# Memory Artifact Interpretation Guide

Guide to identifying and interpreting malicious artifacts found during memory forensics,
including process injection techniques, rootkit signatures, and other indicators of compromise.

## Process Injection Techniques

### Process Hollowing (RunPE)

**Description:** Attacker creates a legitimate process in a suspended state, unmaps its original
code, maps malicious code in its place, then resumes execution.

**Memory indicators:**
- Process with a legitimate name (e.g., `svchost.exe`) whose in-memory image differs from disk
- VAD regions marked as `PAGE_EXECUTE_READWRITE` at the process base address
- MZ/PE headers in VAD regions not backed by the original executable
- `malfind` detects PE headers in non-image memory regions
- PEB `ImageBaseAddress` may differ from the VAD-mapped image

**Detection with Volatility 3:**
```bash
# Malfind will flag hollowed processes
vol -f memory.raw windows.malfind --pid <PID>

# Compare in-memory image with disk image
vol -f memory.raw windows.dumpfiles --pid <PID>
# Then compare hash with original file on disk
```

### Classic DLL Injection

**Description:** Attacker uses `CreateRemoteThread` + `LoadLibrary` to force a target process
to load a malicious DLL.

**Memory indicators:**
- DLL loaded from unusual path (Temp, AppData, user directories)
- DLL present in `dlllist` but not in the on-disk directory listing
- New thread in target process pointing to `LoadLibraryA`/`LoadLibraryW`
- Cross-process handle to the target process from the injector

**Detection:**
```bash
vol -f memory.raw windows.dlllist --pid <PID>
vol -f memory.raw windows.ldrmodules --pid <PID>
```

### Reflective DLL Injection

**Description:** DLL is mapped into memory manually without using the Windows loader,
making it invisible to standard module enumeration.

**Memory indicators:**
- PE headers in memory not tracked by any PEB module list
- `ldrmodules` shows `False` for all three lists
- `malfind` detects executable regions with PE headers
- No corresponding file object in `filescan`

**Detection:**
```bash
vol -f memory.raw windows.ldrmodules --pid <PID>
# Look for entries with InLoad=False, InInit=False, InMem=False
vol -f memory.raw windows.malfind --pid <PID>
```

### Shellcode Injection

**Description:** Raw shellcode injected into allocated memory in a remote process,
typically via `VirtualAllocEx` + `WriteProcessMemory` + `CreateRemoteThread`.

**Memory indicators:**
- Small executable memory regions (< 4KB typical for shellcode)
- `PAGE_EXECUTE_READWRITE` protection on non-image memory
- No PE headers (unlike DLL injection)
- Common shellcode patterns: `FC E8` (CLD; CALL), `EB XX 5E` (JMP; POP ESI)
- API resolution stubs (hash-based API lookup patterns)

**Detection:**
```bash
vol -f memory.raw windows.malfind --pid <PID>
# Dump and analyze with disassembler
```

### APC Injection

**Description:** Uses Asynchronous Procedure Calls to queue code execution in target thread.

**Memory indicators:**
- Queued APC entries pointing to injected code
- `PAGE_EXECUTE_READWRITE` memory regions in target process
- Thread context modifications

### Thread Execution Hijacking

**Description:** Suspends a thread, modifies its context (instruction pointer) to point to
injected code, then resumes.

**Memory indicators:**
- Thread start address pointing to non-module memory
- Suspended threads with modified context
- Code caves in executable sections

### Process Doppelganging

**Description:** Uses NTFS transactions to create a process from a transacted file that
is never committed to disk.

**Memory indicators:**
- Process with legitimate name but no corresponding file on disk
- VAD entries with file-backed sections to non-existent files
- Transaction handles in the process handle table

---

## Rootkit Indicators

### DKOM (Direct Kernel Object Manipulation)

**Description:** Rootkit unlinks process or driver entries from kernel linked lists.

**Indicators:**
- Process found by `psscan` but not `pslist`
- Driver found by `driverscan` but not `modules`
- Broken EPROCESS list links (gaps in the doubly-linked list)

**Detection:**
```bash
# Compare outputs
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt
# Diff to find hidden processes
```

### SSDT Hooking

**Description:** Rootkit modifies System Service Descriptor Table entries to redirect
system calls.

**Indicators:**
- SSDT entries pointing outside `ntoskrnl.exe` or `win32k.sys`
- Entries pointing to non-standard kernel modules
- Modified `KeServiceDescriptorTable`

**Detection:**
```bash
vol -f memory.raw windows.ssdt
# All entries should resolve to ntoskrnl.exe or win32k.sys
```

### IRP Hooking

**Description:** Rootkit modifies I/O Request Packet dispatch tables in device driver objects.

**Indicators:**
- IRP major function pointers pointing to addresses outside the owning driver
- Modified dispatch tables for filesystem or network drivers

### Inline Hooking (Detours)

**Description:** First bytes of a function are overwritten with a JMP to rootkit code.

**Indicators:**
- Function prologues starting with `E9` (JMP) or `FF 25` (JMP [addr])
- Trampolines in kernel code
- Code integrity violations in critical kernel functions

### Callback Registration

**Description:** Rootkit registers kernel callbacks to monitor and intercept system activity.

**Indicators:**
- Callbacks registered by unsigned modules
- Callbacks pointing to addresses in non-standard drivers
- Excessive number of registered callbacks

**Detection:**
```bash
vol -f memory.raw windows.callbacks
```

---

## Credential Artifacts

### LSASS Memory

The Local Security Authority Subsystem Service (`lsass.exe`) contains authentication
credentials in memory.

**Artifacts found in LSASS:**
- NTLM password hashes
- Kerberos tickets and session keys
- Cleartext passwords (WDigest, if enabled)
- SSP credentials
- DPAPI master keys

**Detection of credential theft:**
```bash
# Check for processes accessing LSASS
vol -f memory.raw windows.handles | grep lsass
# Look for non-standard processes with handles to LSASS

# Dump LSASS for offline credential extraction
vol -f memory.raw windows.memmap --pid <lsass_pid> --dump
# Analyze with mimikatz's sekurlsa module
```

### SAM Database

The Security Account Manager database contains local account password hashes.

**Extraction:**
```bash
vol -f memory.raw windows.hashdump
vol -f memory.raw windows.cachedump
```

---

## Persistence Artifacts in Memory

### Registry-Based Persistence

Common persistence registry keys visible in memory:

```bash
# Run keys
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows\CurrentVersion\Run"

# Services
vol -f memory.raw windows.registry.printkey \
    --key "System\CurrentControlSet\Services"

# Winlogon
vol -f memory.raw windows.registry.printkey \
    --key "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
```

### Scheduled Tasks

```bash
vol -f memory.raw windows.filescan | grep -i "tasks"
```

### WMI Event Subscriptions

Look for WMI-related processes and objects:
- `WmiPrvSE.exe` with unusual activity
- Event consumer bindings in memory

---

## Common Malware Patterns in Memory

### Packed/Encrypted Payloads

**Indicators:**
- High entropy memory regions
- Memory regions that transition from RW to RX (unpack-and-execute)
- Small stub code followed by large encrypted blob
- Common packer signatures (UPX, Themida, VMProtect)

### Configuration Data

Malware often stores configuration in memory:
- C2 server addresses (URLs, IPs)
- Encryption keys
- Campaign identifiers
- Mutex names
- File paths for persistence

**Extraction approach:**
1. Dump process memory with `memmap`
2. Search for string patterns (URLs, IPs)
3. Look for structured data (JSON, XML, custom binary formats)
4. Check for XOR-encoded strings (single-byte XOR is common)

### Communication Buffers

Active C2 communication artifacts:
- HTTP request/response data in memory
- DNS query buffers
- Encrypted communication buffers (before/after encryption)
- WebSocket frames

---

## Analysis Workflow Summary

1. **Triage**: Run `pslist`, `psscan`, `netscan` for quick overview
2. **Hidden process detection**: Compare `pslist` vs `psscan`
3. **Injection detection**: Run `malfind` and `ldrmodules`
4. **Network analysis**: Review `netscan` for suspicious connections
5. **Persistence check**: Examine services (`svcscan`), registry, scheduled tasks
6. **Rootkit detection**: Check `ssdt`, `callbacks`, kernel modules
7. **Credential assessment**: Check for LSASS access, credential dumping artifacts
8. **Extract and analyze**: Dump suspicious processes/regions for further analysis