<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-malware-memory-forensics
description: >-
  Analyze memory dumps for malware artifacts including injected code, hidden
  processes, rootkit hooks, and extracted payloads using Volatility 3 and
  complementary memory forensics tools.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - memory-forensics
  - volatility
  - process-injection
  - malfind
  - vad-analysis
  - kernel-forensics
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1055"]
---

# Performing Malware Memory Forensics

## Overview

Memory forensics reveals malware that hides from disk-based analysis — injected code, hollowed processes, fileless payloads, and rootkit hooks all leave artifacts in physical memory. Analysis involves acquiring memory dumps, identifying anomalous processes and modules, extracting injected code regions, scanning with YARA, and reconstructing malware behavior from volatile artifacts including network connections, registry handles, and loaded drivers.

## Prerequisites

- Volatility 3 (Python 3.10+ with `volatility3` package)
- WinPmem / FTK Imager / LiME for memory acquisition
- YARA with malware rule sets
- Rekall (alternative memory forensics framework)
- Strings / FLOSS for extracted region analysis
- Ghidra for disassembly of dumped code

## Key Concepts

### Memory Acquisition Methods

| Tool | Platform | Format |
|------|----------|--------|
| WinPmem | Windows | Raw / AFF4 |
| FTK Imager | Windows | Raw / AD1 |
| LiME | Linux | Raw / Lime |
| DumpIt | Windows | Raw |
| osxpmem | macOS | Raw / AFF4 |

### Key Volatility 3 Plugins

| Plugin | Purpose |
|--------|---------|
| `windows.pslist` | List processes via EPROCESS linked list |
| `windows.psscan` | Find processes via pool tag scanning |
| `windows.malfind` | Detect injected/modified code regions |
| `windows.vadinfo` | Virtual Address Descriptor analysis |
| `windows.dlllist` | List loaded DLLs per process |
| `windows.handles` | List open handles (files, registry, mutexes) |
| `windows.netscan` | Active network connections |
| `windows.ssdt` | System Service Descriptor Table hooks |
| `windows.callbacks` | Kernel notification callbacks |

## Workflow

### Step 1: Acquire Memory

```bash
# Windows — WinPmem
winpmem_mini_x64.exe memory.raw

# Linux — LiME
sudo insmod lime-$(uname -r).ko "path=/tmp/memory.lime format=lime"

# Verify acquisition
file memory.raw
ls -lh memory.raw
vol3 -f memory.raw banners
```

### Step 2: Initial Triage

```bash
# Identify OS profile
vol3 -f memory.raw banners
vol3 -f memory.raw windows.info

# Process listing — compare pslist vs psscan for hidden processes
vol3 -f memory.raw windows.pslist --output csv > pslist.csv
vol3 -f memory.raw windows.psscan --output csv > psscan.csv

# Quick diff for hidden processes
diff <(awk -F, '{print $1}' pslist.csv | sort) \
     <(awk -F, '{print $1}' psscan.csv | sort)

# Process tree for parent-child analysis
vol3 -f memory.raw windows.pstree
```

### Step 3: Detect Injected Code

```bash
# malfind — detect injected code (RWX memory, PE headers in non-image VADs)
vol3 -f memory.raw windows.malfind

# Dump injected regions for analysis
vol3 -f memory.raw windows.malfind --dump --pid 1234

# VAD analysis for suspicious memory regions
vol3 -f memory.raw windows.vadinfo --pid 1234

# Scan for PE headers in process memory
vol3 -f memory.raw windows.pe_scan --pid 1234
```

### Step 4: Analyze Suspicious Processes

```bash
# DLL list — look for unknown/unsigned DLLs
vol3 -f memory.raw windows.dlllist --pid 1234

# Handles — open files, registry keys, mutexes
vol3 -f memory.raw windows.handles --pid 1234

# Command-line arguments
vol3 -f memory.raw windows.cmdline --pid 1234

# Environment variables
vol3 -f memory.raw windows.envars --pid 1234

# Network connections from process
vol3 -f memory.raw windows.netscan | grep 1234
```

### Step 5: YARA Scanning in Memory

```bash
# Scan all process memory with YARA rules
vol3 -f memory.raw yarascan.YaraScan \
    --yara-file malware_rules.yar

# Scan specific process
vol3 -f memory.raw yarascan.YaraScan \
    --yara-file malware_rules.yar --pid 1234

# Scan kernel memory
vol3 -f memory.raw yarascan.YaraScan \
    --yara-file rootkit_rules.yar --kernel
```

### Step 6: Extract and Analyze Artifacts

```bash
# Dump process executable
vol3 -f memory.raw windows.pslist --pid 1234 --dump

# Dump all DLLs from process
vol3 -f memory.raw windows.dlllist --pid 1234 --dump

# Extract strings from dumped regions
strings -a -n 6 pid.1234.*.dmp | grep -iE "http|cmd|powershell|password"
floss pid.1234.*.dmp

# Disassemble in Ghidra
analyzeHeadless /tmp/project MemDump \
    -import pid.1234.malfind.0x10000.dmp \
    -processor x86:LE:64:default
```

## YARA Rule

```yara
rule Memory_Injected_PE {
    meta:
        description = "Detects PE files injected into process memory"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1055"
        severity = "high"
    strings:
        $mz = { 4D 5A }
        $pe = { 50 45 00 00 }
        $dos = "This program cannot be run in DOS mode"
        $rwx = { 00 00 00 40 }  // PAGE_EXECUTE_READWRITE
    condition:
        $mz at 0 and $pe and ($dos or $rwx)
}
```

## Detection

```yaml
title: Malware Memory Forensics Detection
id: 9cf811f0-6647-4bd1-bda4-dc28f6195935
status: experimental
description: Detects suspicious activity related to performing malware memory forensics techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*malware*"
  condition: selection
level: high
tags:
  - attack.t1055
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] Memory acquired with verified integrity (hash)
- [ ] Process listing cross-referenced (pslist vs psscan)
- [ ] Injected code regions detected and dumped (malfind)
- [ ] YARA scan completed against process and kernel memory
- [ ] Network connections extracted and mapped to processes
- [ ] Suspicious DLLs and handles investigated
- [ ] Findings mapped to MITRE ATT&CK (T1055, T1014, T1134)

## References

- [Volatility 3 Documentation](https://volatility3.readthedocs.io/)
- [MITRE ATT&CK T1055 — Process Injection](https://attack.mitre.org/techniques/T1055/)
- [LiME — Linux Memory Extractor](https://github.com/504ensicsLabs/LiME)
- [The Art of Memory Forensics](https://www.wiley.com/en-us/The+Art+of+Memory+Forensics-p-9781118825099)
