DeepSec 2021 Talk: I Will Hide, You Come And Seek – Discovering The Unknown in Known Malwares using Memory Forensics – Shyam Sundar Ramaswami
Malware analysis is a key phase to extract IOCs like domains, ip, mutex and other signatures. What if malware knows what online sandboxes look for and what tools look for, decides to “showcase only 90%” and hide the rest? Well, Memory forensics comes to our rescue. This was tried and tested with a lot of samples during the pandemic phase and was aided in extracting a lot of hidden process, domains, urls and even ip. This is what the talk covers: Talk about the traditional malware analysis process Introduction to memory forensics and why Introducing tools like Volatility and Rekall Running Orcus RAT, Agent Tesla and Sodinobki Ransomware malwares usingt traditional methods like Any.run online sandbox and malware runs Playing a game by capturing memory of the infected machine by invoking WMI module and