In this lecture, we're going to analyze network services and connections in volatility.
So volatility can be used to identify and analyze active, terminated and hidden connections along with
the ports and processes.
So all the protocols are supported.
And volatility also reveals details of ports used by the processes, including the times they were started.
So for these purposes we can use the con scan and sockets sockets plugin in volatility.
So let's, let's start with the con scan plugin.
So to display a list of connections that have been terminated, the con scan command is used.
So the con scan here, we're going to just delete the ps6 view con scan.
And so the con scan command is also only used for Windows XP and 2003 servers, both 32 bit and 64 bit
systems.
So you're just going to specify the profile, enter the file virtual memory file and enter the con scan
plugin name here and click on enter.
The output of is shown as follows here.
So looking at this code, we see that the connection was made to 101 72.16 .98.1, 2.4 times six.
So for those knowledgeable about port numbers.
Port for 46666 is usually an identification of malware according to let's actually make a bit research
on six here.
Port number.
We can see that actually it's a famous datagram.
Communication for Internet network layer.
And here this is the UDP port.
Actually, it can be used for TCP, of course.
And yeah it's it can be also used for another purposes but it mainly uses like it's actually there are
more popular um Trojan and remote administrator tools that uses the this port for connection with the
victim computer, but it also uses the IRC messaging applications and the other purposes.
As you can see, this is a dark connection.
Dark.
There was a random Access Trojan named Dark Command, and it's actually most popular that uses these
port.
So it's actually not like 100% suspect here like, but it's actually pretty suspicious.
So.
We will also look into finding and analyzing traces of malware using volatility framework in next lectures
and where we will revisit volatility and have a look at ransomware analysis.
So as you can see here, let's actually what why we did here.
Yeah this is let's run our command again scan here so if using this connections plugin on the other
examples cases, you can obtain more information about the remote IP addresses using the IP lookup tools
such as.
The who is actually why?
Why this ad here?
Yeah, yeah, yeah.
Actually you can also use foo is like ip loop lookup.
You can also change.
You can also get, um, like navigate IP address to somewhere.
IP map like.
Yeah, this is mainly.
Here.
And you can also use Furies here.
Now, let's as I said earlier, this, we we were in this lecture.
We're going to cover two plugins.
And the second plugin is the the second plugin is.
Cone scan here.
No second plugin is actually sockets.
So the sockets.
The sockets plugin can be used to give additional information on the listening sockets.
Although the user datagram protocol which named UDP and Transmission Control Protocol TCP are the only
protocols listed in the output.
So the sockets command supports actually all protocols here.
As you can see, we got this result here actually.
Let's copy.
Now it's okay.
So.
The output is as follows here.
So you were able to leave network and socket information in this section.
So let's let's actually now delve into memory analysis using the plug ins to reveal programs and users
that may have been running and active at the time of the memory acquisition.
Now I'm waiting you in next lectures.