Memory forensics

RAM holds what the disk doesn’t: running processes, active network connections, injected code, encryption keys, recent commands, and fileless malware that never touches disk. It’s the most volatile evidence and so it’s captured first.

Why memory

- fileless malware / in-memory injection (see mal-evasion) isn't on disk
- processes and loaded DLLs, network connections and ports at the moment of compromise
- credentials, decryption keys, commands, and artifacts in clear text
- order of volatility: RAM > disk -> capture BEFORE powering off/aggressively isolating

Acquisition

Windows   WinPmem, Magnet RAM Capture, FTK Imager (RAM dump)
Linux     AVML (Microsoft), LiME (kernel module)
macOS     version-specific tools
# the dump minimally alters the system; document time and tool (dfir-cadena)
# do NOT power off if you want memory: it's lost when power is cut

Analysis with Volatility 3

vol -f mem.raw windows.pslist       # processes
vol -f mem.raw windows.pstree       # process tree (suspicious children)
vol -f mem.raw windows.psscan       # hidden/terminated processes (carving)
vol -f mem.raw windows.netscan      # network connections (C2, see mal-c2)
vol -f mem.raw windows.malfind      # injected memory regions (RWX, no file)
vol -f mem.raw windows.cmdline      # process command lines
vol -f mem.raw windows.dlllist      # loaded DLLs (sideloading)
vol -f mem.raw windows.hashdump     # credential hashes (if in memory)

What to look for (indicators)

- processes with an anomalous parent (e.g. powershell child of winword) -> see dfir-win-art
- malfind: code injected into legitimate processes (hollowing, see mal-evasion)
- netscan: connections to C2/odd domains; processes listening on unusual ports
- malware-family handles/mutexes; strings/commands in clear text
- pslist vs psscan discrepancies (processes hidden by rootkits)

Integration

- extract suspicious processes/DLLs from memory and pass them to triage (dfir-triage)
- correlate connections with network forensics (dfir-red) and timestamps with the timeline
- found IOCs (hashes, IPs, domains) feed hunting (def-hunting) and TI (cti-ioc)

Blue Team / DFIR

Capture RAM as early as possible and before destructive actions; it’s the fastest-vanishing evidence.
Volatility/MemProcFS as standard tools; profile the correct OS version.
Hunting for injection (malfind) and C2 (netscan) is high value against evasive malware (Defense Evasion).

Real-world cases

Memory forensics is the way to detect fileless malware and C2 frameworks in RAM (Cobalt Strike beacons).
RAM dumps have recovered BitLocker/encryption keys and credentials in real incidents.
Rootkits detected by pslist/psscan discrepancies in memory analysis.

Testing checklist

Capture RAM before powering off/aggressive isolation (order of volatility)
Document tool, time, and hash of the dump (Chain of custody)
pslist/pstree/psscan: anomalous processes and hierarchy
malfind: code injection (RWX with no file)
netscan: connections to C2 (Command & Control)
cmdline/dlllist: commands and sideloading
Extract suspects → triage (Malware triage); IOCs → hunting/TI