Volatility Traces Walkthrough

Memory forensics is essential for uncovering malicious activities, analyzing threat vectors, and identifying indicators of compromise (IoCs). In this walkthrough, we’ll use Volatility, a powerful memory analysis tool, to analyze a memory dump (memory.dmp). This guide will focus on answering specific questions regarding malicious activities on a compromised system. Each step includes detailed instructions, an explanation of plugins, and how they help uncover the attack chain.

Question 1: Identifying the Suspicious Process that Spawned Malicious PowerShell Processes

To identify the suspicious parent process, we need to list all active processes and analyze their relationships.

Step 1: Listing Active Processes with pslist Plugin

The pslist plugin lists active processes based on process structures found in memory. This is our starting point for identifying any suspicious processes.

Partial Output:

6980    4596    powershell.exe     0xb882f10e9080     True     2024-05-02 06:57:59.000000
7656    4596    powershell.exe     0xb882f0db8080     True     2024-05-02 06:57:59.000000

From the output, we observe two PowerShell processes with the same Parent Process ID (PID) 4596. This suggests that a parent process with PID 4596 spawned these suspicious PowerShell instances.

Since the pslist output doesn’t show the PID 4596, we proceed with psscan to gather more data.

Step 2: Using psscan for Additional Process Information

The psscan plugin scans for processes in memory, not limited to active or terminated states, and can retrieve names not visible with pslist.

Output:

4596    3800    InvoiceCheckLi     0xb882f107e080     False     2024-05-02 06:57:42.000000

This output reveals a partial name InvoiceCheckLi. The kernel’s process tracking structure only st…