volatilityの作法 その15

#概要

volatilityの作法、調べてみた。
zeus.vmemやってみた。

#volatility -f zeus.vmem/zeus.vmem imageinfo

```
Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
                     AS Layer2 : FileAddressSpace (/home/testuser/zeus.vmem/zeus.vmem)
                      PAE type : PAE
                           DTB : 0x319000L
                          KDBG : 0x80544ce0L
          Number of Processors : 1
     Image Type (Service Pack) : 2
                KPCR for CPU 0 : 0xffdff000L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2010-08-15 19:17:56 UTC+0000
     Image local date and time : 2010-08-15 15:17:56 -0400
```
#volatility -f zeus.vmem/zeus.vmem pstree


```
Volatility Foundation Volatility Framework 2.6
Name                                                  Pid   PPid   Thds   Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
 0x810b1660:System                                      4      0     58    379 1970-01-01 00:00:00 UTC+0000
. 0xff2ab020:smss.exe                                 544      4      3     21 2010-08-11 06:06:21 UTC+0000
.. 0xff1ec978:winlogon.exe                            632    544     24    536 2010-08-11 06:06:23 UTC+0000
... 0xff255020:lsass.exe                              688    632     21    405 2010-08-11 06:06:24 UTC+0000
... 0xff247020:services.exe                           676    632     16    288 2010-08-11 06:06:24 UTC+0000
.... 0xff1b8b28:vmtoolsd.exe                         1668    676      5    225 2010-08-11 06:06:35 UTC+0000
..... 0xff224020:cmd.exe                              124   1668      0 ------ 2010-08-15 19:17:55 UTC+0000
.... 0x80ff88d8:svchost.exe                           856    676     29    336 2010-08-11 06:06:24 UTC+0000
.... 0xff1d7da0:spoolsv.exe                          1432    676     14    145 2010-08-11 06:06:26 UTC+0000
.... 0x80fbf910:svchost.exe                          1028    676     88   1424 2010-08-11 06:06:24 UTC+0000
..... 0x80f60da0:wuauclt.exe                         1732   1028      7    189 2010-08-11 06:07:44 UTC+0000
..... 0x80f94588:wuauclt.exe                          468   1028      4    142 2010-08-11 06:09:37 UTC+0000
..... 0xff364310:wscntfy.exe                          888   1028      1     40 2010-08-11 06:06:49 UTC+0000
.... 0xff217560:svchost.exe                           936    676     11    288 2010-08-11 06:06:24 UTC+0000
.... 0xff143b28:TPAutoConnSvc.e                      1968    676      5    106 2010-08-11 06:06:39 UTC+0000
..... 0xff38b5f8:TPAutoConnect.e                     1084   1968      1     68 2010-08-11 06:06:52 UTC+0000
.... 0xff22d558:svchost.exe                          1088    676      7     93 2010-08-11 06:06:25 UTC+0000
.... 0xff218230:vmacthlp.exe                          844    676      1     37 2010-08-11 06:06:24 UTC+0000
.... 0xff25a7e0:alg.exe                               216    676      8    120 2010-08-11 06:06:39 UTC+0000
.... 0xff203b80:svchost.exe                          1148    676     15    217 2010-08-11 06:06:26 UTC+0000
.... 0xff1fdc88:VMUpgradeHelper                      1788    676      5    112 2010-08-11 06:06:38 UTC+0000
.. 0xff1ecda0:csrss.exe                               608    544     10    410 2010-08-11 06:06:23 UTC+0000
 0xff3865d0:explorer.exe                             1724   1708     13    326 2010-08-11 06:09:29 UTC+0000
. 0xff374980:VMwareUser.exe                           452   1724      8    207 2010-08-11 06:09:32 UTC+0000
. 0xff3667e8:VMwareTray.exe                           432   1724      1     60 2010-08-11 06:09:31 UTC+0000
```

#volatility -f zeus.vmem/zeus.vmem connections


```
Volatility Foundation Volatility Framework 2.6
Offset(V)  Local Address             Remote Address            Pid
---------- ------------------------- ------------------------- ---
```

#volatility -f zeus.vmem/zeus.vmem connscan


```
Volatility Foundation Volatility Framework 2.6
Offset(P)  Local Address             Remote Address            Pid
---------- ------------------------- ------------------------- ---
0x02214988 172.16.176.143:1054       193.104.41.75:80          856
0x06015ab0 0.0.0.0:1056              193.104.41.75:80          856
```

#volatility -f zeus.vmem/zeus.vmem malfind --pid 856


```
Volatility Foundation Volatility Framework 2.6
Process: svchost.exe Pid: 856 Address: 0xb70000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 38, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00b70000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............
0x00b70010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......
0x00b70020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00b70030  00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00   ................

0x00b70000 4d               DEC EBP
0x00b70001 5a               POP EDX
0x00b70002 90               NOP
0x00b70003 0003             ADD [EBX], AL
0x00b70005 0000             ADD [EAX], AL
0x00b70007 000400           ADD [EAX+EAX], AL
0x00b7000a 0000             ADD [EAX], AL
0x00b7000c ff               DB 0xff
0x00b7000d ff00             INC DWORD [EAX]
0x00b7000f 00b800000000     ADD [EAX+0x0], BH
0x00b70015 0000             ADD [EAX], AL
0x00b70017 004000           ADD [EAX+0x0], AL
0x00b7001a 0000             ADD [EAX], AL
0x00b7001c 0000             ADD [EAX], AL
0x00b7001e 0000             ADD [EAX], AL
0x00b70020 0000             ADD [EAX], AL
0x00b70022 0000             ADD [EAX], AL
0x00b70024 0000             ADD [EAX], AL
0x00b70026 0000             ADD [EAX], AL
0x00b70028 0000             ADD [EAX], AL
0x00b7002a 0000             ADD [EAX], AL
0x00b7002c 0000             ADD [EAX], AL
0x00b7002e 0000             ADD [EAX], AL
0x00b70030 0000             ADD [EAX], AL
0x00b70032 0000             ADD [EAX], AL
0x00b70034 0000             ADD [EAX], AL
0x00b70036 0000             ADD [EAX], AL
0x00b70038 0000             ADD [EAX], AL
0x00b7003a 0000             ADD [EAX], AL
0x00b7003c d000             ROL BYTE [EAX], 0x1
0x00b7003e 0000             ADD [EAX], AL

Process: svchost.exe Pid: 856 Address: 0xcb0000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 1, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x00cb0000  b8 35 00 00 00 e9 cd d7 c5 7b 00 00 00 00 00 00   .5.......{......
0x00cb0010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00cb0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x00cb0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

0x00cb0000 b835000000       MOV EAX, 0x35
0x00cb0005 e9cdd7c57b       JMP 0x7c90d7d7
0x00cb000a 0000             ADD [EAX], AL
0x00cb000c 0000             ADD [EAX], AL
0x00cb000e 0000             ADD [EAX], AL
0x00cb0010 0000             ADD [EAX], AL
0x00cb0012 0000             ADD [EAX], AL
0x00cb0014 0000             ADD [EAX], AL
0x00cb0016 0000             ADD [EAX], AL
0x00cb0018 0000             ADD [EAX], AL
0x00cb001a 0000             ADD [EAX], AL
0x00cb001c 0000             ADD [EAX], AL
0x00cb001e 0000             ADD [EAX], AL
0x00cb0020 0000             ADD [EAX], AL
0x00cb0022 0000             ADD [EAX], AL
0x00cb0024 0000             ADD [EAX], AL
0x00cb0026 0000             ADD [EAX], AL
0x00cb0028 0000             ADD [EAX], AL
0x00cb002a 0000             ADD [EAX], AL
0x00cb002c 0000             ADD [EAX], AL
0x00cb002e 0000             ADD [EAX], AL
0x00cb0030 0000             ADD [EAX], AL
0x00cb0032 0000             ADD [EAX], AL
0x00cb0034 0000             ADD [EAX], AL
0x00cb0036 0000             ADD [EAX], AL
0x00cb0038 0000             ADD [EAX], AL
0x00cb003a 0000             ADD [EAX], AL
0x00cb003c 0000             ADD [EAX], AL
0x00cb003e 0000             ADD [EAX], AL

```

以上。