In previous lecture there was a discussion regarding beginning the process of analysis with the URL
or IP address associated with the malicious activity.
So volatility has the ability to pull out the memory image existing and even exited network connection
that were still resident at the time of the acquisition.
So the net scan plugin scans the memory image for network certificates.
Actually I was I have to let's here clear and here.
So the next scan plugin in volatility.
It scans the memory image of certificates and the plugin will find the TCP and UDP endpoints and listeners
as well as provide the local and foreign IP addresses.
So the net scan will only work with the 32 bit and 64 bit Windows Vista Windows 7, Windows 10 and Windows
2008 server or newer ones.
So one key feature that is of help to the instant response analysis with the net scan plugin is that
for the network connections, the process owner is indicated in the output.
So this is usually useful determining whether a connection is utilizing Internet Explorer or another
process, so such as remote desktop services or SMB.
So now let's run the program here and run the run the plugin here net scan.
And here?
Yeah.
Why the command provide?
Yeah.
The the net scan is for the newer versions for volatility.
That's because, as I said earlier, the net scan will not work in the Windows XP file.
This one is works with the Windows Vista, Windows 7 and Windows 10.
But we have an alternative here for Windows here.
So this and that's the con scan.
Con scan actually pretty different but actually not, not kind of different.
But yeah, the net scan is more.
And this gun has more features and gives more information here.
So for earlier versions of Windows such as Windows XP that we are analyzing now.
Here.
Yeah.
Before Windows XP that we are analyzing now.
The con scan plugin performs the same function as the scan plugin, so the con scan plugin finds the
Twcpt object and is able to find both existing and exited connections.
So this provides responders with data concerning connections in relation to processes that were running.
So to determine the network connections run here.
Con scan plugin.
Against the R2-D2 image.
And that's it.
Here.
This is our Trojan.
This is our Trojan IP address that.
That we're connected to.
So the output indicates that the process ID of 1956, which is actually doesn't show the witch the which
executable is that.
But we will see, uh, we will see.
So long.
But uh, the, the, the parent process of reader as we know because we as you remember, we suspect
that the reader SL dot exe file that we're running on the process and that's that is probably like 99%
of this reader is a address but we will investigate and I will show you facts that how this reader cell
and how how these IP address is associated with it.
So.
Here.
Uh, the IP address.
172.16.98.1. and four times six port was associated with several URLs that were communicating with malicious
executables.
So.
Here now we can hear.
Copy this.
So.
This year.
We're going to paste it here.
Suspect.
Right here?
Yeah.
So taking the date of was right from the process analysis in conjunction with the IP address taken from
the network connection.
So there is enough reason to believe one or both of the explorer that exist and reader SSL, that exit
process are associated with malicious code and this is the IP address connecting to them.
And yeah, in next lecture the reader SSL will be extracted along with its associated files for analysis.