Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.
Instrucciones de origen · Vista previa de solo lectura
name
conducting-memory-forensics-with-volatility
description
Performs memory forensics analysis using Volatility 3 to extract evidence of malware execution, process injection, network connections, and credential theft from RAM dumps captured during incident response. Covers memory acquisition, process analysis, DLL inspection, and malware detection. Activates for requests involving memory forensics, RAM analysis, Volatility framework, memory dump investigation, volatile evidence analysis, or live memory acquisition.
An endpoint has been contained during an active incident and volatile evidence must be preserved
EDR alerts suggest process injection or fileless malware that only exists in memory
Encryption keys need to be recovered from a ransomware-infected system before shutdown
Credential theft (Mimikatz, LSASS dumping) is suspected and evidence must be confirmed
A rootkit or kernel-level compromise is suspected and disk-based analysis is insufficient
Do not use for analyzing disk images or file system artifacts; use disk forensics tools (Autopsy, FTK) for those tasks.
Detection Gaps & Validation
Profile / symbol-table mismatch is the #1 failure: Volatility 3 auto-resolves symbols, but a missing or wrong PDB for the exact build (e.g. Windows 10 22H2 19045.xxxx) makes windows.info fail or pslist return garbage/empty. Confirm windows.info reports the correct build and DTB before trusting any plugin output — empty results often mean bad symbols, not a clean host.
pslist vs psscan blind spot:pslist walks the linked list a rootkit can unlink from. Always diff psscan (pool-tag scan for EPROCESS) against pslist — a process in psscan only is hidden. Likewise netscan may show connections the live host's netstat hid.
malfind false negatives/positives: legitimate JIT engines (.NET, browsers) allocate PAGE_EXECUTE_READWRITE, and modern injection (module stomping, thread-stack spoofing) won't always trip malfind. Corroborate with windows.dlllist/ldrmodules (unlinked DLLs), windows.malfind hexdump (MZ header), and a YARA scan.
Acquisition smearing: a dump taken on a live host is non-atomic; structures shift mid-capture, so a single missing artifact isn't proof of absence.
Validate every finding: hash the image and confirm it parses (windows.info) before analysis; cross-check an injected-process hit against netscan (its C2 connection) and cmdline (how it launched); dump the suspect region (windows.memmap --dump) and re-scan with YARA/CobaltStrikeParser to confirm the family rather than inferring from the VAD protection flag alone.
Prerequisites
Memory acquisition tool deployed or available: WinPmem, Magnet RAM Capture, DumpIt, or AVML (Linux)
Volatility 3 installed with Python 3.8+ and required symbol tables
Sufficient storage for memory dumps (equal to system RAM size, typically 8-64 GB)
YARA rules for malware detection in memory (Florian Roth's signature-base, custom rules)
Reference baseline of normal processes and DLLs for the OS version being analyzed
Chain of custody documentation for evidence handling
Workflow
Step 1: Acquire Memory Image
Capture RAM from the target system using a forensically sound method:
Volatility 3 automatically identifies the OS, but verify:
# Get system information
vol -f WKSTN-042_20251115_1445.raw windows.info
# Output includes:# OS: Windows 10 22H2 (Build 19045.3693)# Kernel Base: 0xf8066c200000# DTB: 0x1aa000# Symbols: ntkrnlmp.pdb
Step 3: Analyze Running Processes
Examine the process tree for suspicious activity:
# List all running processes
vol -f memory.raw windows.pslist
# Show process tree (parent-child relationships)
vol -f memory.raw windows.pstree
# Scan for hidden/unlinked processes (rootkit detection)
vol -f memory.raw windows.psscan
# Compare pslist vs psscan to find hidden processes# Processes in psscan but NOT in pslist may be hidden by rootkits
Key indicators of compromise in process analysis:
svchost.exe running without -k parameter or with wrong parent (should be services.exe)
csrss.exe or lsass.exe with abnormal parent process
Processes with misspelled names (scvhost.exe, lssas.exe)
Unusual processes spawned by outlook.exe, winword.exe, or excel.exe
Multiple instances of processes that should be singletons (lsass.exe, smss.exe)
Step 4: Investigate Network Connections
Extract active and recently closed network connections:
# List all network connections
vol -f memory.raw windows.netscan
# Focus output fields:# Offset Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID Owner# 0xe10... TCPv4 10.1.5.42 49721 185.220.101.42 443 ESTAB 3847 update.exe
Cross-reference suspicious connections with the process tree to identify C2 communications. Look for:
Connections to external IPs from unexpected processes
High port numbers connecting to port 443/80 from non-browser processes
Connections from svchost.exe or system processes to external IPs
Step 5: Detect Process Injection and Malware
Use malfind to identify injected code and memory-resident malware:
# Detect injected code in processes
vol -f memory.raw windows.malfind
# Output shows:# PID Process Start End Tag Protection Hexdump/Disassembly# 3847 explorer.exe 0x2a10000 0x2a14000 VadS PAGE_EXECUTE_READWRITE# MZ header detected - injected PE# Dump suspicious process memory
vol -f memory.raw windows.memmap --pid 3847 --dump
# List DLLs loaded by a suspicious process
vol -f memory.raw windows.dlllist --pid 3847
# Scan memory with YARA rules
vol -f memory.raw windows.yarascan --yara-file malware_rules.yar
