I was wondering what to do if by any chance I got infected with a Ransomware that could trick my AV suite, and my conclusion is that a complete memory dump would be the best option, as probably the encryption key would be there somewhere.

Searching online only showed me how to get the memory dumped on error, BSOD and the like, but not on demand. Some tutorials from many AV vendors even include a Restart step, which obviously is not something I would do during a Ransomware attack as I might lose the key for good.

So how could I dump all the system's memory in order to have a chance to find a encryption key there and possibly recover my files?

  • 1
    Encryption keys aren't 2 ways if the ransomware is good. You will not find the private key, you will only find the public key. THIS DOESN'T MEAN YOU SHOULD TRY. However, to answer your question there are a ton of tools to do this. f-response and encase to name a few. Not sure they will pull from a BSOD. It appears windows creates a minidump file. I'd research that. – Robert Cotterman May 24 '20 at 4:23

Some time ago, Microsoft bundled quite a large collection of tools, some more powerful than anything available for Windows.

I'm able to log activity going on in the background that I've never been able to see up until that point. At any rate, if they haven't created icons for everything - which they shouldn't, find ALL the EXE files that lack any kind of icon - they're command line only, no GUI. Either cut and paste or create a copy of them and stick them in your C:\Windows\System32

For your immediate purposes, just find livekd64 (assuming your system is 64 bit? if not, use the plain livekd) and put it in `System32. It might help you acquire the dump information you're after.

  • This is my ignorance, lack of patience... and, more specifically, lack of attention to detail. I just skimmed across and read the actual reason you want a dump file of your RAM. I suppose I could be wrong, but I'd almost wager MY $1,500 computer against the possibility of obtaining an encryption key. – TrexxæByte Apr 19 '20 at 17:40
  • Again, though... I could be wrong. Are you referring to regular Windows OS capability to encrypt files via the properties dialog window? Or... a much more hopeless attempt - trying to dig up BitLocker encryption key? Since BitLocker gives you about 3 different ways to recover its key, I'm pretty much 100% certain you're talking about the Encryption option found under the Advanced button in each file's Properties tab. – TrexxæByte Apr 19 '20 at 17:44
  • Well, how come the encryption key won't be in memory? If the program is running, then the data is on RAM, the only alternative is if it uses asymmetric encryption, but since it's a lot slower I think many won't use. – mFeinstein Apr 19 '20 at 17:45
  • No no no, I am talking about Ransonware encripting all my files, so they can ask for money later. – mFeinstein Apr 19 '20 at 17:46
  • But @mFeinstein ... that's not what I meant. You're absolutely right - it would have to either be in random access memory OR... possibly the page file. How much virtual memory is your system allocating? No... my doubtfulness was due to believing the encryption key ITSELF would have to be encoded, encrypted... protected in SOME way. – TrexxæByte Apr 19 '20 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.