Hey Guys welcome to memory analysis with volatility in the previous video we introduce the volatility
framework this video.
We're going to take a look at how to use the program and it's plug ins to analyze the sample memory
image acquired in the last video which was memory acquisition.
To begin we can verify our Windows memory image and have more info about it with the image info plugin
we execute volatility specifying the f option with the name of the memory image and the name of the
Plug-In image info.
The image in Bill plugin displays info about the image including the OS type and version as you could
see the output confirms that it's a Windows 7 64 bit image so we can use the relative profile when 7
Sep 1 x 64 we don't obviously use all the available plugins for the sake of brevity but we'll only show
most relevant ones.
First thing we'd like to do is enumerate the active processes that were running on the target when we
acquired the memory image.
To accomplish this we can use the list plugin.
Now we specify the profile to use with the image with the profile option that we paste the name of the
profile.
Then the f option with the name of the image and the list plug in the output shows info like the name
of the process process id parent id and the start time.
The output can also be redirected to a file used in the output file option.
Also hidden or terminated processes can be enumerated with the scanned plugin.
The DL list plugin displays all the DL L's referenced by all the processes.
We can narrow the search specifying the ID option volatility dash dash profile equals Win 7 Sep 1 x
64 dash f Win 7 mem DL elist dash dash P ID 24 28 we specified the ID of the win PM tool used to image
the memory.
This outputs all the DL relative to the specific processes to display the kernel modules and drivers.
We use the modules plugin if we want to display also the hidden or residual modules.
There's a mod scan plugin the pricky plugin allows us to see the value of cached registry keys.
We have to also specify capital K option for the name of the registry key the output displays the subcase
and its values.
In this case it's only one the NetScan plugin enumerates the network connections on the target.
For example in the output we can observe the TCAP connection initiated by the netcat process in order
to transfer the memory image from the target to the forensic workstation.
If the target is Windows XP or 2003 we must use connection's instead of NetScan.
Here's also a plugin that displays the IP cache or history.
Finally we scan the image for of rules that could reveal malware running on the target Jaar is a tool
to identify and classify malware based is a tool to identify and classify malware based on rules that
include sets of signatures.
These rules can be downloaded from the Jaar repository at HTP colon slash slash get how dotcom slash
Yerra slash rules.
They're divided into various categories.
The plug in to use volatility is your iscan.
We must specify the path of the Jaar rules file to use the scan option.
For example if you want to scan the image for signatures of eks Zeus malware we must specify the corresponding
Jaar rule file.
In this case no signatures of the malware are found on the memory image.
We can also scan only a specific process with the ID option or the kernel memory with the kernel option.
For more info on how to use plug ins to extract and examine several kinds of artifacts from a memory
image a very useful reference is the volatility Chee-Chee which can be downloaded from the volatility
wiki page.
H s colon slash slash get hubcap slash volatility foundation slash volatility slash wiki.
Great job in this section we covered some of the most relevant volatility plug ins to analyze a Windows
7 memory image in the next section we're going to introduce network forensics and cover the capturing
and analysis of network data traffic.