All,
Has anyone successfully analyzed memory from a windows 2008 server memory dump? This is my third time attempting to do so, and have yet to have any success with volatility. I took the memory dump so I know the profile, however, volatility reports it as a Windows 7 machine. Any advice on how to approach this persistent problem?
Does anyone have a copy of Brian Kaplan's paper, "RAM is Key, Extracting Disk Encryption Keys From Volatile Memory"
that they could email me at dragonforen(a)hotmail.com
If so, thank you!
Mike
Hi,
I'm using zeusscan2 module against a zeus infected memory dump, i'm able to
get the rc4 keys and xor keys as mentioned in this link "
http://mnin.blogspot.in/2011/09/abstract-memory-analysis-zeus.html".......i
have also downloaded the zeus config file, that this sample tried to
download, knowing this information, is it possible to decrypt the config
file, if yes, how can i decrypt the config file or what are the steps to
decrypt the config file?....and i think the zeuscan plugin is really
awesome (Thanks Michael for writing such a great plugin, its really
useful?)..
Thanks,
Does this mean volatility can't identify the hiberfil?
$ python ~/Volatility/vol.py hibinfo -f hiberfile.sys
Volatile Systems Volatility Framework 2.1_alpha
No suitable address space mapping found
Tried to open image as:
WindowsHiberFileSpace32: No base Address Space
EWFAddressSpace: No base address space provided
WindowsCrashDumpSpace32: No base Address Space
AMD64PagedMemory: No base Address Space
JKIA32PagedMemory: No base Address Space
JKIA32PagedMemoryPae: No base Address Space
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
WindowsHiberFileSpace32: No xpress signature found
EWFAddressSpace: EWF signature not present
WindowsCrashDumpSpace32: Header signature invalid
AMD64PagedMemory: Incompatible profile WinXPSP2x86 selected
JKIA32PagedMemory: No valid DTB found
JKIA32PagedMemoryPae: No valid DTB found
IA32PagedMemoryPae: Module disabled
IA32PagedMemory: Module disabled
FileAddressSpace: Must be first Address Space
Hello,
Over the last week or so, when I've done an svn update on the
2.1_alpha code, I've been receiving the following errors:
Volatile Systems Volatility Framework 2.1_alpha
*** Failed to import
volatility.plugins.overlays.windows.win2k3_sp2_x64 (AttributeError:
'module' object has no attribute 'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.win7_sp0_x86
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import volatility.plugins.zeusscan1 (AttributeError:
'module' object has no attribute 'ImpScan')
*** Failed to import
volatility.plugins.overlays.windows.win2k3_sp1_x86 (AttributeError:
'module' object has no attribute 'AbstractWindowsX86')
*** Failed to import volatility.plugins.zeusscan2 (AttributeError:
'module' object has no attribute 'ApiHooks')
*** Failed to import volatility.plugins.overlays.windows.vista_sp1_x86
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.win7_sp1_x86
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.vista_sp2_x86
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import
volatility.plugins.overlays.windows.win2k3_sp1_x64 (AttributeError:
'module' object has no attribute 'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.xp_sp3_x86
(AttributeError: 'module' object has no attribute 'nt_types')
*** Failed to import volatility.plugins.evtlogs (AttributeError:
'module' object has no attribute 'LdrModules')
*** Failed to import volatility.plugins.overlays.windows.vista_sp1_x64
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import
volatility.plugins.overlays.windows.win2k3_sp0_x86 (AttributeError:
'module' object has no attribute 'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.win7_sp1_x64
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import
volatility.plugins.overlays.windows.win2k3_sp2_x86 (AttributeError:
'module' object has no attribute 'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.vista_sp0_x64
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.vista_sp2_x64
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.xp_sp2_x86
(AttributeError: 'module' object has no attribute 'nt_types')
*** Failed to import volatility.plugins.timeliner (AttributeError:
'module' object has no attribute 'LdrModules')
*** Failed to import volatility.plugins.overlays.windows.vista_sp0_x86
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
*** Failed to import volatility.plugins.overlays.windows.win7_sp0_x64
(AttributeError: 'module' object has no attribute
'AbstractWindowsX86')
(This is with revision 1558)
This is just from doing an imageinfo. I was thinking since it
includes plugins that some plugins need to be updated for 2.1, but I
didn't want to make the assumption.
It does finish the KDBG search and give me the correct profile, so
it's parsing the dump. Just wasn't sure about the errors.
Thanks,
Tom
I have found an interesting result and have a fair amount of data to share.
Bottom line is that connscan may have missed (and miss reported) some connections (see memory image).
2 IPs are missing and note the ports recorded by cports and those reported by V2.0 connscan. Check the attached xls search hits, where did port 1088 and 1064 come from?
I can provide a copy of the memory image! Imager is win32dd.exe.
Here is the IP connection record I have from cports:
Date Time Log action PID Program Name Proto Source IP Destination IP
3/12/2012 3:53:10 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1063 212.117.175.34:80
3/12/2012 3:53:10 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1065 98.142.243.60:80
3/12/2012 3:53:10 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1066 98.142.243.60:80
3/12/2012 3:53:11 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1065 98.142.243.60:80
3/12/2012 3:53:11 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1066 98.142.243.60:80
3/12/2012 3:53:45 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1078 92.123.68.97:80
3/12/2012 3:54:06 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1080 98.142.243.60:80
3/12/2012 3:54:06 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1078 92.123.68.97:80
3/12/2012 3:54:27 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1080 98.142.243.60:80
3/12/2012 3:54:30 PM Added 1344 fix_pack.exe TCP 192.168.1.44:1087 98.142.243.60:80
3/12/2012 3:54:31 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1063 212.117.175.34:80
3/12/2012 3:54:31 PM Removed 1344 fix_pack.exe TCP 192.168.1.44:1087 98.142.243.60:80
Here is the result of V2.0 connscan:
Scan for connection objects (connscan):
Offset Local Address Remote Address Pid
---------- ------------------------- ------------------------- ------
0x041484c0 192.168.1.44:1088 98.142.243.60:80 1344
0x04193278 192.168.1.44:1093 65.54.51.29:443 3756
0x041cdc40 192.168.1.44:1064 98.142.243.60:80 1344
Attached is search results of the memory image, with memory offsets. (A few are dups and that may be the Win32dd imager)
Where did ports 1088 and 1064 come from?
If anyone wants a copy of the memory image, it is 115 MB
Mike
When clicking on the list of Volatility plugins, I go to
http://www.forensicswiki.org/wiki/List_of_Volatility_Plugins
>From the web page
"Here is a list of the published plugins for the Volatility 1.3 framework"
I do not see any "installation instructions"
Do these plugins just get copied to C:\Python27\Volatility-1.3_Beta\memory_plugins ?
Also, is there a like page for v2.0 ?
>From http://code.google.com/p/volatility/wiki/FAQ#Where_do_I_find_the_"malware"_plugins there is a link to
http://malwarecookbook.googlecode.com/svn/trunk/malware.py
what Volatility version is the plugin for? I do not see Volatility version number in .py files so I get a little confused which is for which. Will plugins have "for Volaitility vX" in the future?
Maybe I'm just not getting it.
Sorry,
Mike
Meant to send this to the list not just the OP.
-------- Original Message --------
Subject: Re: [Vol-users] BSOD while collecting a memory image
Date: Sun, 11 Mar 2012 11:07:54 -0400
From: George M. Garner Jr. <ggarner_online(a)gmgsystemsinc.com>
To: Mike Lambert <dragonforen(a)hotmail.com>
Mike,
> Is there malware that stops all imaging programs.. <
Don't know about ALL imaging programs. There is anecdotal evidence of
malware that stops some imaging programs and then allows others to run.
Smart malware doesn't stop anything from running. Everything appears
to be normal. Welcome to the matrix.
Malware has for a long time sought to identify "white hat" software.
Until recently this has been almost exclusively based on the file names
of common anti-rootkit and IR packages. You could effectively defeat
the anti-forensic techniques simply by renaming your tools. More
recently, however, rootkits have begun to use other information to
identify IR tools, in particular, the certificate info for signed PE
executables. This is much more problematic. Particularly with the
widespread adoption of 64-bit Windows, all device drivers must be signed
and the signature can be used to identify your tools in an unambiguous
way. There is a paper that will be published in the near future on
developing a blackhat scanner. If you investigate sophisticated malware
you should be thinking about getting your own code signing certificate(s).
I believe that Sinowal was/is a "public" rootkit that attempts to remove
itself from memory during hibernation. Whether a rootkit successfully
removes all traces of itself from a hibernation file is another matter.
Regards,
g.
