恶意程序内存取证分析

---
name: memory-forensics
description: >
  Analyze RAM dumps to detect malicious activity including hidden processes, injected code,
  network connections, and rootkit artifacts. Use when investigating a potentially compromised
  system, hunting for fileless malware, or performing incident response on memory captures.
  Supports Volatility 3 for Windows, Linux, and macOS memory images.
---

# Memory Forensics

Analyze memory dumps to uncover malware artifacts that may not be visible on disk, including
process injection, hidden processes, rootkit hooks, and in-memory-only payloads.

## Prerequisites

- Python 3.10+
- [Volatility 3](https://github.com/volatilityfoundation/volatility3) installed (`pip install volatility3`)
- Memory dump file (raw, ELF core, crash dump, or VM snapshot)
- Sufficient disk space for extracted artifacts (2x memory dump size recommended)

## Steps

### 1. Acquire Memory Dump

Obtain a memory image from the target system. The acquisition method depends on the platform
and access level.

**Linux:**
```bash
# Using LiME kernel module
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# Using AVML (Azure VMware Migration)
sudo avml /tmp/memory.raw

# From /proc/kcore (less reliable)
sudo dd if=/proc/kcore of=/tmp/memory.raw bs=1M
```

**Windows:**
```powershell
# Using winpmem
winpmem_mini_x64.exe memory.raw

# Using DumpIt
DumpIt.exe /quiet /output memory.raw
```

**VM Snapshots:**
```bash
# VMware: use .vmem file directly
# VirtualBox: use .sav or .elf file
# Convert if needed
volatility3 -f snapshot.vmem windows.info
```

See `scripts/memory_acquisition.sh` for automated acquisition.

### 2. Identify the OS Profile

Determine the operating system and version of the memory dump. Volatility 3 auto-detects in
most cases.

```bash
# Auto-detect OS information
vol -f memory.raw windows.info
vol -f memory.raw linux.info
vol -f memory.raw mac.info

# Using the helper script
python scripts/vol3_analyze.py --dump memory.raw --detect-only
```

Record the OS version, kernel build, and architecture. This information is critical for
accurate analysis.

### 3. List Processes

Enumerate all processes to establish a baseline and identify suspicious entries.

```bash
# Standard process listing (from EPROCESS linked list)
vol -f memory.raw windows.pslist

# Scan for process structures (finds hidden/unlinked processes)
vol -f memory.raw windows.psscan

# Process tree view (parent-child relationships)
vol -f memory.raw windows.pstree
```

**What to look for:**
- Processes with unusual names or misspellings (e.g., `scvhost.exe` vs `svchost.exe`)
- Processes running from unusual paths (e.g., `svchost.exe` not from `System32`)
- Processes with unexpected parent processes (e.g., `cmd.exe` spawned by `excel.exe`)
- Processes with unusual start times (outliers from boot sequence)
- Processes found by `psscan` but not `pslist` (potentially hidden)

### 4. Detect Hidden Processes

Compare process listings from different methods to find processes hidden by rootkits.

```bash
# Compare pslist vs psscan results
vol -f memory.raw windows.pslist > pslist.txt
vol -f memory.raw windows.psscan > psscan.txt

# Check for DKOM (Direct Kernel Object Manipulation)
# Processes in psscan but not pslist are suspicious
```

**Analysis approach:**
1. Run both `pslist` and `psscan`
2. Compare PIDs - any PID in `psscan` but missing from `pslist` is likely hidden via DKOM
3. Check process exit times - terminated processes appear in `psscan` but not `pslist`
4. Look for orphaned threads pointing to unlisted processes

### 5. Analyze Network Connections

Identify active and recent network connections to find C2 communication.

```bash
# Scan for network connections and sockets
vol -f memory.raw windows.netscan

# Linux network connections
vol -f memory.raw linux.sockstat
```

**What to look for:**
- Connections to known malicious IPs/domains
- Unusual ports (especially high-numbered ephemeral ports for listeners)
- Processes that should not have network connections (e.g., `notepad.exe`)
- Multiple connections to the same external IP from different processes
- Connections established shortly before/after the incident timeframe

### 6. Find Injected Code (Malfind)

Detect code injection, process hollowing, and other memory-based techniques.

```bash
# Find injected/modified memory regions
vol -f memory.raw windows.malfind

# Dump suspicious memory regions for further analysis
vol -f memory.raw windows.malfind --dump --pid <PID>
```

**Indicators of injection:**
- Memory regions with `PAGE_EXECUTE_READWRITE` protection
- MZ/PE headers in non-image memory regions (process hollowing)
- Executable code in heap regions
- Regions allocated with `VirtualAllocEx` that contain shellcode patterns
- Mismatched VAD (Virtual Address Descriptor) tags

### 7. Extract DLLs and Loaded Modules

List loaded DLLs to identify malicious or hijacked libraries.

```bash
# List DLLs for all processes
vol -f memory.raw windows.dlllist

# List DLLs for specific process
vol -f memory.raw windows.dlllist --pid <PID>

# Find hidden or unlinked DLLs
vol -f memory.raw windows.ldrmodules
```

**What to look for:**
- DLLs loaded from unusual paths (`%TEMP%`, `%APPDATA%`, user directories)
- DLLs with names similar to legitimate Windows DLLs (DLL side-loading)
- Modules in `ldrmodules` marked as not in all three lists (InLoad, InInit, InMem)
- Unsigned or suspiciously small DLLs
- DLLs loaded at unusual base addresses

### 8. Dump Suspicious Processes

Extract process executables and memory for offline analysis.

```bash
# Dump process executable
vol -f memory.raw windows.dumpfiles --pid <PID>

# Dump process memory regions
vol -f memory.raw windows.memmap --pid <PID> --dump

# Dump specific VAD regions
vol -f memory.raw windows.vadinfo --pid <PID>
```

After dumping:
1. Calculate hashes of dumped files
2. Submit to VirusTotal or similar services
3. Perform static analysis on extracted executables
4. Look for strings, embedded configs, or encrypted payloads

### 9. Analyze Handles and Mutexes

Examine process handles to find synchronization objects, files, and registry keys.

```bash
# List handles for all processes
vol -f memory.raw windows.handles

# Filter by handle type
vol -f memory.raw windows.handles --pid <PID>

# Look for mutexes (often used by malware for single-instance checks)
vol -f memory.raw windows.handles --pid <PID> | grep Mutant
```

**Malware-relevant handle types:**
- **Mutant (Mutex):** Campaign identifiers, single-instance markers
- **File:** Dropped files, configuration files, exfiltrated data
- **Key (Registry):** Persistence mechanisms, stored configuration
- **Section:** Shared memory for IPC between malware components
- **Event:** Synchronization between malware stages

### 10. Check for Rootkit Artifacts

Look for kernel-level manipulation and hooking.

```bash
# Scan for kernel modules/drivers
vol -f memory.raw windows.modules
vol -f memory.raw windows.driverscan

# Check for SSDT hooks
vol -f memory.raw windows.ssdt

# Detect callbacks
vol -f memory.raw windows.callbacks

# Check for IDT hooks
vol -f memory.raw windows.idt
```

**Rootkit indicators:**
- Kernel modules loaded from non-standard paths
- Modified SSDT entries pointing outside `ntoskrnl.exe` or `win32k.sys`
- Suspicious callback registrations (process creation, image load, registry)
- IRP (I/O Request Packet) hook modifications on device drivers
- Timer DPC routines pointing to unsigned code

### 11. Windows Services Analysis

Enumerate services to find malicious or modified service entries.

```bash
# List services
vol -f memory.raw windows.svcscan
```

**What to look for:**
- Services with random or unusual names
- Services running from temp directories or user-writable paths
- Services with `SERVICE_KERNEL_DRIVER` type loading unsigned drivers
- Services set to auto-start that were recently created
- Services with modified `ImagePath` values

### 12. Generate Consolidated Report

Use the automated analysis script to generate a comprehensive report.

```bash
# Run full analysis suite
python scripts/vol3_analyze.py --dump memory.raw --output report.json

# Run specific plugins only
python scripts/vol3_analyze.py --dump memory.raw --plugins pslist,netscan,malfind

# Run with artifact dumping
python scripts/vol3_analyze.py --dump memory.raw --output report.json --dump-dir ./artifacts/
```

## Offline vs Online Mode

**Offline mode (default):** All Volatility 3 analysis is performed locally. No internet
access required. Use symbol tables bundled with Volatility 3.

**Online mode:** Enrich findings with threat intelligence:
- Submit extracted hashes to VirusTotal
- Check network IOCs against threat intel feeds
- Look up mutex names in malware databases
- Cross-reference with MITRE ATT&CK patterns

## Tips

- Always work on a copy of the memory dump, never the original
- Document the chain of custody for forensic investigations
- Compare suspicious findings against known-good baselines for the OS version
- Memory analysis is point-in-time; correlate with disk and network artifacts
- Large memory dumps (16GB+) require patience; use `--pid` filters when possible
- When Volatility 3 lacks symbols, download ISF files from the symbol server