analyzing-malware-in-memory-with-volatility3

Name: analyzing-malware-in-memory-with-volatility3
Author: meltedinhex

18stars5forks

How to install analyzing-malware-in-memory-with-volatility3?

meltedinhex/analyst-ai-pack/analyzing-malware-in-memory-with-volatility3

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malware-in-memory-with-volatility3

Installs into the current project.

Summary

Analyzes a memory image with Volatility 3 to find malware: rogue processes,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malware in Memory with Volatility 3
2
3	## When to Use
4
5	- You have a RAM image from a suspected-infected host and need to find malicious activity.
6	- Disk artifacts are insufficient (fileless/in-memory malware) and you need volatile evidence.
7	- You want to extract injected code, command lines, or network connections for analysis.
8
9	Do not use Volatility plugins blindly without an order of investigation — start broad
10	(processes, network) before deep per-process dumps.
11
12	## Prerequisites
13
14	- Volatility 3 (`pip install volatility3`) with appropriate symbol tables.
15	- A memory image acquired with a sound tool (WinPmem, LiME, or hypervisor snapshot).
16	- Knowledge of the source OS/version to select the right symbols.
17
18	## Safety & Handling
19
20	- Work on a copy of the image; preserve the original with a recorded hash.
21	- Treat any dumped executable region as a live sample — store and handle it accordingly.
22
23	## Workflow
24
25	### Step 1: Enumerate processes and spot anomalies
26
27	```bash
28	vol -f memory.raw windows.pslist
29	vol -f memory.raw windows.pstree
30	```
31
32	Look for unusual parents (Word spawning cmd/powershell), masquerading names
33	(`scvhost.exe`), processes with no disk path, and orphaned children.
34
35	### Step 2: Hunt injected code
36
37	```bash
38	vol -f memory.raw windows.malfind
39	```
40
41	`malfind` flags private, executable, RWX regions with no backing file — classic injection.
42	Note the PID and base address for dumping.
43
44	### Step 3: Review network connections
45
46	```bash
47	vol -f memory.raw windows.netscan
48	```
49
50	Correlate listening/established connections with suspicious PIDs and the C2 endpoints from
51	other analysis.
52
53	### Step 4: Check modules, handles, and persistence
54
55	Examine loaded DLLs (`windows.dlllist`), services, and registry (`windows.registry.*`) for
56	persistence and unexpected modules.
57
58	### Step 5: Dump artifacts
59
60	Dump the suspicious process or injected region for static/RE analysis:
61
62	```bash
63	vol -f memory.raw windows.dumpfiles --pid <pid>
64	```
65
66	The helper script parses Volatility's JSON renderer output to highlight injection candidates.
67
68	```bash
69	vol -f memory.raw -r json windows.malfind \| python scripts/analyst.py malfind -
70	```
71
72	## Validation
73
74	- Injection candidates from `malfind` correspond to anomalous processes from `pstree`.
75	- Network connections map to known C2 or the sample's extracted config.
76	- Dumped regions disassemble into meaningful code, not random bytes.
77
78	## Pitfalls
79
80	- Wrong symbols/profile producing empty or garbage results — confirm OS build first.
81	- Treating every RWX region as malicious; some legitimate JIT engines use RWX. Corroborate.
82	- Forgetting to hash and preserve the original image before analysis.
83
84	## References
85
86	- See [`references/api-reference.md`](references/api-reference.md) for the malfind output
87	parser.
88	- Volatility 3 documentation and memory-forensics concepts (linked in frontmatter).

People who liked this also viewed

6 picks

Type

analyzing-malware-in-memory-with-volatility3

18stars5forks

View on GitHub

How to install analyzing-malware-in-memory-with-volatility3?

meltedinhex/analyst-ai-pack/analyzing-malware-in-memory-with-volatility3

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-malware-in-memory-with-volatility3

Installs into the current project.

Summary

Analyzes a memory image with Volatility 3 to find malware: rogue processes,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Malware in Memory with Volatility 3
2
3	## When to Use
4
5	- You have a RAM image from a suspected-infected host and need to find malicious activity.
6	- Disk artifacts are insufficient (fileless/in-memory malware) and you need volatile evidence.
7	- You want to extract injected code, command lines, or network connections for analysis.
8
9	Do not use Volatility plugins blindly without an order of investigation — start broad
10	(processes, network) before deep per-process dumps.
11
12	## Prerequisites
13
14	- Volatility 3 (`pip install volatility3`) with appropriate symbol tables.
15	- A memory image acquired with a sound tool (WinPmem, LiME, or hypervisor snapshot).
16	- Knowledge of the source OS/version to select the right symbols.
17
18	## Safety & Handling
19
20	- Work on a copy of the image; preserve the original with a recorded hash.
21	- Treat any dumped executable region as a live sample — store and handle it accordingly.
22
23	## Workflow
24
25	### Step 1: Enumerate processes and spot anomalies
26
27	```bash
28	vol -f memory.raw windows.pslist
29	vol -f memory.raw windows.pstree
30	```
31
32	Look for unusual parents (Word spawning cmd/powershell), masquerading names
33	(`scvhost.exe`), processes with no disk path, and orphaned children.
34
35	### Step 2: Hunt injected code
36
37	```bash
38	vol -f memory.raw windows.malfind
39	```
40
41	`malfind` flags private, executable, RWX regions with no backing file — classic injection.
42	Note the PID and base address for dumping.
43
44	### Step 3: Review network connections
45
46	```bash
47	vol -f memory.raw windows.netscan
48	```
49
50	Correlate listening/established connections with suspicious PIDs and the C2 endpoints from
51	other analysis.
52
53	### Step 4: Check modules, handles, and persistence
54
55	Examine loaded DLLs (`windows.dlllist`), services, and registry (`windows.registry.*`) for
56	persistence and unexpected modules.
57
58	### Step 5: Dump artifacts
59
60	Dump the suspicious process or injected region for static/RE analysis:
61
62	```bash
63	vol -f memory.raw windows.dumpfiles --pid <pid>
64	```
65
66	The helper script parses Volatility's JSON renderer output to highlight injection candidates.
67
68	```bash
69	vol -f memory.raw -r json windows.malfind \| python scripts/analyst.py malfind -
70	```
71
72	## Validation
73
74	- Injection candidates from `malfind` correspond to anomalous processes from `pstree`.
75	- Network connections map to known C2 or the sample's extracted config.
76	- Dumped regions disassemble into meaningful code, not random bytes.
77
78	## Pitfalls
79
80	- Wrong symbols/profile producing empty or garbage results — confirm OS build first.
81	- Treating every RWX region as malicious; some legitimate JIT engines use RWX. Corroborate.
82	- Forgetting to hash and preserve the original image before analysis.
83
84	## References
85
86	- See [`references/api-reference.md`](references/api-reference.md) for the malfind output
87	parser.
88	- Volatility 3 documentation and memory-forensics concepts (linked in frontmatter).

People who liked this also viewed

6 picks

Type