Incident Response and Digital Forensics
Memory Analysis
In a memory image captured before system shutdown, we examine malicious code that never touched the disk and active connections. Attacks that leave no trace on disk can be detected here.
What it is
A system's memory contains the processes running at that moment, open network connections, and the command lines of those processes. Some attack tools operate only in memory and leave no trace on disk. This evidence is lost when the system shuts down. Therefore, RFC 3227 recommends collecting evidence starting with the most volatile.
Scope
- Acquiring memory images from running systems and virtual machines
- Detecting hidden or process-injected code
- Extracting active and recently closed network connections
- Searching for traces of credential theft
- Transferring code extracted from memory to malware analysis
The need
When organizations need it
- When EDR reports suspicious behavior in a process but no malicious file is found on disk.
- When a server is observed connecting to an unknown address at regular intervals.
- Before shutting down a system where the attacker is believed to still be active.
Method
How we work
-
Acquisition
We capture memory while the system is running. On virtual machines, we use a snapshot without stopping the system.
-
Integrity
We record the image hash and enter it into the chain of custody record.
-
Examination
We compare processes, connections, and loaded modules with a normal system. Deviations are mapped to MITRE ATT&CK techniques.
-
Spread
We search other systems for the indicators we find. This reveals where else the same code is running.
Outcome
What you have at the end
You see attacker activity that is invisible on disk, including the process and connection used. You have indicators to search for the same trace on other systems.
Frequently asked questions
Can memory be analyzed if the system has been restarted?
A restart erases evidence in memory. However, memory segments written to disk, such as the page file and hibernation file, can still be examined.
Does capturing memory affect the system?
A short-term load occurs. The image is as large as the system's memory, so sufficient storage is arranged in advance.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting