RAM Forensics with Volatility

Introduction to RAM Forensics

RAM forensics, or memory forensics, focuses on analyzing a computer's volatile memory (RAM) to extract information about what happened on the system during its operation. RAM can provide key insights that aren't available through disk forensics, such as running processes, network activity, malicious code injection, and more.

Volatility: is one of the most popular open-source tools used to perform RAM forensics. It is platform-agnostic, supporting Windows, Linux, and macOS memory analysis.

Prerequisites

Before starting with Volatility, make sure you have the following:

1. Memory Dump (Memory Image): You need a memory dump from the system you want to investigate. There are various tools you can use to capture a RAM image, such as:
   • FTK Imager (Windows)
   • DumpIt (Windows)
   • WinPMem (Windows)
   • LiME (Linux)
2. Volatility Installed: Volatility can be installed using:
   • Python Package: Install via pip install volatility.
   • Pre-compiled Binaries: Download from the official Volatility Foundation website.
3. System Knowledge: Familiarize yourself with the operating system and software environment you're analyzing. Knowing the OS version, running applications, and network configuration will help interpret forensic findings.

Step-by-Step Guide:

1. Identify the Memory Image Profile

   The first step in analyzing a memory dump is determining the operating system profile used by Volatility to interpret the image. Use the imageinfo command to identify the profile:

   volatility -f <memory_dump> imageinfo

   The output provides details about the operating system (OS), kernel version, and suggested profile(s). Example output:

   Suggested Profile(s): Win7SP1x64, Win2008R2SP1x64

   Choose the appropriate profile and use it in further commands. In this case, the profile might be Win7SP1x64.

2. List Running Processes

   The next step is to view the processes that were running when the memory image was captured. Use the pslist command:

   volatility -f <memory_dump> --profile=<profile> pslist

   This will show active processes, including:

   • Process ID (PID)
   • Parent Process ID (PPID)
   • Process names
   • Start time of each process

   Example output:

   
   PID    PPID   Name         Offset
   4      0      System       0x00000000
   540    4      smss.exe     0x0004c000
   684    540    csrss.exe    0x00160000
   732    684    wininit.exe  0x002c8000
       

   This output helps identify legitimate processes. If you see suspicious processes (like unknown or misspelled system processes), this could indicate malware.

3. Detect Hidden or Terminated Processes

   Malware often tries to hide itself by avoiding normal system process lists. Volatility can reveal hidden or previously terminated processes using psscan:

   volatility -f <memory_dump> --profile=<profile> psscan

   Unlike pslist, which only shows active processes, psscan scans the entire memory for traces of any process. Compare pslist and psscan results to detect hidden processes.

4. Analyze Process Memory (DLL and Handles)

   You can extract information about the dynamic link libraries (DLLs) used by each process. This is useful to check if any process has loaded malicious or suspicious libraries.

   To list DLLs loaded by each process, use the dlllist command:

   volatility -f <memory_dump> --profile=<profile> dlllist

   Example output for explorer.exe:

   
   Pid      Base      Size      Path
   3040   0x772c0000  0x180000  C:\Windows\system32\kernel32.dll
   3040   0x772c0000  0x210000  C:\Windows\system32\user32.dll
       

   If you notice DLLs loaded from suspicious directories (such as C:\Temp or C:\Users\Public), it could indicate malware.

   Additionally, to see open file handles associated with processes (files, registry keys, etc.), use handles:

   volatility -f <memory_dump> --profile=<profile> handles --pid=<pid>

5. Analyze Network Connections

   Volatility provides plugins to examine network activity, revealing open ports, connections, and even network artifacts from terminated connections. For network forensics on a Windows machine, you can use:

   • netscan (scans for open network connections and listening ports):

     volatility -f <memory_dump> --profile=<profile> netscan

   This will list:

   • Local and remote IP addresses
   • Open ports
   • Connection states (e.g., ESTABLISHED, CLOSE_WAIT)

   Example output:

   
   Offset     Local Address    Remote Address  PID
   0x83be9f   192.168.0.5:80   10.0.0.25:6343  3124 (chrome.exe)
       

6. Dump Process Memory for Malware Analysis

   To extract a process's memory for further analysis, such as scanning for malware signatures or identifying hidden code, use the memdump plugin:

   volatility -f <memory_dump> --profile=<profile> memdump --pid=<pid> --dump-dir=<output_dir>

   This command dumps the process memory to a file, which you can examine further with other tools (e.g., strings, YARA).

7. Analyze Registry Hives

   The Windows Registry is another critical forensic source. Volatility allows you to extract and analyze registry hives, which may contain persistence mechanisms (e.g., autorun entries, malware configurations).

   First, list the registry hives in memory:

   volatility -f <memory_dump> --profile=<profile> hivelist

   Then, you can dump a specific hive for offline analysis:

   volatility -f <memory_dump> --profile=<profile> dumpregistry --hive-offset=<offset> --dump-dir=<output_dir>

8. Detect Injected Code or Malicious Memory Regions

   Malware often injects malicious code into legitimate processes to avoid detection. The malfind plugin helps detect such injections by searching for suspicious memory regions:

   volatility -f <memory_dump> --profile=<profile> malfind

   This will display memory regions that do not match the typical characteristics of legitimate code, such as non-standard permissions (RWX - Read, Write, Execute) or anomalous executable pages.

9. Examine Command History

   You can also examine shell command history using plugins such as cmdscan and consoles, which retrieve previously executed commands:

   volatility -f <memory_dump> --profile=<profile> cmdscan

   volatility -f <memory_dump> --profile=<profile> consoles

   This will give you insight into the activities performed by users or malicious actors through command-line interfaces.

10. Keyword Search with YARA Rules

    If you want to search memory for specific indicators (like IP addresses, file paths, or malware patterns), you can use YARA rules. To search for specific patterns, use the yarascan plugin:

    volatility -f <memory_dump> --profile=<profile> yarascan --yara-rules=<rules_file>

    This will scan the memory image for matches to the provided YARA rules, helping to detect malware signatures.

Analyzing the Results

Once you’ve gathered the information from Volatility, you can start correlating findings:

• Hidden Processes: Look for discrepancies between pslist and psscan.
• Malicious DLLs: Check DLLs loaded from unusual locations.
• Network Connections: Investigate network activity from unexpected processes or connections to suspicious IPs.
• Code Injections: Use malfind to detect any injected code.
• Command History: Look for any executed commands that might be related to malicious activity.
• Additional Analysis: Use tools like IDA Pro, Ghidra, or VirusTotal to further analyze any memory dumps or extracted malicious files.

You can gain a thorough understanding of the activities occurring in RAM and uncover potential malicious behavior, providing invaluable insight during incident response or malware investigations.

VOL.exe vs PassMark Volatility Workbench

The vol.exe tool refers to the traditional Volatility framework, which operates entirely through the command line. It’s often the preferred method for advanced users and forensic professionals who need full control over their analysis, flexibility in scripting, and the ability to handle complex cases.

PassMark Volatility Workbench is a GUI-based tool built on top of the Volatility framework. It was developed by PassMark Software to provide a more user-friendly interface for memory forensics, particularly for users who prefer a graphical user interface (GUI) instead of command-line interaction.

Comparison Table: vol.exe vs PassMark Volatility Workbench

Feature	vol.exe (Command-Line)	PassMark Volatility Workbench (GUI)
Interface	Command-Line Interface (CLI)	Graphical User Interface (GUI)
User-Friendliness	Requires expertise, steep learning curve	Beginner-friendly, easy to use
Control	Full control over commands and options	Simplified with limited flexibility
Automation	Easily scriptable, good for automation	Not suitable for automated workflows
Customization	Supports custom plugins and deep customization	Limited to default plugins
Platform Support	Windows, Linux, macOS	Primarily Windows
Best For	Advanced users, forensic professionals	Beginners, non-technical users
Output Format	Text-based, output in the terminal	Visual output in a GUI