The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory

Chapter 8 Hunting Malware in Process Memory

The previous chapter introduced you to process memory internals and set the foundations for you to deep dive into analysis. Now you’ll see some specific examples of how you can detect malware that hides in process memory by unlinking dynamic linked libraries (DLLs) or using one of four different methods of injecting code. You’ll also learn the fundamentals of dumping processes, libraries, and kernel modules (any portable executable [PE] files) from memory, including samples that are initially packed or compressed.

Process Environment Block

Every _EPROCESS structure contains a member called the Process Environment Block (PEB). The PEB contains the full path to the process’ executable, the full command line that starts the process, the current working directory, pointers to the process’ heaps, standard handles, and three doubly linked lists that contain the full path to DLLs loaded by the process.

Analysis Objectives

Your objectives are these:

• Recover command lines and process paths: Learn about sources in process memory that can provide details about how a process was invoked and where its file resides on disk.
• Analyze heaps: Learn what types of data applications store on their heap(s) and see a practical example that locates the text typed into Notepad.
• Inspect environment variables: Learn how to detect search order hijacking and malware families that mark their presence by creating new variables.
• Detect backdoors with standard ...