Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some analysis on it.
What are the different in-memory malware and what kind of methods do you recommend for each type of in-memory malware ?
You should proceed in two steps:
First: You need to have a look on MoonSols Windows Memory Toolkit Community Edition. It will allow You to dump memory to file for further analysis
Second: then You'll need Volatility Toolkit to analyze dump file and extract info, binaries, DLLs and more from there.
For great sample: of using Volatility - have a look on Andre DiMino's blog post about Cridex
I agree with Denis' answer, but for me, Step 0 is to start FlyPaper, from HBGary.
HBGary Flypaper is an invaluable tool in your fight against malware. Most malware is designed into two or three stage deployment. First, a dropper program will launch a second program, and then delete itself. The second program may take additional steps, such as injecting DLL's into other processes, loading a rootkit, etc. These steps are taken quickly, and it can be difficult for an analyst to capture all of the binaries used in the deployment. HBGary Flypaper solves this problem for the analyst.
HBGary Flypaper loads as a device driver and blocks all attempts to exit a process, end a thread, or delete memory. All components used by the malware will remain resident in the process list, and will remain present in physical memory. The entire execution chain is reported so you can follow each step. Then, once you dump physical memory for analysis, you have all the components 'frozen' in memory - nothing gets unloaded. All of the evidence is there for you.
As others have mentioned the first thing you should do is dump the memory with MoonSols. This will allow you to do memory analysis using Volatility later. When it comes to malware analysis I find IDA the most useful. In order for it be useful you will need a process dump and a way to rebuild the import table. If the malware can spread to other processes I would create a dummy process, dump it then rebuild the import table. If for example the malware injects into iexplore.exe, open up Ollydbg change the debugging options events to System Breakpoint, open up iexplore.exe, then search for memory of RWX (described here). Check the contents of the memory, if it contains your memory malware dump the process and then rebuild the import table. If you need to manually rebuild the import table you can use the following script. If the process does not spread you could attach to the process via a debugger.
Disclaimer: I am the author of those links.
Moonsols is a great option, but I've noticed that there is no longer an option to purchase it and it makes me wonder if support has been stopped.
In my opinion, the best way to get started is with win32dd, win64dd, or mdd. Another option that is more automated is DumpIt (created by the maker of Moonsols). I prefer mdd for most tasks, but I have not tested it on 64bit systems.
Depending on what you're looking for, I tend to use file carvers like Scalpel to pick out everything that is recognizable. Volatility is nice too, but personally I think learning how to recognize the file structures in a hex editor and carving them out will lead you to a better understanding of the dumped memory and what you're actually looking at.
EDIT:
The newest version of scalpel is available in Backtrack r3, I just pulled it from there. As with the others, I have older copies that I use and they work just fine. DumpIt is still available at the MoonSols site and works great for 32 or 64bit, give it a shot: moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream
