process here and use the handles.
Log in.
And as you can see, we got these output here.
So the command here is produce the port here, the thread file and directory and other information here.
So as this output indicates, the suspect process has several open handle processes, threads and register
keys.
So this may become important data points moving forward and give some indication of the behavior of
reader that is executable here.
So I want to mention another plugin here named Aldea Modules.
So a common practice with malware codes is something to hide the activities of the malware.
So one technique is to attempt to hide the DLL files associated with the malicious code so this can
be accomplished by unlocking the suspect from the process environment block named PEB.
So while this may provide some obfuscation on the server, there is a stealth trace evidence of the
existence contained within the virtual address descriptor.
So the VAD is a mechanism that identifies a DLL file based address and full path.
So the all the LDR modules.
Plug in and compare the list of the processes and determines if they are in the PEB named process environment.
BLOCK And so now let's run the all the modules plugin here.
And as you can see here, this is the output we get when using this command.
So a review of this, the outputs reveals some entry.
Uh, in the reader reader dot exe file named here.
Actually it's.
Yeah.
Decrease the size a little bit.
And here, as you can see here from this output, this reader is that process does appear to have an
issue associated with the file.
So this indicator, the indicator that is the process is suspect is the false here in in it is false,
as you can see here.
But there is nothing false, another nothing and another code here.
So as you can see, this is the suspicious this is suspicious that the other file is tampered here.
So this indicates that the executable, the executable has delinked the files and the the reader that
Excel file warrants further investigation.
And we're going to copy this, so I'm going to share it with you.
And.
Yeah, place it under this command.
Okay, The command is shown here.
So now I'm going to I want to mention the.
X we process.
So P is equal.
And as you remember in previous lectures, we did some examples of it, but it's just an demonstration
of how this command run and how to use it.
But in this lecture, like as you can see here, we are like investigating the P reader Excel that Excel
file.
And this is a suspicious file as we as we seen.
So we're going to investigate and analyze this executable file.
Actually, it's run as you as you remember, this is this virtual memory file.
This is another storage file.
This is actually the memory file here that captured from the random access memory.
So.
And here.
We're going to use the.
Ps6.
V file ps6.
V more plugin here.
So this is another good plugin that aids in discovering heating processes in the ps6 with here.
So this plugin compares the active processes indicated with an active process heat with any other possible
sources with the memory image.
So to run this plugin you just you can just.
Delete the process file here because we are not using on this process.
We're going to scan all of this and use the Ps6 view.
And I'm going to copy this also.
So share it with you on lecture attachment.
Here.
So this is the opposite.
I actually copied the wrong here.
Actually, they are the same, but I accidentally.
Yeah, yeah, yeah.
No, they.
They are not the same here.
But I have copied.
They are the same.
Was the same.
So.
The output is like that.
This is this is the output we got from the plugin.
So it falls within the column indicates that the process is not found in that area.
And yeah, this is as you can see, there is a false here.
So and this allows this plugin allows us to actually Yeah yeah.
This this plugin is allows us to leave that list and determine whether there is legitimate reason that
the process may not be there or if it is an indicative of an attempt to hide process.
So as you remember in previous lectures the.
Previous.
In previous code here, we used the reader slot and we suspected that because when we scan it, it does
actually come out pretty suspicious.
Output here and.
Yeah, let's, let's Yeah.
This was the second command we used.
And as you can see here.
There is the suspicious file here.
And while and by suspicious I meant that the dll file is delinked from this.
But is that an.
Like.
As you can see here.
It wasn't an accident.
It wasn't a system that did it.
It just an executable malware code that did hit the hide, the hidden, the DLL file in somewhere in
the system.
So.
This is actually a pretty suspicious here.
And we also hear this was the last quote here.
In next lecture, we're going to go in more depth about the volatility network and volatility network
analysis.
And as you remember in previous lecture, we did some network plugins.
We used some networking plugins in volatility.
But in next lecture we specially will analyze the networking plugin with this, the suspicious executable
or running file here.
So I'm waiting you in the next lecture.