In this lecture.
As we stated previously, one of the central goals of memory analysis is to determine whether there
are any suspicious data points in active indicative of malware.
So in the event data points such as DOS from the CRIDEX or like R2D2 memory image are located, they
can be queried for further analysis.
So we're going to in this lecture, we're going to do the memory dump.
So during the course of the analysis, it may become necessary to dump the memory resident pages associated
with the process, in this case, the mem dump.
The mem dump here.
The mem mem dump process where mem plugin is run against the memory image.
Yeah.
So let's delete this.
And yeah, this is our profile.
Now we're going to work in the same image file that we worked previously XP, SP2, x86.
And firstly, we're going to attach the process.
Yeah, yeah, yeah, yeah.
One minute, one minute.
We have to firstly identify the process file, which is I know it's 1986, but I want to show you.
So.
Now list.
List or list of the list of processes I have.
And yeah, we're going to we're going to export the.
Explorer explorer.
And here 1956.
This is defined 116 and I'm exporting and dumping it because of this is the child reader that SL malware
we're sure we are almost sure that the reader that SL contains malware and yeah we're going to.
Uh, and yeah, the explorer that is the parent process of this.
And as you can see, the PID.
So it works under the Explorer.
So we're going to execute, we're going to dump the Explorer access.
So, you know, so that way we're going to we, we're going to have the access.
And we also in in, in that dump, it's also included the reader dot access.
So we don't we don't do the we don't dump it, uh, like separately the explorer access.
Yeah.
Yes.
And in most times you're going to have the Dump Explorer exit.
So but because the most malwares are associated with the main application explorer that access.
So let's dump it.
Now we know the process ID of the Explorer.
That exit.
Yeah.
Where are you?
Yeah, this is the Explorer that exit here.
And.
Yeah, now we can run our command.
So we we choose the image file.
We choose the profile of the memory image dump.
So now we're going to use p 1956.
As you can see, I previously used this command mem dump dump here with two.
Negative characters.
Yeah, just dumped it home.
Carly.
Desktop.
Volatility.
Gain.
Oxley Case 001.
And yeah, that's the destination for destination folder that we're going to dump the memory.
So as you can see here, this is the dump from it.
And yeah, let's open our folder and see what happened here.
Yeah.
Volatility.
Okay.
001.
And this is, as you can see, we can actually we can open it with the wireshark.
Here.
It doesn't understand.
Yeah.
But are we going to are we going to analyze it with another programs here?
So.
But actually, Wireshark.
Wireshark can use the files, but I think it's not compatible with Wireshark here.
So.
It was.
It is a good practice to develop a naming convention, as you can see, actually.
What what 1956 like reminds you of nothing.
So you can you need to change this file to something meaningful.
Meaning something has meaning that you with your action.
So in this case, I'm going to change this file to explore or.
Yeah.
Case 001.
Uh, explorer.
That eggs or not?
Don't use that.
They are confusing.
As you can see the that is for extension you can just use underscore explorer XM and yeah with after
x.
Yeah and.
Explorer.exe process reader.
SL.
Mall here.
And as you can see, this is more descriptive, right?
Yeah.
So this is more better to you earned.
And like practice the developer naming convention for folders associated with a memory analysis.
So then as you can see, this way, the files are kept in appropriate location.
In this case, the author is using.
And as you can see here, the case 001 explorer dot x here.
And yeah, it should be noted that the acquisition May acquisition may contain malware and should be
done on an appropriate, appropriate system now.
We're going to dump the file.
This and also another aspect, important aspect of the dumping process.
So in the event that an analyst is able to identify a suspect process within the memory image, the
DLL.
DLL dump plugin can be utilized.
To dump the contents of these files to the local system.
This allows the analyst to examine the contents of the DLL files and compare them to legitimate files
to determine whether they are malicious or something something like dangerous, for example.
So the process that has been identified in this case is the reader cell with the process ID 200, 200,
two, 228, and the parent process ID is 1956, which is the Explorer DOT XM.
And this 228 was identified as a potentially malicious in several sections of this lecture.
So to occur the DLL files and have them accessible to the local system.
We're going to also dump this.
So, for example.
200.
In this case, we're not going to dump the export exit, but we're going to dump the spatially spatially
reader That.
SL So because it is more effective way to do this and yeah, 228 we enter the reader.sl and.
Uh, actually, that's.
Okay.
Can you see it?
Yeah.
Okay.
So 228 and after this.
As you can see, we specified that.
And instead of just using the mem dump in this case, we're going to use the dll dump.
DLL dump.
Dump here.
And yeah, now we're going to also click enter and that is the.
That is the dump of the data file.
Uh, yeah.
So we don't we didn't specify.
Yeah.
We also did specify the dumpster here.
Oh, why?
Why this happened?
Okay.
Oh.
We accidentally copied and pasted all of these outputs here?
Yeah.
Volatility.
Desktop volatility.
Volatility.
Yeah.
Yeah, yeah, yeah.
That's because.
Okay.
So now let's open the file here.
Oh.
Yeah, these are the.
Okay, let's create a folder case.
000010001 and return as you actually can.
As you can see, we can give a meaning to it like so.
Redressal.
What was it like?
Dum, dum, dum, dum.
And we're going to paste all of this.
Actually, we had to do it.
Okay.
One, two, three.
And paste all of these files into this.
And as you can see, these are the DLL files that's associated with this malicious, malicious, malicious
file.
So.
Yeah.
These are the modules module names, so we can also use this.
So as you can see here in this case, in this case, we we are using the volatile used the module names
instead of the DLL files becomes because are sort of confusing here.
So we're going to create a document, not just a txt file like module names, module names to module
names to to deal.
Deal Description dot txt.
Here and enter this and we're going to paste it here.
So with this, there is actually quite a point of this, as you can see here.
With this.
For example.
Mhm.
Change it.
Or we can do this, for example.
Yeah.
And as you can see here.
These are the reader dot dll files and I want to change the with a list.
Okay.
And as you can see, there's a list of the files that we are using to it and the you model 220
(818) 233-8739.
7C9.
And as you can see, this module named the module DLL file name.
This is the equivalent to Ntdll.dll here and here.
This is equal to reader dot dot exe.
And this is the So in this lecture you showed you how to dump memory and files from the malicious in
the captured image file here.
So in next lecture we're going to use the executable dump, which is actually quite interesting.
So I'm waiting you next lecture.