14

I have an infected MS-Windows 7 machine with an in-memory malware, shutting it down will probably make it disappear and I would like to get the malware in a more convenient format to perform some analysis on it.

What are the different in-memory malware and what kind of methods do you recommend for each type of in-memory malware ?

20

You should proceed in two steps:

First: You need to have a look on MoonSols Windows Memory Toolkit Community Edition. It will allow You to dump memory to file for further analysis

Second: then You'll need Volatility Toolkit to analyze dump file and extract info, binaries, DLLs and more from there.

For great sample: of using Volatility - have a look on Andre DiMino's blog post about Cridex

| improve this answer | |
  • I managed to use the volatility toolkit and extracted the binary malware. Thanks a lot for the pointers. – perror Apr 15 '13 at 8:46
9

I agree with Denis' answer, but for me, Step 0 is to start FlyPaper, from HBGary.

HBGary Flypaper is an invaluable tool in your fight against malware. Most malware is designed into two or three stage deployment. First, a dropper program will launch a second program, and then delete itself. The second program may take additional steps, such as injecting DLL's into other processes, loading a rootkit, etc. These steps are taken quickly, and it can be difficult for an analyst to capture all of the binaries used in the deployment. HBGary Flypaper solves this problem for the analyst.

HBGary Flypaper loads as a device driver and blocks all attempts to exit a process, end a thread, or delete memory. All components used by the malware will remain resident in the process list, and will remain present in physical memory. The entire execution chain is reported so you can follow each step. Then, once you dump physical memory for analysis, you have all the components 'frozen' in memory - nothing gets unloaded. All of the evidence is there for you.

| improve this answer | |
  • Also good one, thx! – Denis Laskov Apr 14 '13 at 13:07
  • Does FlyPaper exist anymore? I can't seem to find a download link. – alexanderh Jul 17 '13 at 3:00
  • @alexanderh Yes, but looks like now you have to register on their website to get it: hbgary.com/free_tools – Mick Jul 17 '13 at 13:04
5

As others have mentioned the first thing you should do is dump the memory with MoonSols. This will allow you to do memory analysis using Volatility later. When it comes to malware analysis I find IDA the most useful. In order for it be useful you will need a process dump and a way to rebuild the import table. If the malware can spread to other processes I would create a dummy process, dump it then rebuild the import table. If for example the malware injects into iexplore.exe, open up Ollydbg change the debugging options events to System Breakpoint, open up iexplore.exe, then search for memory of RWX (described here). Check the contents of the memory, if it contains your memory malware dump the process and then rebuild the import table. If you need to manually rebuild the import table you can use the following script. If the process does not spread you could attach to the process via a debugger.

Disclaimer: I am the author of those links.

| improve this answer | |
4

MoonSols and Volatility are one option.

Another set of options are Redline and Memoryze, both of which are from Mandiant.

An added bonus with Memoryze is that memory acquisition is included.

| improve this answer | |
3

Moonsols is a great option, but I've noticed that there is no longer an option to purchase it and it makes me wonder if support has been stopped.

In my opinion, the best way to get started is with win32dd, win64dd, or mdd. Another option that is more automated is DumpIt (created by the maker of Moonsols). I prefer mdd for most tasks, but I have not tested it on 64bit systems.

Depending on what you're looking for, I tend to use file carvers like Scalpel to pick out everything that is recognizable. Volatility is nice too, but personally I think learning how to recognize the file structures in a hex editor and carving them out will lead you to a better understanding of the dumped memory and what you're actually looking at.

EDIT:

The newest version of scalpel is available in Backtrack r3, I just pulled it from there. As with the others, I have older copies that I use and they work just fine. DumpIt is still available at the MoonSols site and works great for 32 or 64bit, give it a shot: moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream

| improve this answer | |
  • most of the tools you have mentioned are no longer available at thier official sites. Scaple for instance gives a 404, win32dd etc points to newer Moonsools tools. – cb88 Apr 17 '13 at 16:32
  • Also, mdd is not a good choice; it's no longer actively developed (as far as I know) and the most recent version has outstanding bugs that result in corrupt images. – Brendan Dolan-Gavitt Apr 17 '13 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.