API tools faq
paste
Advertisement
unixfreaxjp

#Malware memory Analysis w/ Volatility (#Tips)

unixfreaxjp
Apr 23rd, 2012
252
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.63 KB | None | 0 0
raw download clone embed print report
  1. root@remnux:~/unixfreaxjp# uname -a; date
  2. Linux remnux 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:50:42 UTC 2011 i686 i686 i386 GNU/Linux
  3. Mon Apr 23 09:24:54 EDT 2012
  4.  
  5. # This is my private note for testing Remnux3.0's Volatile.
  6. # Be free to take a look for your reference too, hope will
  7. # be helpful. - unixfreaxjp -
  8.  
  9. /* Took the below snapshot to take the RAT nsapshot of memory
  10. * by win32dd */
  11. =============================================================
  12. C:\>win32dd /f ./test.dmp
  13. =============================================================
  14. win32dd - 1.3.1.20100417 - (Community Edition)
  15. Kernel land physical memory acquisition
  16. Copyright (C) 2007 - 2010, Matthieu Suiche <http://www.msuiche.net>
  17. Copyright (C) 2009 - 2010, MoonSols <http://www.moonsols.com>
  18.  
  19. Name Value
  20. ---- -----
  21. File type: Raw memory dump file
  22. Acquisition method: PFN Mapping
  23. Content: Memory manager physical memory block
  24.  
  25. Destination path: ./test.dmp
  26.  
  27. O.S. Version: Microsoft Windows XP Professional Service Pack 1 (build 2600)
  28. Computer name: UNIXFREAXJP-RAT
  29.  
  30. Physical memory in use: 58%
  31. Physical memory size: 776624 Kb ( 758 Mb)
  32. Physical memory available: 323368 Kb ( 315 Mb)
  33.  
  34. Paging file size: 1758228 Kb ( 1717 Mb)
  35. Paging file available: 1357412 Kb ( 1325 Mb)
  36.  
  37. Virtual memory size: 2097024 Kb ( 2047 Mb)
  38. Virtual memory available: 2082668 Kb ( 2033 Mb)
  39.  
  40. Extented memory available: 0 Kb ( 0 Mb)
  41.  
  42. Physical page size: 4096 bytes
  43. Minimum physical address: 0x0000000000002000
  44. Maximum physical address: 0x000000002F6DF000
  45.  
  46. Address space size: 795738112 bytes ( 777088 Kb)
  47.  
  48. --> Are you sure you want to continue? [y/n] y
  49.  
  50. Acquisition started at: [23/4/2012 (DD/MM/YYYY) 11:13:7 (UTC)]
  51.  
  52. Processing....Done.
  53.  
  54. Acquisition finished at: [2012-04-23 (YYYY-MM-DD) 11:14:15 (UTC)]
  55. Time elapsed: 1:08 minutes:seconds (68 secs)
  56.  
  57. Created file size: 795738112 bytes ( 758 Mb)
  58.  
  59. NtStatus (troubleshooting): 0x00000000
  60. Total of written pages: 194173
  61. Total of inacessible pages: 0
  62. Total of accessible pages: 194173
  63.  
  64. Physical memory in use: 58%
  65. Physical memory size: 776624 Kb ( 758 Mb)
  66. Physical memory available: 319472 Kb ( 311 Mb)
  67.  
  68. Paging file size: 1758228 Kb ( 1717 Mb)
  69. Paging file available: 1353564 Kb ( 1321 Mb)
  70.  
  71. Virtual memory size: 2097024 Kb ( 2047 Mb)
  72. Virtual memory available: 2082668 Kb ( 2033 Mb)
  73.  
  74. Extented memory available: 0 Kb ( 0 Mb)
  75.  
  76. Physical page size: 4096 bytes
  77. Minimum physical address: 0x0000000000002000
  78. Maximum physical address: 0x000000002F6DF000
  79.  
  80. Address space size: 795738112 bytes ( 777088 Kb)
  81.  
  82.  
  83.  
  84. /* Volatile */
  85.  
  86.  
  87.  
  88. =============================================================
  89. root@remnux:~/unixfreaxjp# vol -f test.dmp imageinfo
  90. =============================================================
  91. Determining profile based on KDBG search...
  92.  
  93. Suggested Profile(s) : WinXPSP3x86, WinXPSP2x86 (Instantiated with WinXPSP2x86)
  94. AS Layer1 : JKIA32PagedMemory (Kernel AS)
  95. AS Layer2 : FileAddressSpace (/media/linux/home/unixfreaxjp/test.dmp)
  96. PAE type : No PAE
  97. DTB : 0x39000
  98. KDBG : 0x805407e0L
  99. KPCR : 0xffdff000L
  100. KUSER_SHARED_DATA : 0xffdf0000L
  101. Image date and time : 2012-04-23 11:13:07
  102. Image local date and time : 2012-04-23 11:13:07
  103. Number of Processors : 1
  104. Image Type : Service Pack 1
  105. root@remnux:~/unixfreaxjp#
  106.  
  107.  
  108. =============================================================
  109. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 pslist -P
  110. =============================================================
  111. Offset(P) Name PID PPID Thds Hnds Time
  112. ---------- -------------------- ------ ------ ------ ------ -------------------
  113. 0x037c87c8 System 4 0 56 295 1970-01-01 00:00:00
  114. 0x035d2998 smss.exe 640 4 3 21 2012-04-23 07:07:52
  115. 0x035efda8 csrss.exe 696 640 13 497 2012-04-23 07:07:57
  116. 0x035ccda8 winlogon.exe 720 640 19 516 2012-04-23 07:08:00
  117. 0x030bada8 services.exe 764 720 16 298 2012-04-23 07:08:05
  118. 0x030f3ba0 lsass.exe 776 720 19 325 2012-04-23 07:08:05
  119. 0x030a8998 ibmpmsvc.exe 920 764 4 36 2012-04-23 07:08:09
  120. 0x03096998 svchost.exe 1000 764 11 237 2012-04-23 07:08:26
  121. 0x03046380 svchost.exe 1036 764 86 1351 2012-04-23 07:08:27
  122. 0x0303cda8 ACS.EXE 1164 764 15 188 2012-04-23 07:08:27
  123. 0x03025380 svchost.exe 1296 764 8 86 2012-04-23 07:08:33
  124. 0x03021bb0 svchost.exe 1352 764 19 156 2012-04-23 07:08:35
  125. 0x032e1da8 spoolsv.exe 1728 764 16 196 2012-04-23 07:08:39
  126. 0x032dcba0 rrpcsb.exe 1844 764 4 103 2012-04-23 07:08:40
  127. 0x03267da8 python.exe 148 1844 0 ------ 2012-04-23 07:08:43
  128. 0x0326cda8 conime.exe 212 148 1 34 2012-04-23 07:08:44
  129. 0x032c7958 PGPserv.exe 292 764 6 111 2012-04-23 07:08:46
  130. 0x032629e8 QCONSVC.EXE 416 764 3 55 2012-04-23 07:08:48
  131. 0x032c2da8 svchost.exe 472 764 5 108 2012-04-23 07:08:48
  132. 0x0325d958 wdfmgr.exe 492 764 4 58 2012-04-23 07:08:48
  133. 0x02e7b348 python.exe 1096 1844 0 ------ 2012-04-23 07:08:51
  134. 0x0304f020 CAPRPCSK.EXE 1608 1728 1 15 2012-04-23 07:10:40
  135. 0x032ae9c0 CAPPSWK.EXE 1624 1728 0 ------ 2012-04-23 07:10:40
  136. 0x03747668 CAPPSWK.EXE 1896 1624 3 83 2012-04-23 07:10:42
  137. 0x02e79b30 rbmonitor.exe 1936 1036 7 195 2012-04-23 07:19:57
  138. 0x03118020 explorer.exe 1464 1156 13 783 2012-04-23 07:19:58
  139. 0x02e829b8 tp4serv.exe 1584 1464 3 41 2012-04-23 07:20:09
  140. 0x03074020 igfxtray.exe 1620 1464 1 68 2012-04-23 07:20:09
  141. 0x03247470 hkcmd.exe 312 1464 2 76 2012-04-23 07:20:10
  142. 0x03053020 TpShocks.exe 1056 1464 2 36 2012-04-23 07:20:11
  143. 0x036e0da8 TPHKMGR.exe 608 1464 5 120 2012-04-23 07:20:12
  144. 0x02e449a0 rundll32.exe 1292 1464 2 35 2012-04-23 07:20:12
  145. 0x03261020 TPONSCR.exe 1104 608 1 28 2012-04-23 07:20:14
  146. 0x0301d818 TpScrex.exe 1184 608 1 28 2012-04-23 07:20:14
  147. 0x02e71570 ibmprc.exe 1144 1464 2 27 2012-04-23 07:20:14
  148. 0x036d0598 rundll32.exe 1188 1464 1 45 2012-04-23 07:20:14
  149. 0x036d4020 ctfmon.exe 2020 1464 1 56 2012-04-23 07:20:18
  150. 0x02e379b8 WDSM.exe 180 1464 1 103 2012-04-23 07:20:19
  151. 0x03211818 Maruo.exe 2252 1464 1 28 2012-04-23 07:20:33
  152. 0x032dbc58 Maruo.exe 2348 2252 1 31 2012-04-23 07:20:38
  153. 0x031d15a0 firefox.exe 3916 1464 34 807 2012-04-23 08:28:05
  154. 0x031ec020 putty.exe 2356 1464 5 87 2012-04-23 11:02:04
  155. 0x02c54020 Maruo.exe 2360 1464 1 74 2012-04-23 11:05:23
  156. 0x031c49c8 cmd.exe 3408 1464 1 20 2012-04-23 11:07:23
  157. 0x02c74020 win32dd.exe 3372 3408 1 23 2012-04-23 11:12:54
  158.  
  159. =============================================================
  160. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 pstree
  161. =============================================================
  162. Name Pid PPid Thds Hnds Time
  163. 0x83BC87C8:System 4 0 56 295 1970-01-01 00:00:00
  164. . 0x839D2998:smss.exe 640 4 3 21 2012-04-23 07:07:52
  165. .. 0x839EFDA8:csrss.exe 696 640 13 497 2012-04-23 07:07:57
  166. .. 0x839CCDA8:winlogon.exe 720 640 19 516 2012-04-23 07:08:00
  167. ... 0x834F3BA0:lsass.exe 776 720 19 325 2012-04-23 07:08:05
  168. ... 0x834BADA8:services.exe 764 720 16 298 2012-04-23 07:08:05
  169. .... 0x8343CDA8:ACS.EXE 1164 764 15 188 2012-04-23 07:08:27
  170. .... 0x83425380:svchost.exe 1296 764 8 86 2012-04-23 07:08:33
  171. .... 0x834A8998:ibmpmsvc.exe 920 764 4 36 2012-04-23 07:08:09
  172. .... 0x836629E8:QCONSVC.EXE 416 764 3 55 2012-04-23 07:08:48
  173. .... 0x836C7958:PGPserv.exe 292 764 6 111 2012-04-23 07:08:46
  174. .... 0x836DCBA0:rrpcsb.exe 1844 764 4 103 2012-04-23 07:08:40
  175. ..... 0x83667DA8:python.exe 148 1844 0 ------ 2012-04-23 07:08:43
  176. ...... 0x8366CDA8:conime.exe 212 148 1 34 2012-04-23 07:08:44
  177. ..... 0x8327B348:python.exe 1096 1844 0 ------ 2012-04-23 07:08:51
  178. .... 0x836E1DA8:spoolsv.exe 1728 764 16 196 2012-04-23 07:08:39
  179. ..... 0x836AE9C0:CAPPSWK.EXE 1624 1728 0 ------ 2012-04-23 07:10:40
  180. ...... 0x83B47668:CAPPSWK.EXE 1896 1624 3 83 2012-04-23 07:10:42
  181. ..... 0x8344F020:CAPRPCSK.EXE 1608 1728 1 15 2012-04-23 07:10:40
  182. .... 0x83421BB0:svchost.exe 1352 764 19 156 2012-04-23 07:08:35
  183. .... 0x83446380:svchost.exe 1036 764 86 1351 2012-04-23 07:08:27
  184. ..... 0x83279B30:rbmonitor.exe 1936 1036 7 195 2012-04-23 07:19:57
  185. .... 0x836C2DA8:svchost.exe 472 764 5 108 2012-04-23 07:08:48
  186. .... 0x83496998:svchost.exe 1000 764 11 237 2012-04-23 07:08:26
  187. .... 0x8365D958:wdfmgr.exe 492 764 4 58 2012-04-23 07:08:48
  188. 0x83518020:explorer.exe 1464 1156 13 783 2012-04-23 07:19:58
  189. . 0x832449A0:rundll32.exe 1292 1464 2 35 2012-04-23 07:20:12
  190. . 0x83647470:hkcmd.exe 312 1464 2 76 2012-04-23 07:20:10
  191. . 0x832829B8:tp4serv.exe 1584 1464 3 41 2012-04-23 07:20:09
  192. . 0x832379B8:WDSM.exe 180 1464 1 103 2012-04-23 07:20:19
  193. . 0x835D15A0:firefox.exe 3916 1464 34 807 2012-04-23 08:28:05
  194. . 0x83453020:TpShocks.exe 1056 1464 2 36 2012-04-23 07:20:11
  195. . 0x83611818:Maruo.exe 2252 1464 1 28 2012-04-23 07:20:33
  196. .. 0x836DBC58:Maruo.exe 2348 2252 1 31 2012-04-23 07:20:38
  197. . 0x83AD0598:rundll32.exe 1188 1464 1 45 2012-04-23 07:20:14
  198. . 0x83054020:Maruo.exe 2360 1464 1 74 2012-04-23 11:05:23
  199. . 0x83AE0DA8:TPHKMGR.exe 608 1464 5 120 2012-04-23 07:20:12
  200. .. 0x83661020:TPONSCR.exe 1104 608 1 28 2012-04-23 07:20:14
  201. .. 0x8341D818:TpScrex.exe 1184 608 1 28 2012-04-23 07:20:14
  202. . 0x83AD4020:ctfmon.exe 2020 1464 1 56 2012-04-23 07:20:18
  203. . 0x835C49C8:cmd.exe 3408 1464 1 20 2012-04-23 11:07:23
  204. .. 0x83074020:win32dd.exe 3372 3408 1 23 2012-04-23 11:12:54
  205. . 0x835EC020:putty.exe 2356 1464 5 87 2012-04-23 11:02:04
  206. . 0x83271570:ibmprc.exe 1144 1464 2 27 2012-04-23 07:20:14
  207. . 0x83474020:igfxtray.exe 1620 1464 1 68 2012-04-23 07:20:09
  208.  
  209.  
  210. =============================================================
  211. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 dlllist
  212. =============================================================
  213. :
  214. :
  215. cmd.exe pid: 3408
  216. Command line : "C:\WINDOWS\system32\cmd.exe"
  217. Service Pack 1
  218.  
  219. Base Size Path
  220. 0x4ad00000 0x076000 C:\WINDOWS\system32\cmd.exe
  221. 0x77f50000 0x0a7000 C:\WINDOWS\System32\ntdll.dll
  222. 0x77e20000 0x124000 C:\WINDOWS\system32\kernel32.dll
  223. 0x77bc0000 0x053000 C:\WINDOWS\system32\msvcrt.dll
  224. 0x77cf0000 0x08c000 C:\WINDOWS\system32\USER32.dll
  225. 0x7f000000 0x042000 C:\WINDOWS\system32\GDI32.dll
  226. 0x77d80000 0x09b000 C:\WINDOWS\system32\ADVAPI32.dll
  227. 0x78000000 0x087000 C:\WINDOWS\system32\RPCRT4.dll
  228. 0x762e0000 0x01c000 C:\WINDOWS\System32\IMM32.DLL
  229. 0x60740000 0x008000 C:\WINDOWS\system32\LPK.DLL
  230. 0x72ef0000 0x05a000 C:\WINDOWS\system32\USP10.dll
  231. 0x10000000 0x00d000 C:\WINDOWS\system32\OCMAPIHK.DLL
  232. 0x75e90000 0x01e000 C:\WINDOWS\system32\Apphelp.dll
  233. ************************************************************************
  234. win32dd.exe pid: 3372
  235. Command line : win32dd /f ./test.dmp
  236. Service Pack 1
  237.  
  238. Base Size Path
  239. 0x00400000 0x01a000 C:\transit\@@DEV\@@@ANALYST\moonsols\win32dd.exe
  240. 0x77f50000 0x0a7000 C:\WINDOWS\System32\ntdll.dll
  241. 0x77e20000 0x124000 C:\WINDOWS\system32\kernel32.dll
  242. 0x77cf0000 0x08c000 C:\WINDOWS\system32\USER32.dll
  243. 0x7f000000 0x042000 C:\WINDOWS\system32\GDI32.dll
  244. 0x77d80000 0x09b000 C:\WINDOWS\system32\ADVAPI32.dll
  245. 0x78000000 0x087000 C:\WINDOWS\system32\RPCRT4.dll
  246. 0x719e0000 0x014000 C:\WINDOWS\System32\WS2_32.dll
  247. 0x77bc0000 0x053000 C:\WINDOWS\system32\msvcrt.dll
  248. 0x719d0000 0x008000 C:\WINDOWS\System32\WS2HELP.dll
  249. 0x74a10000 0x007000 C:\WINDOWS\System32\POWRPROF.dll
  250. 0x762e0000 0x01c000 C:\WINDOWS\System32\IMM32.DLL
  251. 0x60740000 0x008000 C:\WINDOWS\System32\LPK.DLL
  252. 0x72ef0000 0x05a000 C:\WINDOWS\System32\USP10.dll
  253. 0x10000000 0x00d000 C:\WINDOWS\System32\OCMAPIHK.DLL
  254.  
  255.  
  256. =============================================================
  257. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 connections -P
  258. =============================================================
  259. Offset(P) Local Address Remote Address Pid
  260. ---------- ------------------------- ------------------------- ------
  261. root@remnux:~/unixfreaxjp#
  262.  
  263. =============================================================
  264. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 sockets -P
  265. =============================================================
  266. Offset(P) PID Port Proto Address Create Time
  267. ---------- ------ ------ ------------------- -------------- --------------------------
  268.  
  269.  
  270. =============================================================
  271. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 sockscan
  272. =============================================================
  273. Offset PID Port Proto Address Create Time
  274. ---------- ------ ------ ------------------- -------------- --------------------------
  275. 0x0b3b7be4 945014 17774 25185 - 116.105.111.110 -
  276.  
  277.  
  278. =============================================================
  279. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 connscan
  280. =============================================================
  281. Offset Local Address Remote Address Pid
  282. ---------- ------------------------- ------------------------- ------
  283. 0x02c36008 192.168.7.2:1473 173.194.38.106:80 3916
  284. 0x02c582a8 192.168.7.2:1234 173.194.38.97:80 45219846
  285. 0x02e1fae0 192.168.7.2:1268 173.194.38.102:443 3916
  286. 0x02e22aa0 192.168.7.2:1126 199.59.148.87:443 3916
  287. 0x02e3c9d0 192.168.7.2:1201 173.236.192.217:80 3916
  288. 0x02e53838 192.168.7.2:1408 192.168.7.1:22 2356
  289. 0x02efc008 192.168.7.2:1186 74.125.235.133:443 3916
  290. 0x02f71008 192.168.7.2:1471 207.171.189.80:80 3916
  291. 0x02f9d008 192.168.7.2:1460 199.59.150.41:443 3916
  292. 0x02fc0008 192.168.7.2:1470 207.171.189.80:80 3916
  293. 0x0301f1c8 192.168.7.2:1480 199.59.150.9:443 3916
  294. 0x030e1e08 127.0.0.1:1085 127.0.0.1:1087 3916
  295. 0x0316ee60 192.168.7.2:1457 74.125.235.145:443 3916
  296. 0x03175ac0 192.168.7.2:1477 199.59.150.41:443 3916
  297. 0x031dd958 0.0.0.0:55919 0.0.0.0:21157 34056384
  298. 0x032781c8 192.168.7.2:1454 173.194.38.118:443 3916
  299. 0x0328fc20 192.168.7.2:1479 173.194.38.118:443 3916
  300. 0x032a3bf0 127.0.0.1:1087 127.0.0.1:1085 3916
  301.  
  302.  
  303. =============================================================
  304. root@remnux:~/unixfreaxjp# mkdir dumpdir
  305. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 procmemdump -p3916 -D./dumpdir
  306. =============================================================
  307. ************************************************************************
  308. Dumping firefox.exe, pid: 3916 output: executable.3916.exe
  309.  
  310. =============================================================
  311. root@remnux:~/unixfreaxjp# file ./dumpdir/executable.3916.exe
  312. =============================================================
  313. ./dumpdir/executable.3916.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
  314.  
  315.  
  316. =============================================================
  317. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 memdump -p1296 -D ./dumpdir
  318. =============================================================
  319. ************************************************************************
  320. Writing svchost.exe [ 1296] to 1296.dmp
  321.  
  322. =============================================================
  323. root@remnux:~/unixfreaxjp# strings -a ./dumpdir/1296.dmp
  324. =============================================================
  325. u.;5|
  326. SVWUj
  327. ]_^[
  328. t.;t$$t(
  329. VWumh
  330. wLVWP
  331. FVWS
  332. :
  333. :
  334.  
  335. =============================================================
  336. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 memmap
  337. =============================================================
  338. 0x0080281000 0x0000281000 0x000000001000
  339. 0x0080282000 0x0000282000 0x000000001000
  340. 0x0080283000 0x0000283000 0x000000001000
  341. 0x0080284000 0x0000284000 0x000000001000
  342. 0x0080285000 0x0000285000 0x000000001000
  343. :
  344. :
  345.  
  346. =============================================================
  347. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 volshell
  348. =============================================================
  349. Current context: process System, pid=4, ppid=0 DTB=0x39000
  350. Welcome to volshell! Current memory image is:
  351. file:///media/linux/home/unixfreaxjp/test.dmp
  352. To get help, type 'hh()'
  353. >>>
  354. >>> hh()
  355. ps() : Print a process listing.
  356. cc(offset=None, pid=None, name=None) : Change current shell context.
  357. dd(address, length=128, space=None) : Print dwords at address.
  358. db(address, length=128, width=16, space=None) : Print bytes as canonical hexdump.
  359. hh(cmd=None) : Get help on a command.
  360. dt(objct, address=None) : Describe an object or show type info.
  361. list_entry(head, objname, offset=-1, fieldname=None, forward=True) : Traverse a _LIST_ENTRY.
  362. dis(address, length=128, space=None) : Disassemble code at a given address.
  363.  
  364. For help on a specific command, type 'hh(<command>)'
  365.  
  366.  
  367.  
  368. =============================================================
  369. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 malfind -D ./dumpdir/
  370. =============================================================
  371. Name Pid Start End Tag Hits Protect
  372.  
  373. firefox.exe 3916 0x02040000 0x2040fff0 VadS 0 PAGE_EXECUTE_READWRITE
  374. Dumped to: ./dumpdir/firefox.exe.31d15a0.02040000-02040fff.dmp
  375. 0x02040000 1b 6f f5 77 68 58 02 00 00 e9 12 6f f1 75 00 00 .o.whX.....o.u..
  376. 0x02040010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  377. 0x02040020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  378. 0x02040030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  379. 0x02040040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  380. 0x02040050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  381. 0x02040060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  382. 0x02040070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  383.  
  384. Disassembly:
  385. 02040000: 1b6ff5 SBB EBP, [EDI-0xb]
  386. 02040003: 7768 JA 0x204006d
  387. 02040005: 58 POP EAX
  388. 02040006: 0200 ADD AL, [EAX]
  389. 02040008: 00e9 ADD CL, CH
  390. 0204000a: 126ff1 ADC CH, [EDI-0xf]
  391. 0204000d: 7500 JNZ 0x204000f
  392. 0204000f: 0000 ADD [EAX], AL
  393. 02040011: 0000 ADD [EAX], AL
  394. 02040013: 0000 ADD [EAX], AL
  395.  
  396. =============================================================
  397. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 hivescan
  398. =============================================================
  399. Offset (hex)
  400. 63426568 0x03c7d008
  401. 63458144 0x03c84b60
  402. 71756640 0x0446eb60
  403. 100591960 0x05fee958
  404. 115226456 0x06de3758
  405. 115443544 0x06e18758
  406. 117456904 0x07004008
  407. 200962056 0x0bfa7008
  408. 205273952 0x0c3c3b60
  409. 212844552 0x0cafc008
  410. 219321368 0x0d129418
  411. 380906336 0x16b42b60
  412. 381963104 0x16c44b60
  413.  
  414. =============================================================
  415. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 hivelist
  416. =============================================================
  417. Virtual Physical Name
  418. 0xe16d6b60 0x16b42b60 \Device\HarddiskVolume1\Documents and Settings\kaspersky\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  419. 0xe16deb60 0x16c44b60 \Device\HarddiskVolume1\Documents and Settings\kaspersky\NTUSER.DAT
  420. 0xe1377418 0x0d129418 \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  421. 0xe12d3b60 0x0c3c3b60 \Device\HarddiskVolume1\Documents and Settings\LocalService\NTUSER.DAT
  422. 0xe11c4008 0x0bfa7008 \Device\HarddiskVolume1\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  423. 0xe1318008 0x0cafc008 \Device\HarddiskVolume1\Documents and Settings\NetworkService\NTUSER.DAT
  424. 0xe1a43758 0x06e18758 \Device\HarddiskVolume1\WINDOWS\system32\config\SOFTWARE
  425. 0xe1a3a758 0x06de3758 \Device\HarddiskVolume1\WINDOWS\system32\config\DEFAULT
  426. 0xe1a41008 0x07004008 \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
  427. 0xe1987958 0x05fee958 \Device\HarddiskVolume1\WINDOWS\system32\config\SAM
  428. 0xe181cb60 0x0446eb60 [no name]
  429. 0xe1036b60 0x03c84b60 \Device\HarddiskVolume1\WINDOWS\system32\config\SYSTEM
  430. 0xe102e008 0x03c7d008 [no name]
  431. 0x8066ab1c 0x0066ab1c [no name]
  432.  
  433. =============================================================
  434. root@remnux:~/unixfreaxjp# vol -f test.dmp --profile=WinXPSP2x86 printkey
  435. =============================================================
  436.  
  437. Values:
  438. ----------------------------
  439. Registry: [no name]
  440. Key name: REGISTRY (S)
  441. Last updated: 2012-04-23 07:07:40
  442.  
  443. Subkeys:
  444. (S) MACHINE
  445. (S) USER
  446.  
  447. Values:
  448. ----------------------------
  449. Registry: \Device\HarddiskVolume1\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
  450. Key name: S-1-5-19_Classes (S)
  451. Last updated: 2003-02-27 12:01:19
  452.  
  453. Subkeys:
  454. (S) Network
  455. (S) Software
  456.  
  457. Values:
  458. ----------------------------
  459. Registry: \Device\HarddiskVolume1\WINDOWS\system32\config\SECURITY
  460. Key name: SECURITY (S)
  461. Last updated: 2012-04-23 07:07:57
  462.  
  463. Subkeys:
  464. (S) Cache
  465. (S) Policy
  466. (S) RXACT
  467. (V) SAM
  468.  
  469. Values:
  470. ----------------------------
  471. Registry: \Device\HarddiskVolume1\Documents and Settings\kaspersky\NTUSER.DAT
  472. Key name: $$$PROTO.HIV (S)
  473. Last updated: 2012-04-23 07:21:34
  474.  
  475. Subkeys:
  476. (S) AppEvents
  477. (S) Applications
  478. (S) Console
  479. (S) Control Panel
  480. (S) DefaultScope
  481. (S) Environment
  482. (S) EUDC
  483. (S) Identities
  484. (S) Keyboard Layout
  485. (S) Network
  486. (S) NodeEventQuery
  487. (S) pmtest
  488. (S) Printers
  489. (S) RemoteAccess
  490. (S) Software
  491. (S) UNICODE Program Groups
  492. (S) Windows 3.1 Migration Status
  493. (V) SessionInformation
  494. (V) Volatile Environment
  495.  
  496. =====================
  497. PLUGIN LISTS
  498. =====================
  499.  
  500. apihooks [MALWARE] Find API hooks
  501. bioskbd Reads the keyboard buffer from Real Mode memory
  502. callbacks [MALWARE] Print system-wide notification routines
  503. connections Print list of open connections [Windows XP Only]
  504. connscan Scan Physical memory for _TCPT_OBJECT objects (tcp connections)
  505. crashinfo Dump crash-dump information
  506. datetime A simple example plugin that gets the date/time information from a Windows image
  507. devicetree [MALWARE] Show device tree
  508. dlldump Dump DLLs from a process address space
  509. dlllist Print list of loaded dlls for each process
  510. driverirp [MALWARE] Driver IRP hook detection
  511. driverscan Scan for driver objects _DRIVER_OBJECT
  512. evtlogs Extract Windows Event Logs (XP/2K3 only)
  513. filescan Scan Physical memory for _FILE_OBJECT pool allocations
  514. gdt [MALWARE] Display Global Descriptor Table
  515. getservicesids Get the names of services in the Registry and return Calculated SID
  516. getsids Print the SIDs owning each process
  517. handles Print list of open handles for each process
  518. hashdump Dumps passwords hashes (LM/NTLM) from memory
  519. hibinfo Dump hibernation file information
  520. hivedump Prints out a hive
  521. hivelist Print list of registry hives.
  522. hivescan Scan Physical memory for _CMHIVE objects (registry hives)
  523. idt [MALWARE] Display Interrupt Descriptor Table
  524. imagecopy Copies a physical address space out as a raw DD image
  525. imageinfo Identify information for the image
  526. impscan [MALWARE] Scan a module for imports (API calls)
  527. inspectcache Inspect the contents of a cache
  528. kdbgscan Search for and dump potential KDBG values
  529. kpcrscan Search for and dump potential KPCR values
  530. ldrmodules [MALWARE] Detect unlinked DLLs
  531. lsadump Dump (decrypted) LSA secrets from the registry
  532. malfind [MALWARE] Find hidden and injected code
  533. memdump Dump the addressable memory for a process
  534. memmap Print the memory map
  535. moddump Dump a kernel driver to an executable file sample
  536. modscan Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects
  537. modules Print list of loaded modules
  538. mutantscan Scan for mutant objects _KMUTANT
  539. netscan Scan a Vista, 2008 or Windows 7 image for connections and sockets
  540. patcher Patches memory based on page scans
  541. printkey Print a registry key, and its subkeys and values
  542. procexedump Dump a process to an executable file sample
  543. procmemdump Dump a process to an executable memory sample
  544. psdispscan Scan Physical memory for _EPROCESS objects based on their Dispatch Headers
  545. pslist print all running processes by following the EPROCESS lists
  546. psscan Scan Physical memory for _EPROCESS pool allocations
  547. pstree Print process list as a tree
  548. psxview [MALWARE] Find hidden processes with various process listings
  549. registryapi A wrapper several highly used Registry functions and w/a Timeline component
  550. sockets Print list of open sockets
  551. sockscan Scan Physical memory for _ADDRESS_OBJECT objects (tcp sockets)
  552. ssdt Display SSDT entries
  553. ssdt_ex [MALWARE] SSDT Hook Explorer for IDA Pro (and SSDT by thread)
  554. strings Match physical offsets to virtual addresses (may take a while, VERY verbose)
  555. svcscan [MALWARE] Scan for Windows services
  556. testsuite Run unit test suit using the Cache
  557. ------
  558. ZeroDay Japan http://0day.jp
  559. OPERATION CLEANUP JAPAN | #OCJP
  560. Analyst: Hendunixfreaxjp ADRIAN アドリアン・ヘンドリック
  561. Malware Researcher VT/ twitter/google: @unixfreaxjp
  562. sponsored by: 株式会社ケイエルジェイテック http://www.kljtech.com
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!