Don't forget, there will be a live workshop event right after this video premiers on discord.tpsc.tech. Maybe we'll do something special and try to clean the system using your suggestions. Everyone is welcome to join. :) Links: Volatility (Command Line Interface) -- For this tool, be sure to review the documentation within the -h command www.volatilityfoundation.org/releases Dump It -- Tool used to create dump files -- remember to rename your dump to .mem file extension github.com/thimbleweed/All-In-USB/blob/master/utilities/DumpIt/DumpIt.exe?raw=true Volatility GUI -- User Friendly Version of the utility tested www.osforensics.com/tools/volatility-workbench.html
About 10 years ago I use to do this remote. I had the best resolve rate, best single call rate, best customer care rate. I was fired for not doing more calls per day, because as far as they are concerned leaving a customer with some malware was ok as long as the system worked for a couple of weeks.
Thats crazy, sounds like they needed to reevaluate their procedures, are they still in business? Not looking for a name just curious if they could really establish a solid customer base. I would rather take one or two calls and ensure that their system was completely clean and working to its best ability, than lots of calls and customers that eventually walk away and find someone who does it properly.
I've had one very nasty virus where it would let me do everything BUT: open task manager, type in any word resembling 'virus' or 'antivirus' anywhere, or visit any site like avast. It was impressive really, how polite it was in letting me do work but not allowing me to get rid of it. :D
@@lerebox drove me nuts, esp since I just got a used card off ebay and wasn't sure if it was the card. Tbh it still can crash games after 30mins or so but I gave up on diagnosing it :D
Very informative. I've been out of the computer space since 2002. I was once the go to guy to fix everyones computers, not anymore lol. Glad there is a channel like this to get me caught up.
Same here! I worked in the world of PCs when they were just beginning and up until about 2000 +/-. Now, I am way behind on everything. It's going to be some serious catch up work to get back up to speed. This channel may be my ticket to success.
I like the way you do not hide anything from and you do not assume we know anything about the subject. You did a great video as to why and how to do. Great job, please keep up the great work!
6:00 You can also open cmd (or any executable really) in the current directory by just entering 'cmd' in the path bar 10:20 note that basically anything can be encrypted in RAM or anywhere
@@itsTyrion hey wondering if you or anyone else can help I just did exactly that and complete fresh start I download Norton and malwarebytes start searching, nothing comes back ever full scans. I disable everything that autoruns it seems to come from Microsoft onedrive and I can’t stop the files from autorunning but I seen them… it’s still trying to create files n such. It’s renamed n made Norton and malware bytes useless as the it tricks the scanners… cause ur rewrites them . Just tried to do Microsoft defender offline scan and gets to about 93% and shuts off… please anyone I could really use your help.
@@grill6411 well my buddy made the instillation media for me on his own desktop I lost all my files just saying f it and trying to get rid of this. I have a screenshot of it but I still don’t know how to remove it.. It says it did watsonreport so it followed me over I guess? Image:jokeyaklog/FargoodIcy/BagZoorWar/CanlabEgg.exe Appname:Skydrive setup Then it gave itself permissions… please if anyone could help. I already lost everything just trying to play my video games again.
@@grill6411 well maybe but I had the issue before, I think the usb was fine. I had a windows 10 disc instillation the computer came with. I think it’s possibly corrupted as well since I tried using fixmestick and left the disk in like a idiot.
In the SANS FOR508 course, they advise running netscan over netstat as this scans through the entire memory dump looking for network activity, including from processes unlinked from the VAD tree. Netstat is limited to just the network activity that is easy to find. If a process is unlinked from the VAD tree netstat would not find it. The same applies with psscan vs pslist.
You should make a follow up video on how to isolate malware like this! I think it would help a lot of people especially because most people would just wipe the system and reinstall windows. I think it would be good for the world to learn the basics of cyber security like that so they can isolate malware on their systems and save their precious data! Just a suggestion, love your video!
It'd be a better idea to educate people on how to make proper backups. Restoring a backup would take less than an hour for an average computer. Dumping the memory, going through processes and connections, doing 'forensics' basically, takes as long as it takes (days/weeks easily). And that is for people who have experience, the average user will never care to go that deep, nor will they care to fully remove malware. In those cases it's probably better to have the user know how the malware got in (usually they downloaded/clicked something fishy) and restoring backups.
I agree that not everyone might be interested, but isolating and learning how that program works or is hurting my machine interests not only me but everyone who's trying to learn in their own time and outside institutions that sometimes don't even teach us how to properly dissect malware and understand how and through were they attacking the machine. This was a great video btw i will definitely check my fams old laptops
RAM don't get infected, everytime you power off your computer the content of the RAM wipes out completely, so the temporary infection depends on what you have in you HDD/SSD running so formatting the SO will be enough to clean up everything.
for the api key generation, go to the main page, ones your signed in, hover over your account on top right corner, press account details, on the bottom, there is a generate key option, press it, then copy the key and enter it on the 'enter api key'
Instantly subbed after this video. Looking forward to diving deeper into this channel. I’m a gen X who started using computers with apple IIe. These days I consider myself very capable of avoiding infections in the first place but have never been able to be sure of that other than knowing my system is running well and being able to spot evidence well. So I believe. Lol Will be trying out some of this stuff to see if I can find anything.
Im satisfied and slightly impressed how consisely you speak. An obvious good perk for creating informative videos that surprisingly many lack on youtube I believe.
Great video! Volatility is such an amazing tool. I used Volatility 2 extensively but haven't had the opportunity to use 3 as much so far. The developers are all some of the smartest people I've ever met.
Excellent video and good to learn some tools here for my STEM students learning Cyber Security. We don’t teach hacking, but this looks like a good topic to put on next summers Cyber Camp. Thanks
Seriously ? Downloading a third party software and you're not suspecting anything ? I've searched for Dumpit, and the only "safe" download was from Comae and you must sign in and wait for check up. It is actually SCARY AF to think that "professional" are actually using third party software with thinking about security breaching. Someone tell me if I'm missing something.
Really? When I was in school for Cybersecurity/Cyber forensics we did a lot of white hat/ethical hacking and even some black hat stuff as part of the learning process. Maybe I'm just misunderstanding you, haha.
Great tools you introduced. I know Windows, comfortable with the command line, and appreciate your thorough explanation of how to approach the troubleshoot. Some viruses will resist getting the dump off the computer anyway. Often I just restart with no network (cable unplugged/WiFi disabled) - that stops many viruses from completing their execution long enough to get the thumb drive to cooperate for a moment.
This is way too much to expect anyone but the most experienced to perform and get right. Never assume that malware always will be found running in memory at the time of your dump, it won't. My methods of cleanup, gathered over 31+ years, don't look at memory dumps. Not anymore. But for regular users, If you think you're hacked or constantly infected, visit me or take it to a professional. Sometimes it's just worth it to backup your data, virus scan the data and wipe the drive. I've removed malware that survived drive wipe, so even that can fail, unless you know how and where to look. Thanks for the video. Thought I knew every tool Passmark makes, evidently not.
so this is excellent content, about 10 years ago i used to do this type of analysis for virus infections, but 3rd party software like rkill, adwcleaner (before being bought by malwarebytes) and even malwarebytes sort of made this type of investigation pointless the combo of those three software were good enough to track down like 99.9% of all infections in a quarter of the time this type of analysis required so i just stopped doing this type of analysis. thanks for making this video, gives me a place to start to familiarize myself with the common tools these days for proper virus removal now adwcleaner was mostly destroyed by malwarebytes, and malwarebytes itself no longer is half as good as it used to be... (especially now they've disabled virus removal on domain pcs)
I love how you went through changing a directory in the CLI... lol. I don't think the venn diagram of people who can't CD and people interested in memdump forensics overlap...
I'm seriously lacking in malware removal for Windows 10. A lot of my tools worked great for Windows XP/7. Now that I found this channel, I'm grabbing all the tools mentioned! As of today, Volatility cannot be downloaded. On Brave, a new tab opens then closes immediately. I used Edge and it tries to download but says it can't securely.
Everytime I run any program that trys to create a MEMORY DUMP FILE (Dumpit, FTX Imager) the computer crashes immediately. Any ideas how to get past this?
damn that intezer analyze is p good i'd actually recommend anyone to skip the grunt work and just do the analysis like that cause its free and you dont gotta worry that u missed something
I got dumpit but whenever I open it and input "y" - before I can hit enter, the computer goes blue screen and I get a "system service exception" error...
Reykjavik, Weird. I also sub to Just Icelandic & he posted a vid today about the capitol of Iceland. Anywho, Always a pleasure learning new things from you.
Hi! I'm a layman in this area and I just happened to watch this video because YT recommendations, and I really find it interesting. I would just like to ask, what's the next step? Like after finding out the malicious files, what do we do with them? Do we just delete them? Or is there another program to use to remove them? Thanks in advance!
In general, you want them gone. Best to use something that instantly overwrites the HDD space the files were on, like Eraser (Free opensource), to make sure they are completely gone. But depending on how many you find and what type, may be best to do a full re-imaging of the system (reinstall windows). And yeah.. fuck that other guy. Edit: Also make sure you change any important login credentials you have, but don't do that on the system you're troubleshooting before making sure the malicious files are gone!
@@babayega1717 Thank you so much! Also, I didn't think too much about what the other person said. I know that when it comes to these kinds of people, the more you engage with them, the more aggressive and unreasonable they get.
I prefer to use some of the older tools available and creating memory rumps directly from the command line if available on the operating system I am working with. Some of the newer software out there I have seen, tested or used is often times what I call internet locked, sometimes its a good idea not to let the "attacker" know what you are doing, while you are doing it. That being said, its an interesting newer tool. However you can get a lot of similar scanning and dump analyzation and process analyzation through other or built in means. I just don't like the entire, sign in and use my tool deal. Its always bugged me, hence I like to use other resources used by corporate security firms.
when running DumpIt i immediately get a BSOD and can’t move forward; the memory dump file it generates has 0 bytes of data in it; any clues on generating a memory dump via some other method?
Followed your advice and tried out Intezer... pretty cool stuff. found some things that seemed to stop executing once the dynamic analysis in the sand box begins... do you think that the malware could be aware that it is in a sandbox or do you think that intezer would pick up on those kinds of evasion techniques?
I seem to get a constant blue screen error every time I try to dump my memory regardless of whether Im using DumpIt.exe or FTK Images? Could I get some advice on what to do?
If your computer had a root kit, wouldn't you have to suspect that the memory dump is incomplete? After all, the program making the memory dump would be running on top of the root kit.
Dude, we're on Ring -2 malware now; I found out the hard way when my network was compromised in may 2021. It's only starting to be reported on recently... I suspect because cyber security is helpless in combating the really advanced attacks that have transitioned from being targeted to widespread botnets and credential harvesting.
I'm not certain about these specific IOCs from the video, but anti-viruses are not as effective as many people think. But the trade off, at least, is that the exploits and artifacts that use anti-virus evasion techniques also makes it easier to find during forensics instead. Still a good trade off for hackers though, as forcing manual instead of automatic detection is a massive win for them.
Hello and thank you for those well explained videos. I am just starting to learn commands and fix my windows by removing unwelcome stuff put in my system.
Then, you're out of luck. Although not impossible, It's unlikely that generic malware would be that sophisticated. It's more likely it would just prevent you from saving a dump file, in which case you could just boot into Linux, take the files you need to backup and start fresh. Tampering with ram dumps is a very fine line between breaking the computer and achieving what you want, as reading memory is something legitimate programs do sometimes, including Windows itself. Unless you target a specific tool, it's hard for a malware to catch and tamper with. For a malware developer, that would be a lot of work for not much reward. Another option that might work is booting that PC on Ubuntu/your favorite Linux distro and using the main drive as a Windows VM, in which case you should have access to memory and the malware not being able to do anything about it to hide.
Before I would go through all of that, I would just do a clean reinstall of the operating system and before uploading my back-up files to the clean install, do a virus/malware scan of those files. Youre better off starting with a clean operating system than trying to get out a bunch of viruses/malware and not really being sure you got all of them removed
Hi, I really appreciate your amazing video. I have a question. So are these the type of malwares that AV can't detect? Because can't we boot in safe mode and plug in a USB with the antivirus installed and run a scan? Or are these too advanced for AV to detect as they can mimick real process?
Most mallware could be detected by AV. If if you are hacked - you may have to look at suspicious activity by yourself, because it may look quite normal - AV don't know is it ok for your programs to "call" some remote server in Iceland or not ;-)
Yep, and BIOS/UEFI suppliers have basically made it as easy as possible. Happened in 2021 with my Alienware/Dell laptops, but every other big OEM is affected. They all made a small security advisory, acting like it wasn't serious, yet announced new UEFI/Bios updates for every system/platform going back a decade+. This was long known for Intel's AMT/ME but now there's so many other places they can flash (FROM THE FKN OS). Modern cyber security is an absolute farce and it's gotten so much worse in the past couple years.
@@Demoralized88 but new tpm chips that massively increase your security... if you pay for the service that use it, and realistically more than one of them
I do this too and list the executable path. Then I sort on signature and check if there is a signature present and if it is valid. Found a lot of malware this way in the past. But for years I did not find anything with it but I also did not have any (suspected) infected systems
Be careful before you upload your memory dumps into some "security tools" you don't know or trust. Might as well steal all your passwords and everything. And i hope that tool can filter known file hashes and known IP addresses by default. Pretty big waste of time to check them all manually.
Hi there, when I run the dumpit.exe file and enter "y"... blue windows screen appears with the message... "your device ran into an problem and it needs to restart". After restart I can see .raw file but its only 4 MB. What to do?
@@MrAircraft999 Did you set it to run on startup ? I've never used that DumpIt tool he used, but it's unlikely that a tool to dump memory would cause your PC to not boot on startup unless it does suspicious stuff.
The volatility workbench keeps soft crashing or locking at 52.04% during the Scanning Layer_name using PDBSignatureScanner any ideas what might cause this ?
The memory dump file itself is harmless. It's not going to do anything to your system. Even if you have a malicious .exe file, it will not do anything until you run it. Just copying the memdump.mem file and putting it on another system will not do anything and is safe. This file has no way of infecting a system.
@@Netsuko I think he meant that in order to copy the dump from the infected machine onto another, you have to plug in an external storage medium or connect to it by network, both of which carry the risk of an active infection spreading to another storage/system.
I know it's a hassle, but the safest way would probably be to turn off the system and boot into a live environment (any Linux Live USB/CD or HBCD_PE if you are uncomfortable with Linux). In an external OS, the malware is harmless, as it won't run on startup and/or would be completely incompatible with the external OS.
@@kaloyannikolov6849 You can probably just as well use bootable Malwarebytes removal tool (although I'm not sure if it will actually be 100% effective)
Your HDD may have bad sectors or windows might be indexing your files or defragmenting your HDD or running a system scan in the background etc... HDDs just don't cut it as a operating system drive, for additional storage, sure, but I don't recommend installing windows 10/11 on a HDD.
@@GopadilipReddy Yes, you can get a low capacity SSD ( 60-80GB ) for windows and programs only, and leave the HDD for storage, like games, movies, pictures, large files etc. Or if money isn't an issue you can buy a large capacity SSD and keep everything on it for maximum performance.
when I try to use volatility, I get an error. Does this mean my system is compromised? I tried on a different system too. Same error. "Failed to obtain process list" even though it is windows. I also noticed I get a .raw when I use dumpit, whilst you get a .mem file
6:08 a small tip: once you click the path, you can also type cmd right on it and then shift enter to open cmd on that path with administrator privileges
Just in case it is not a static IP get the exact time and date of any suspicious connection if you found malware and are sending the ISP a report. This is just in case it doesn't belong to just one user. They should hopefully be able to check their log and see who leased it for that time frame. You will not need much other than that except that some details about the kind of traffic may be helpful. If it is going through a VPN it may still be possible to at least get the VPN operator to shut them down.
Not to be too paranoid, but I wouldn't put it past the government to do hardware level wireless surveillance. Try (or is it possible) to scan the area your computer in is for somebody broadcasting on a weird frequency.
I know My PCs are hacked for years now. All the Cracks & KeyGens I download. I get many of them off/deleted, sometimes within the Registry or CMD/Power Shell, but I know its more lurking in a file in a far away place inside My PCs.
i followed along and it spat out a bunch of data i have no idea about. tried volatility you linked and it doesn't work. i tried the main website and because i'm not a business i can't download it. feel pretty much useless at this point.
