Introduction

In this lab, you are tasked with investigating a memory dump captured from a compromised system to identify the source of unusual network activity. This activity involves communication with multiple suspicious IP addresses, suggesting potential malware infection. By analyzing the memory dump, you will uncover the processes involved in executing malicious payloads, identify the files responsible, and trace their behavior to external entities.

This walkthrough will guide you through using tools like Volatility3, a powerful memory forensics framework, to extract critical artifacts and analyze the compromised system. You will learn how to interpret process hierarchies, dump suspicious files, and correlate findings with threat intelligence platforms to understand the malware's behavior and its impact. The investigation also highlights techniques for detecting malicious network communications and leveraging cryptographic hashes to identify malware across systems.

Through this process, you will gain hands-on experience in reconstructing the sequence of events leading to the execution of malware, while reinforcing your skills in endpoint forensics and threat analysis.

Analysis

Q1 Our first step is identifying the initial point of contact the malware made with an external server. Can you specify the first IP address the malware attempted to communicate with?

To begin analyzing the suspicious activity, we need to focus on the memory dump provided. Using Volatility3, an advanced memory forensics framework, we can extract critical insights about the system's state during the incident. First, we use the windows.pstree plugin to reconstruct the process tree of the memory image. This is achieved by running the command

python3 vol.py -f ../../Artifacts/memory.dmp windows.pstree > pstree.txt

The resulting process tree output provides a hierarchical view of processes, showcasing parent-child relationships and timestamps. While rev…