Malware Analysis

Abstract

This chapter provides the reader with an introduction to memory analysis, used for malware detection, using the open-source tool Volatility. Using Volatility rather than treating a memory dump as a big blob of data allows the examiner to complete a more structured analysis. This chapter demonstrates how to use Volatility to find several key artifacts including different ways of listing processes, finding network connections, and using the module malfind that can detect suspicious instructions. Looking at memory analysis for use as a part of incident response, it usually comes down to finding signs of intrusions or malicious code, as such it is about finding illegal behaviors in the processes loaded into memory. The aim of the chapter is to demonstrate how to accomplish that by showing the reader the basic functionality of Volatility and Redline so that the reader can continue to learn memory analysis on his own.