1

I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics. The problem is that the machine does not have the tools for memory imaging before getting infecting. When infected, an incident responder must somehow install the tools to dump the memory to an external disk as evidence. My problem is that if I transfer the tools via a USB disk and/or save the memory image to that USB disk, there is a risk to transfer the malware from the infected machine to the USB device. Does any of you have a solution for this problem and what is the standard for such procedure?

Thanks a lot!

2
  • 3
    If the USB used isn't vulnerable to reprogramming (BadUSB) (or if the system is configured to refuse new keyboards/network cards/etc), you don't have autorun enabled on the analysis machines, and you know in advance that everything on the USB is untrusted, how can malware be transferred? Jul 2 '21 at 8:21
  • OP asked about the risk that the malware will be transferred from the infected machine to the USB device, not from the USB device to the analysis machine. Of course, this is a silly question, since the malware probably WILL be transferred from the infected machine to the USB stick (since the malware is presumably loaded into memory and OP is dumping the memory to the USB stick). You are right that the malware is not likely to infect the analysis machine, which should actually be OP's concern, but that is not actually what he asked about. <shrug>
    – hft
    Jul 29 '21 at 4:39
1

I'm assuming that memory image means memory dump.

There are a couple of ways I can think of, but it depends on your machine setup. For instance it is much easier to do this to virtual machine-based machine than physical machine.

  1. If you're using virtual machine host like ESXi or VMWare Workstation, it's pretty simple. I assume that you kept the machine up when the malware infection happened. Pause or suspend the machine, then go to the filesystem where the VM is located, then look for the suspended-memory file, you should be able to copy it safely from the host. I only knew two filetypes for the memory dump, .vmss and .vmem. Both should be good for analysis, but sometimes it need some more processing. Angry Bender made a good example about how to convert this for analysis.
  2. Dump the memory using portable tools like DumpIt, and then upload it to online storage from the machine, and then you can download it to your computer. This is maybe the most naive way to send the image to your machine. I don't recommend this since it's a bit sketchy to be forensically sound when you redownload it. Use single-download online storage for safety.

Cheers.

Good readings:

https://forums.ivanti.com/s/article/Collecting-a-Memory-Dump-from-a-VMWare-machine-for-use-with-WinDbg?language=en_US

https://www.andreafortuna.org/2019/04/03/how-to-analyze-a-vmware-memory-image-with-volatility/

https://angry-bender.github.io/blog/vmware_snapshots_volatility/

0

One way you can do this is to hibernate the computer, which will result in the OS conveniently dumping memory to disk. Then you can boot onto another OS and read the dumps.

Windows stores the memory dump in hiberfil.sys. Although it uses a proprietary format, it has been reverse engineered and can be converted into a raw memory dump. See Tools for Windows 10 hiberfil.sys file analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.