--- name: memory-analysis description: Analyze Windows memory images on a SANS SIFT workstation with Volatility 3 and Memory Baseliner, covering process, network, registry, service, injection, module, file extraction, strings, timeline, and baseline-difference workflows while preserving forensic read-only handling. --- # Memory Analysis Use this skill when examining Windows memory captures on a SANS SIFT workstation. Treat the evidence image as read-only, record the image hash before analysis, keep generated output under the case analysis/export directories, and use UTC for timeline work. ## Environment Primary tools: - Volatility 3: `/opt/volatility3-2.20.0/vol.py` - Memory Baseliner: `/opt/memory-baseliner/baseline.py` Do not confuse `/usr/local/bin/vol.py` with the Volatility 3 path above. Volatility 3 may need Microsoft symbol data; use cached symbols or `--offline` when the workstation cannot reach the symbol source. A convenient session setup is: ```bash alias vol="/opt/volatility3-2.20.0/vol.py" mkdir -p ./analysis/memory ./exports/dumpfiles ./exports/malfind ./exports/memdump ``` Use elevated privileges only when a plugin or evidence location actually requires them. ## Core workflow ### 1. Identify the image and operating-system context ```bash file vol -f windows.info ``` If symbol loading hangs, retry with `--offline` and document the limitation. ### 2. Enumerate and correlate processes Run more than one process-enumeration method so hidden or terminated processes are not missed. ```bash vol -f windows.pslist > ./analysis/memory/pslist.txt vol -f windows.psscan > ./analysis/memory/psscan.txt vol -f windows.pstree > ./analysis/memory/pstree.txt vol -f windows.cmdline > ./analysis/memory/cmdline.txt vol -f windows.envars > ./analysis/memory/envars.txt ``` Investigate anomalies such as unexpected parent/child relationships, system processes outside normal paths, orphaned processes, short-lived processes, suspicious command lines, and unusual privilege assignments. For a specific PID: ```bash vol -f windows.getsids --pid vol -f windows.privs --pid vol -f windows.dlllist --pid vol -f windows.handles --pid ``` ### 3. Review network activity ```bash vol -f windows.netstat > ./analysis/memory/netstat.txt vol -f windows.netscan > ./analysis/memory/netscan.txt ``` `netstat` is useful for structures representing active connections at capture time; `netscan` can also recover historical or closed connections. Correlate external addresses with owning PIDs, process command lines, executable paths, and disk artifacts before treating an address as malicious. ### 4. Review services, registry and persistence indicators ```bash vol -f windows.svcscan > ./analysis/memory/svcscan.txt vol -f windows.registry.hivelist > ./analysis/memory/hivelist.txt vol -f windows.registry.userassist > ./analysis/memory/userassist.txt ``` For targeted registry work: ```bash vol -f windows.registry.printkey --key "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" vol -f windows.registry.printkey --key "SYSTEM\\CurrentControlSet\\Services" ``` ### 5. Hunt for injection and hidden kernel components ```bash vol -f windows.malfind > ./analysis/memory/malfind.txt vol -f windows.vadinfo --pid > ./analysis/memory/vadinfo_.txt vol -f windows.modules > ./analysis/memory/modules.txt vol -f windows.modscan > ./analysis/memory/modscan.txt ``` Treat `malfind` hits as leads rather than proof. JIT runtimes and other legitimate software can create suspicious-looking memory regions. Compare `modules` and `modscan` for unlinked or hidden drivers and validate findings with additional evidence. YARA may be applied to process VAD regions when a suitable rule exists: ```bash vol -f windows.vadyarascan --pid --yara-rules /path/to/rules.yar ``` ### 6. Extract files or process memory for deeper analysis ```bash vol -f windows.filescan > ./analysis/memory/filescan.txt vol -f windows.dumpfiles --virtaddr --output-dir ./exports/dumpfiles/ vol -f windows.pslist --dump --pid vol -f windows.memmap --dump --pid --output-dir ./exports/memdump/ ``` Extract strings from a dumped process and pivot on commands, URLs, UNC paths, encoded content, or tool names: ```bash strings -a -n 8 ./exports/memdump/pid..dmp > ./analysis/memory/strings__ascii.txt strings -a -el -n 8 ./exports/memdump/pid..dmp > ./analysis/memory/strings__unicode.txt ``` Hash every extracted executable or blob before further handling. ### 7. Build a memory timeline ```bash vol -f timeliner --create-bodyfile > ./analysis/memory/mem_bodyfile.txt mactime -b ./analysis/memory/mem_bodyfile.txt -z UTC > ./analysis/memory/mem_timeline.txt ``` Use the memory timeline as corroboration and correlate it with filesystem, event-log and Plaso timelines. ## Memory Baseliner Use Memory Baseliner when a known-good baseline is available or when a baseline can be created from a clean reference image. Compare processes, drivers and services: ```bash python3 /opt/memory-baseliner/baseline.py -proc -i --loadbaseline --jsonbaseline -o ./analysis/memory/proc_baseline.csv python3 /opt/memory-baseliner/baseline.py -drv -i --loadbaseline --jsonbaseline -o ./analysis/memory/drv_baseline.csv python3 /opt/memory-baseliner/baseline.py -svc -i --loadbaseline --jsonbaseline -o ./analysis/memory/svc_baseline.csv ``` Create a new baseline only from a trusted reference image: ```bash python3 /opt/memory-baseliner/baseline.py -proc -i --savebaseline --jsonbaseline ``` Useful comparison dimensions include import hash, owner, command line and process state. Investigate unique processes, DLLs, drivers or services rather than assuming every difference is malicious. ## Recommended analysis order 1. Verify image and OS context. 2. Compare `pslist`, `psscan` and `pstree`. 3. Review command lines, environment, SIDs and privileges. 4. Correlate `netstat`/`netscan` with process ownership. 5. Inspect services, registry and persistence traces. 6. Use `malfind`, VAD analysis and module comparisons for injection/rootkit leads. 7. Dump and hash suspicious material. 8. Compare against a trusted baseline when available. 9. Correlate memory findings with disk and timeline evidence. ## Output discipline Keep textual analysis under `./analysis/memory/`, extracted evidence under `./exports/`, and record command failures or missing symbols explicitly. Never treat a single plugin result as conclusive when another independent artifact can corroborate it.