Fileless malware makes cyber attacks even more difficult to detect nowadays.Simple signatures are too easy for an intruder to circumvent. Cyber criminals can also program fileless malware to gain persistence after it was written directly to RAM. Fileless malware is not a revolutionary approach, However 2016 certainly saw a dramatic rise in this type of attack as the criminals worked to perfect it. This talk is about triage a system potentially impacted by fileless malware by memory analysis.

1. How do I know I’m secure?

2. Are my devices Infected?

3. What if!

5. Incident Response

6. What if!?!

7. Or…

8. We need to analyze malware

9. Malware become smarter
Encrypted Network Communications(c&c)
Persistence (Auto Start)
Privilege Escalation (run as admin)
Data exfiltration
Evades modern antivirus

10. Fileless Malware

11. Case Study

14. We need a sample
Contagio Malware Dump: Free; password required
Das Malwerk: Free
FreeTrojanBotnet: Free; registration required
KernelMode.info: Free; registration required
MalShare: Free; registration required
Malware.lu’s AVCaesar: Free; registration required
MalwareBlacklist: Free; registration required
Malware DB: Free
Malwr: Free; registration required
Open Malware: Free
theZoo aka Malware DB: Free
Virusign: Free
VirusShare: Free

15. Let's get infected

16. Win7x86/64

17. Before infected
1.Regshot
2.Memory dump

18. After infection
Compare regshot

21. But....

22. The memory remains.

23. Memory dump
Vmware (Fusion/Workstation/Server/Player) — .vmem = raw memory. (.vmss and .vmsn = contain
memory image) (each snapshot will have its own .vmem file)
Microsoft Hyper-V — .bin = raw memory image
Parallels — .mem = raw memory image
VirtualBox — .sav = partial memory image (Memory file only holds memory actively in use, not the
entire amount of memory assigned to the virtual machine.

24. Volatility

32. Shellcode loading….

33. But....

34. The memory remains.

41. vol.py -f afterinfected.raw --profile=Win7SP1x86 printkey --
key="SoftwareMicrosoftWindowsCurrentVersionRun"
vol.py -f afterinfected.raw --profile=Win7SP1x86 pslist
vol.py -f afterinfected.raw --profile=Win7SP1x86 malfind -p 3312
vol.py -f infected.raw --profile=Win7SP1x86 envars -p 3276
vol.py -f infected.raw --profile=Win7SP1x86 hivedump -o 0x8ced15c0
vol.py -f infected.raw --profile=Win7SP1x86 hivelist

42. Yara

43. dump the memory.

45. Writing code for fun and food. Security enthusiastic.
@nahidupa
Nahidul Kibria
Co-Founder, Beetles