Investigating Malware Using Memory Forensics - A Practical Approach

Investigating Malware Using Memory Forensics - A Practical Approach
Monnappa KA • Info Security Investigator - Cisco CSIRT • Author of the Book: Learning Malware Analysis • Member of Black Hat Review Board • Co-founder Cysinfo Security Community • Creator of Limon Sandbox • Winner of Volatility Plugin Contest 2016
Memory Acquisition - Dumping the memory of a target machine to disk
Memory Analysis of Infected System (KeyBase Malware)
Memory Analysis of Infected System (Darkcomet RAT)
Investigating Hollow Process Injection
Investigating Rootkits
Memory Analysis of ZeroAccess Rootkit
Example - Memory Analysis of Necurs Rootkit