Presentation Title: Full Process Reconstitution from Memory
Presentation Details:

Recently there has been a lot of discussion about using memory forensics during incident response as part of an investigation; however, memory forensics can also be leveraged when doing malware analysis in a lab. The only difference between the two use cases is how the binary is acquired. Using memory forensics a malicious process or the malicious portions of a process can be captured from memory without using a debugger; injecting into the process; or relying on any APIs to enumerate, address, and acquire the address space.

This talk will focus on the these forensic techniques and a demonstration of pulling a malicious process or portions of a process from both live memory and previously acquired memory images. The benefits of this approach are numerous but include

a.) the ability to analyze binaries after unpacking (assuming the binary is unpacked at initial runtime and not on a functional basis)
b.) the ability to analyze binaries that exist only in memory and not on disk
c.) the ability to get a full process view of malware including all subsequent binaries loaded and
d.) the ability to leverage other process metadata obtained from memory to include environment, user/owner of the process, start time, and all handles. It is important to realize that all parsing of memory, virtual to physical address translation, and pagefile translation is being done using “raw”, non-API based methods.

About Peter

Peter Silberman works at MANDIANT as an engineer on the agent team. For a number of years, Peter has specialized in offensive and defensive kernel technologies, reverse engineering, and vulnerability discovery. He enjoys automating solutions to problems both in the domain of reverse engineering and rootkit analysis. Peter now spends most of his time researching solutions to memory forensic problems. Peter is the co-author and teacher of “Advanced Memory Forensics in Incident Response”. Although he is college educated, Peter does not believe formal education should interfere with learning.