Memoryze This

At the Hack in the Box security conference in Malaysia Wednesday, Mandiant's Peter Silberman announced the release of Mandiant's newest free tool for incident response and forensic investigations. The tool, Memoryze, is the latest memory analysis tool for first responders to consider adding to their toolkit for acquiring physical memory from running Windows systems. This summer, we saw the release of several other tools to do the same thing, but they stopped short at providing the ability to acquire a forensic image (or copy) of physical memory. Memoryze goes further and provides advanced analysis capabilities of both physical memory from live, running Windows systems and memory images previously acquired from running systems.I spent a couple hours working with Memoryze in the wee hours of this morning and found it to be quite powerful. It acquires memory quickly and writes it in a raw format that can be read by the other memory analysis tools like the Volatility Framework. I tested Memoryze's ability to read physical memory images acquired by itself, Mantech's mdd, Guidance Software's winen and win32dd. Note: For winen, I had to convert Encase format to a raw dd format using FTK Imager first. I didn't have any problems analyzing all four images acquired by the various tools. Additionally, I tested Volatility with similar success.

So, Memoryze works with output from other tool and works well, but what can it really do? I've already established that it can acquire an image of physical memory from a running Windows system. It can image just the memory of a single process or a driver, list all running processes (even those hidden by rootkits), and list network sockets and strings (might find URLs, e-mail addresses, passwords). Memoryze also has several specific capabilities that can help determine if a rootkit is running such as reporting on device and driver layering, identify all loaded kernel modules and identify hooks often used by rootkits.

Jamie Butler, MIR Agent Team Lead at MANDIANT said, "Memoryze is designed to catch the most sophisticated of threats. It analyzes physical memory and even parses the paging files, bypassing the operating system's APIs. In the lab, we have shown that Memoryze can find memory resident-only shellcode that does not exist on disk. If the attacker is there, Memoryze can pull the malicious code directly from memory, so our malware analysis team can begin the analysis."

Memoryze contains a small subset of the functionality available from Mandiant Intelligent Response (MIR) that can do all of the above and more but at an enterprise level to remote hosts. I'm sure Memoryze is meant to be a bit of a teaser of what MIR can do and is intended partially to entice companies to look at MIR, but there's no point in looking a gift horse in the mouth -- it's a good tool and likely to find a home in many first responders' toolkits.

John H. Sawyer is a Senior Security Engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.