Memory Analysis using Volatility - psxview
Volatility is a tool used for extraction of digital artifacts from volatile memory(RAM) samples. Volatility uses a set of plugins that can be used to extract these artifacts in a time efficient and quick manner.
psxview – a volatility plugin that find hidden processes with various process listings. This plugin compares the active processes indicated within psActiveProcessHead with any other possible sources within the memory image.
This combines the output of plugins pslist and psscan. Some malware manipulates the EPROCESS structure, which is part of the stealth technique they use. A malicious sample can detach itself from the active process link which has FLINK (forward link) and BLINK (backward link) that is use by Windows EPROCESS structure to link the all processes.
From an incident response perspective, the volatile data residing inside the system’s memory contains rich information such as passwords, credentials, network connections, malware intrusions, registry hives, and etc. that can be a valuable source of evidence and is not typically stored on the local hard disk. This is one of the investigator’s favorite data sources to perform digital forensics on, and knowing the right tool to dump memory is a must.
Using the Volatility psxview plugin, we can see if the process appears in pslist and psscan plugin by the boolean value True. A False within the column indicates that the process is not found in that area.
This allows the analyst to review the list and determine if there’s a legitimate reason for that.
Our syntax will be like: Vol.exe -f <memory_dump> –profile=<OS_version> psxview
