Extracting Malware Indicators of Compromise in Memory Forensics

This is the official website of the workshop “Extracting Malware Indicators of Compromise in Memory Forensics”, given in person at “Cybersecurity Summer BootCamp 2022”, organized by the Spanish National Cybersecurity Institute (INCIBE).

Material

• Workshop slides

Additional Material (Lab Sessions)

Lab Workbooks

• Lab session 1: First Steps with Volatility
• Lab session 2: Malware Extraction and Analysis with Volatility 3
• Lab session 3: Development of Own Analysis Tools
• Lab session 4: Automation of Analysis Tasks with Volatility

Virtual Machines

• Debian 10 Virtual Machine. It is a compressed OVA file, you can deploy it with VirtualBox, VMWare, or the hypervisor software of your choice (VirtualBox is recommended).
• MD5 hashes

Memory dumps

• Windows 7 (infected with ALINA) (MD5 hashes)
• Windows 7 (infected with WannaCry) (MD5 hashes)
• Memory dump “zeus.vmem” (from The Malware Analyst’s Cookbook) (MD5 hashes)

License

All material distributed on this website is licensed under CC BY-NC-SA 4.0.

Author

Ricardo J. Rodríguez

LAST UPDATE

• July 2, 2022: Initial creation of the website