Bangeter 02-mf_intro_v41.pdf

• Defeat most root kit techniques
• Defeats file less, memory only malware
• Practicability
• Integrates naturally with the trend to virtualize infrastructure

Live forensics analysis search for anomalies on the potential victim machine itself

This is typically done sudin system administration tools to view process, network connections, registry and memory layout.

Malware often contain anti-live forensic features, so analysis becomes unreliable / impossible.

Rootkits are malware components that activly hide some malware traces / artifacts from someone working on the system, by modifying the processes and system.

Artifacts to hide:

• Files on disk
• Presence on live system (processes, code, registry keys, etc...)
• Network communication
• Suppress processes network connections, registry entries, etc...
• Hide code in non-malicous processes, corners of the system, etc...

In offline forensics a memory image or disk image of the infected host is created.

The image is then analyzed on a different (not infected) machine.

• Detect intrusions on victim machine, especially traces left by malware and related attack tools and techniques.
• Understand / analyze malware behavior at leas partially
• Identify mlware
• Triage
• Extract artefacts for further analysis (e.g. reverse engineering)

• Cyber-attacks & incident response (main application)
  • Finding malware, attack tools, etc...
  • Can be done proactively, or reactivly
• Reverse engineering in general
  • e.g. unpacking of obfuscated code
• Real world incidents & crime limited to specific data & scenarios
  • Disk decryption
  • Chat logs etc...
  • Proof that system is not subverted by malware

Creating memory image:

• Winpmem
• Dumpit

Memory analysis tools:

• Volatility
• Rekall
• WinDBG

Data carving is the scanning of a memory image for specific patterns such as:

• Credit card numbers
• Pictures
• IP adress
• Crypto keys

Carving is noisy -> it is possible to get false matches

Due to the fact that memory pages can be unorderd, it is possible that carving doesn't find everything.

Maximal lifetim: is between power-on and power-off

Data from "normal" applications can remain in memory even after the application has been closed.

Security aware application explicitly destroy sensitive information from memory when closed.

The ides is to use memory forensics tools to extract system related informations form memory images.

Memory introstpection is when the state of the OS is recunstructed from a binary blob (memory image). e.g. the process tree is recunstructed from the binary blob, etc...

Volatility is a collection of Python scripts for memory forensics.

Key features:

• Supports a wide variety of OSes
• Widely used
• Shell based, runs on Windows, OSX, Linux
• Freely available under GPL
• Extensible
• Solid documentation

$ vol -f mem-image.raw imageinfo

-f specify file

vol.py -f FILENAME --profile=PROFILENAME PLUGIN_COMMAND

List waliking -> extracting a process list

• List walking is also used to extract other entities such as DLLs

Scanning -> the image is searched for the signature of some process atributes.

Diferences:

• Scanning may produce flas positives and garbage, but my reveal rootkits
• Walking is mor precise, but may be defeated
• Almost all Vollatility tools use either list walking or scanning.

Hypervisor base

• Easy and reliable

Hardware based

• Direct memory access (FireWire, Thunderbolt, JTAG, PCMACIA, ...)
• Cold boot attack

Remote agent based in enterprise scenario

• Open source: Grr by google
• Many comercial ...

• RAW / DD: files contain an (almost) exact copy of the physical memory.
• Windows DMP: files additionaly contain meta data. the advantage is that the can be read using WinDBG for advanced analysis.
• VMWare images: Vmwarestoresmemoryin.vmemfiles,whichare sometimes (depending on VMware product and version) accompanied by .vmsn or .vmss files, in which case both files need to be recovered

Memory images can be converted from one format to another.

Prints a list of all the processes found in the memory image.

Prints a tree of all the processes and shows which process was created by which process.

explore.exe is suspicious because of its name.

smss.exe is started twice which is suspicious.

• Unknown or miss spelled process name
• To many process instances
• Wrong parent process, in particular typical user program with a parent differnt to explorer.exe
• Start order of processes / boot procedure
  • E.g. system process starting mach later than at boot time
• Suspicious path of executable

psscan can find processes that previously terminated and processes that have been hidden or unlinked by a rootkit.

psscan enumerates the process using pool tag scanning.

Unlinked processes will not show up in pslist but will show up in psscan. So process which are shown in psscan but not in pslist are suspicious.

psxview : finds process that are hidden using DKOM tricks, by cross checking against other process artifacts. (Hard to hide all process artifacts)

vol.py -f FILENAME --profile=PROFILENAME dlllist -p pid_of_process

dlllist will give you a list of all processess.

-p pid_of_process will give you a list of DLLs loaded by that process

• dlllist shows full path of where dlls are loaded for
  • spot an unusal path to a dll
  • spot unusual names
• dllist allows to detect DLL injections which are done useing LoadLibrary
• suspicous functionality i.e. legitimate DLL that does not normaly belong to a process
• Too many or too few DLLs

C:\Documents and Setting\Administrator\WS2_32.dll

Suspicious because not located in C:\WINDOWS\system32

malfind uses a simple heuristic to fint potential injection. It consists of the following checks:

• Is VAD regian: readable, writable, executable?
• Is VAD region: private (i.e. no flie mappings)?
• Are all pages in VAD region committed?

Malfind will have false posetives and false negatives be carefull.

Attributes that are suspicious, if not present false posetive.

• Priviledged instructions ('IN', 'OUT', 'INT', etc..) in user mode code
• 'DB' statements in the execution path
• 'NOP's, sparse code etc ...
• Jumps to undefined regions
• Conditional jumps, without setting flags first.
• Compiler generated code typically only contains a subset of the x86 instruction set. With some practice atypical instructions can be spoted.

Windows keeps track of DLLs in the PEB and the VAD.

ldrmodules iterates over the VAD and the PEB and finds discrepancies between the two. Through this unlinked DLLs in PEB are identified.

The more general goal of this command is to detect anomalies in file mappings, which my be caused by various malware techniques.

• Process hollowing is a code injection technique that is very similar to direct code injection.
• The ides is to hide the malicious code entierly by camouflageing as another process by replacing its code.
• Many data structures, suh as the PEB, of the original process remain unchanged and thus do not look suspcious.
• Typical victim processes would be standard Window processes like 'svchost.exe', 'lsass.exe'

1. Start victim using CreateProcess(), then suspend it immediately.
2. Release memory of main executable using ZwUnmapViewOfSection()
3. Allocate new memory using VirtualAllocEx(). The allocated memory needs to be writable and executable.
4. Inject code into allocated memory using WriteProcessMemory()
5. SetThreadContext() to new entry point
6. Call ResumeThread() to get injected code to run.

• The PEB is untouched, the path of the main images will remain visible in the PEB. 
• The main image is unmapped the VAD will have no entry for the main image.

This discrepancy is indicative of process hollowing.

Volatility module -> ldrmodules

ldrmodules: displays the state of the PEB and the mapped images in the VAD. So a process that has no Mapped image is likely to be the victim of process hollowing.

Volatility module -> malfind

malfind: process hollowing will result in a RWX memoryb allocation, which results in a malfind detection. See image.

VAD (keeps track of memory allocations and mapped files)

• compare the result of apihooks on an infected system, to a refernce "clean" system.

False positives reduction by correlation:

• Idea:
  • check where the hook points to, does it point to legitimate code or malicous code?
  • take malfind outputs as candidate malicious regions and match them agains the results from apihooks.

• connections: shwos TCP connections that where active at the point the mem. image was taken.
• connscan: finds artifacts from previeous connections that have been terminated, in addition to the active ones. (finds: _TCPT_OBJECT structures)
• sockets: detect listening sockets for any protocol.
• sockscan: can pick up residual data and artifacts from previous sockets (finds: _ADDRESS_OBJECT)
• netscan: Finds TCP endpoints, TCP listeners, UDP endpoints and UDP listeners. Distinguishes between IPv4 and IPv6. (only works for: 32, 64-bit Windows Vista, Server 2008, Windows 7)

Look for:

• Connections to unknown / suspicous hosts or to known bad hosts. (check blacklists)
• Process listening on suspicious ports known to be used by malware
• Identify processes that are not suposed to have network functionality with a socket /connection

To keep in minde:

• Malwere that connects to the CC once a day is unlikely to be capured in the memory image
• Network logs from your network monitoring is probably a complementary / better source
• The absence of network activity in memory forensics does not prove much.