Network, Memory and Malware Tools

What it is

Network traffic, memory and malware samples answer the questions a disk cannot: what the attacker did on the wire, what ran in RAM, and what a sample does. Each has its own tool class.

The exam asks which tool fits which data source, and what the analysis shows.

How it works

Network traffic investigation tools

tcpdump -i eth0 -w capture.pcap host 10.0.0.5

Wireshark display filters narrow the view, for example ip.addr == 10.0.0.5 && http.request or dns. Hash the capture file after it is closed.

Incident detection with SIEM tools

A SIEM collects logs from many sources, normalizes them, correlates events and raises alerts. Examples: Splunk, Elastic stack, IBM QRadar, Microsoft Sentinel, LogRhythm, Graylog and ArcSight. For an investigation the SIEM provides search across hosts, timelines, and rules such as many failed logons followed by a success.

Web application attacks in logs

Check status codes, response sizes and later requests from the same client. A sudden request to a new script after probing suggests a web shell. Use grep, Log Parser Studio, GoAccess or a SIEM.

Tools to identify TOR artifacts

Tor Browser is built on Firefox ESR. Evidence: the installation folder, prefetch entries for the Tor Browser executables, the Tor state files, registry and user activity traces, memory strings, and network traffic to known Tor relays. Compare connections to public lists of relay addresses. Tor hides the destination and the content from the network, so endpoint artifacts are the main evidence.

Tools to acquire memory dumps

Write the dump to external media and hash it. Hibernation and page files are extra memory sources.

Tools to examine memory dumps

Volatility is the standard framework. Typical questions and plugins: processes (pslist, psscan, pstree), network connections (netscan), injected code (malfind), command lines (cmdline), registry hives (hivelist, printkey). In Volatility 3 these are named with a prefix such as windows.malfind.Malfind. Other aids: strings, Bulk Extractor and Autopsy.

A process that appears in psscan but not pslist may be hidden or exited. Compare lists to find it.

Static and dynamic malware analysis

Always analyze on isolated virtual machines with snapshots and no connection to production. Record indicators of compromise: hashes, domains, file paths and registry keys.

Analyzing suspicious Word and PDF documents

Do not open the document normally. Examine its structure with the tools, or open it only in a sandbox.

Malware behavior on a system and network

On the system, Process Monitor shows file, registry and process activity. Regshot compares registry and file snapshots before and after. Autoruns lists persistence. On the network, TCPView and Wireshark show connections, and tools such as FakeNet-NG or ApateDNS simulate services so the sample reveals its requests. Look for persistence, dropped files, beaconing and command and control traffic.

A worked example

A memory dump from a server shows an unfamiliar process. pslist and psscan differ, and malfind flags a region with executable code.

The analyst dumps the region, hashes it, and examines it in a sandbox, where Process Monitor shows it creating a run key and Wireshark shows periodic requests to one domain.

How the exam asks about this

• "Which tool lists files and credentials rebuilt from a packet capture?" → NetworkMiner.
• "Which Volatility plugin finds injected code?" → malfind.
• "Which tool scans a PDF for JavaScript and OpenAction keywords?" → pdfid.