Investigating Malware Using Memory Forensics - A Practical Approach

This presentation mainly focuses on the practical concept of memory forensics and shows how to use memory forensics to detect, investigate and understand the capabilities of malicious software. In addition to that, with the help of various demonstrations, the presentation also covers various tricks and techniques used by the malware including some of the stealth and evasive capabilities.
By Monnappa K A
Full Abstract & Presentation Materials: www.blackhat.com/asia-19/brie...

[@NeXuSInfoS3c]

you are a role model in cyber security sir.

[@rehm3868]

You made memory forensics so easy to understand for a newbie like me. I’m now more interested in practicing forensics. Hats off to to you sir Monnappa!

[@kidsfungaming6756]

wow, extraordinary presentation, can I request to get the discussed memory dumps for practicing? please

[@rhydhamjoshi1960]

One of the best presentations that I ever attended. I feel I learned at each and every second of the presentation. Very engaging talk. The experience and the expertise of Monnappa on Volatility framework is incredible. Great work. :)

[@marcschweiz]

This absolutely blew my mind. So detailed and well explained. Thank you Monnappa!

[@thecyberian9803]

Thank you very much Monnappa for this excellent presentation and perfect demonstration.

[@cmdsecure]

By far, one of the best videos in terms of understanding the processes used and the different commands with Volatility. Will be watching again so I can practise on my own examples with Volatility3.

[@jalapenohiway]

Amazing presentation with TONS of invaluable information, all in a very concise manner. TY!

[@ibrahima9123]

Awesome and great explanation.

[@emran5897]

I love to follow ur videos your videos teaches me a lot.
Thank you so much.

[@kranky1993]

Danke für die Präsentation. Habe super viel gelernt was ich nun auf der Arbeit umsetzten kann ❤️

[@Madeinoz1967]

Very detailed presentation. Thank you for sharing

[@nilanjana25]

This is an awesome informative presentation. Thank you 😊

[@clarencewilliams3065]

Good work Sir.

[@krithikapadmavathy7052]

Best learning session, thank you

[@yogeshdange]

Wow 👏 thank you so much for this session 🙌

[@vinnu333]

An Awesome tool for Memory Forensics and a very detailed presentation!!
Glad this is an open-source tool.

[@ihacksi]

Best memory forensics presentation ever! Thank you sir!

[@sudipsinha1660]

very nice.. thank you for delivering great talk.

[@SarathKumariamawesome]

Good one

[@MrEvoluter]

What a voice sir, it is so clear and your approach to each objective is definitely whelming. Thank you for such a great demonstration, felt like learnt and dealt with my investigation. Tahnk you once again.

[@sarathreddy844]

Really very nice explanation..I am getting 60 %clarity on memory analysis

[@Basieeee]

Man thanks, I had to do incident response for my threat hunt class. I was so lost but this cleared up a bunch.

[@SantoshKumar-bm2iz]

You are the best... 👍

[@user-ty8cm9ox5d]

Nice presentation.

[@anasshaikh5778]

Thanks TH-cam for recommending this video

[@nunoalexandre6408]

Very Nice...

[@nimaforoughi3008]

So beautiful!!!!

[@msecure5543]

Please provide full video..
It's very useful

[@peacefultube45]

Awesome book bro 💪👊👌 read it 😍🥰

[@bubunleo]

awesome !!!!nice training

[@mohamedal-ghamdi7654]

Brilliant, nothing to say more

[@arkadiuszzduniak2126]

volatility rulez. This is all one may need for malware analysis.

[@keitakeita7890]

I’m now more interested in practicing forensics, can you share the memory dump

[@rockrobotx]

i really liked this presentation; very informative and, indeed, practical. I'm sure I'm not alone in my disappointment for what defcon and black hat have become. What's more; the infosec industry in the east seems much less superficial and sexy, which is why the best presentations come from people who live outside the US, Canada, Western Europe. Feels like that, anyway.

[@alifayyaz851]

i tried to recover a packed malware from memory knowing its PID using procdump but it recovered me packed exe . Can't i recover it unpacked ?

[@CyberDeck-pg7sf]

Is it possible to get the sample you are analyzing ?

[@rahuldutt2021]

Hi sir, I'm doing a project on "Primary Memory Analysis". I have a question how can I undergo the live memory forensic, in which computer system I need to undergo, can I do on my personal laptop and what are the programs I need to run or do I need to download memory dump from the Internet containing malware? Could you plz advice.

[@bsoujanya8380]

how to do memory forensics in Routers

[@hackingkingdom4061]

can u provide the file link

[@New-qg3zj]

How to do analysis on infected Android mobile

[@sarathreddy844]

i want one sample .vmem file

[@AlexSiviero]

Vmem is a memory dump from a VMware machine. Easiest and cleanest way to obtain it is to snapshot an infected VM and look for this file on the folder the VM is at. You can then run volatility on it without the need to converting it to a raw dump

[@usuallyadam]

Gulp!

[@killshxxxt5147]

nice very informative! could be alot better tho!

[@valeenoi2284]

The dizzying array of tools and techniques... it's mindboggling.
Don't we all agree that the root cause of all these issues is... Windows? Ditch that shit OS.

[@andrevirgantara5360]

wkwkwk server C2 nya di undip