First, let me start by saying thanks to our users for the more than
10,000 unique downloads of Memoryze and Audit Viewer in 2010. Peter
and I have been working with a lot of different people over the past
couple of months to bring you this new release. You can download
version 1.4.4200 of href="/content/fireeye-www/en_US/services/freeware/memoryze.html">Memoryze
and href="http://www.mandiant.com/products/free_software/mandiant_audit_viewer/">Audit
Viewer now. I will just touch on a few things of most interest.
You can read the User Guides for the rest.
zynamics VxClass Integration
If you have not checked
out href="http://zynamics.com/vxclass.html">VxClass from zynamics,
now is a good time. For those at MIRcon, you got to see Thomas
Dullien's presentation. VxClass automatically classifies malware
into families. This allows the incident responder to leverage
intelligence from prior investigations and focus on the most
important threats. Since it is fast and automated, VxClass is a
great addition to your arsenal whether you have a malware team or
not. VxClass can also generate private byte signatures (in ClamAV
format) for a whole family of malware samples. Imagine finding 160
pieces of malware that VxClass automatically classifies as a single
family and generates one byte pattern that you can use to find every
variant. It is now possible, and you can take that byte signature
and scan all the physical memory in your enterprise with target="_blank"
href="http://www.mandiant.com/products/core/intelligent_response">MANDIANT
Intelligent Response or a host at a time with Memoryze and
Audit Viewer.
Thomas has a great write-up of how this process
works href="http://blog.zynamics.com/2011/01/27/memoryze-vxclass-vs-zeus/">here.
I will not attempt to explain the article, but below is a
glimpse.
href="http://blog.zynamics.com/2011/01/27/memoryze-vxclass-vs-zeus/">
width="417" height="227" title="Malware Overlap"
src="http://zynamics.files.wordpress.com/2011/01/tree-venn.png" />Two
pieces of malware and how they overlap
Report Generation
Our users have really liked the
wealth of information and the detailed analysis and scoring Memoryze
and Audit Viewer provides, but sometimes you need all that data in a
format you can rearrange. Audit Viewer has attempted to address this
in different ways over time including the ability to cut-n-paste and
comment almost every row of data. If you have not tried the comment
feature, I encourage you to today. But how do you get all that
information out of Audit Viewer as you work the incident? Well,
Audit Viewer now includes the ability to automatically generate a
report in text or Microsoft Word format with MRI results, case
comments, handles, sections, ports, etc. Simply click on
Operations->Generate Report.
href="https://www.fireeye.com/content/dam/legacy/ammo/generate_report.jpg"> width="536" height="349"
class="aligncenter size-full wp-image-1643"
title="Generate Report"
src="https://www.fireeye.com/content/dam/legacy/ammo/generate_report.jpg" />
Here is a brief example of the lsass.exe process that was
infected. Note: if you are using this feature across every
process with all the options turned on, it can generate large
documents that Word and most editors may take a long time to
process.
href="https://www.fireeye.com/content/dam/legacy/ammo/ir_report.jpg"> width="511" height="516"
class="aligncenter size-full wp-image-1646"
title="Incident Response Report"
src="https://www.fireeye.com/content/dam/legacy/ammo/ir_report.jpg" />
Searching Process Address Space
If you do not have
access to zynamics VxClass, I encourage you pursue that; however,
you can still search every process' address space. Memoryze will
only return the processes that match your search criteria. Memoryze
can also search for more than one pattern. It will look for the
patterns and return the process if any pattern was a match. There
are many applications of this technology. You could search for email
addresses, partial domain names, URLs, Social Security numbers,
credit card numbers, arbitrary byte patterns, etc.
Currently,
Audit Viewer is customized for VxClass so if you want to use this
feature you must edit ProcessAuditMemory.Batch.xml and run
Memoryze from the command-line.
Memoryze.exe -o -script ProcessAuditMemory.Batch.xml -encoding
none
You can also use the batch files included with
Memoryze.
Process.bat -handles true -sections true -ports true -injected
true -digsig true -content conficker
Training at CanSecWest
If you would like to sharpen
your memory forensics skills, Peter and I will be teaching at target="_blank"
href="http://cansecwest.com/dojos/2011/csw_2_07.html">CanSecWest.
