Accession Number:

AD1004008

Title:

Malware Memory Analysis for Non-specialists: Investigating Publicly Available Memory Image for the Tigger Trojan Horse

Descriptive Note:

Technical Report

Corporate Author:

DRDC Valcartier Research Centre North Quebec (Quebec) Canada

Personal Author(s):

Report Date:

2014-06-01

Pagination or Media Count:

142.0

Abstract:

This report examines how a computer forensic investigator can effectively analyse an infected Windows memory dump. The author investigates how to perform such an analysis using Volatility and other investigative tools, including data carving utilities and anti-virus scanners.Volatility is a popular and evolving open source-based memory analysis framework upon which the authors previously proposed memory-specific methodology could be of aid to fellow novice memory analysts. The author examines how Volatility can be used to find evidence and indicators of infection. This report is the fifth in this series concerning Windows malware-based memory analysis. It examines a memory image infected with the TiggerSyzor Trojan horse.

Subject Categories:

Distribution Statement:

APPROVED FOR PUBLIC RELEASE