STAGE 6: VOLATILE MEMORY FORENSICS
Volatility Memory Analysis Suite
Deep forensic memory inspection using Volatility 3. Uncover injected RWX code regions (`malfind`), detect unlinked DKOM hidden processes (`psscan` vs `pslist`), isolate process hollowing, and track LSASS access.
Memory Image
CobaltStrike_Beacon_Memory.raw
Size: 8.0 GB
Volatility Profile
Win10x64_19041
DTB / CR3: 0x1AA000
Injected VADs
1 RWX Regions
PAGE_EXECUTE_READWRITE
Process Hollowing
DETECTED
svchost.exe
LSASS Handle Access
CRITICAL (0x1FFFFF)
Credential Sniffing
Volatility 3 Plugin: windows.malfind
Identifies Virtual Address Descriptors (VAD) with execute permissions containing unmapped code or injected PE headers.
svchost.exe (PID: 5410)Address: 0x000001F82B000000PAGE_EXECUTE_READWRITE
Detected Signature: Cobalt Strike Beacon Watermark #1337
0x000001F82B000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 |MZ..............|
0x000001F82B000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......|
0x000001F82B000020 fc 48 83 e4 f0 e8 c0 00 00 00 41 51 41 50 52 51 |.H........AQA PRQ|
0x000001F82B000030 56 48 31 d2 65 48 8b 52 60 48 8b 52 18 48 8b 52 |VH1.eH.R`H.R.H.R|
0x000001F82B000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......|
0x000001F82B000020 fc 48 83 e4 f0 e8 c0 00 00 00 41 51 41 50 52 51 |.H........AQA PRQ|
0x000001F82B000030 56 48 31 d2 65 48 8b 52 60 48 8b 52 18 48 8b 52 |VH1.eH.R`H.R.H.R|