(Un)Fucking Forensics

Who are we ?

Georges-James Duchamp De La Trufinière

Coffee maker

Brian

Memory Forensic response team

Summary

  • What is this ?
  • Basics concepts
  • How we proceed (why we get paid)
  • Case study

What is this ?

RAM

Processes

CPU

Disk

What is this ?

  • Extracting information from RAM
  • Finding interesting things
  • Enumerate running processes
  • Malwares may only leave clues in memory, not on disk

Basics concepts

Memory acquisition

Memory analysis

Dumping the memory of a target machine to disk

Analysing the memory dump for finding forensics artifacts

Basics concepts

Usefull tools

  • Volatility <3
  • Recall
  • binwalk
  • foremost
  • SIFT & Remnux VMs
  • Process Hacker
  • Process monitor
  • Lime

Basics concepts

Memory analysis

We should look at :

  • Running processes
  • Opened files
  • Registries
  • Network connections
  • Hidden data
    • dotfiles
    • obfuscated data
  • Malicious code

How we proceed

Checklist :

  • Profile infos
  • Commands history
  • Running processes
  • Network connections
  • Look for cool files

Practice

Example :

ECSC forensics challenge : "3615 Incident"

Mission : Find the ransomware, its PID and the name of the encrypted file.

Questions ?

Made with Slides.com