Redline Memory Analysis How To Dig Deep

To use Redline, copy the Windows memory images off the Examiner system to a separate Windows workstation, where the Mandiant Redline application is installed.

Mandiant Redline ( Figure 11 ) is a free tool that provides host investigative capabilities to users and uncovers signs of malicious activity through memory and file analysis to develop a threat assessment profile.

After I infected the test Windows box with a known malware variant and allowed the system to react, the machine wanted to restart at that moment.

All the processes that are running on the system are in Figure 12 (left, before reboot, and right, after reboot).

Figure 12: Redline shows the total number of processes running after installing malware (left), then a list of processes running after reboot (right).

MRI (Malware Risk Index) is a score Redline uses to assess the likelihood that a process or artifact is associated with a malware event.

Redline calculates the Malware Risk Index (MRI) score, which you can use to prioritize your investigation.

The higher the MRI score, the more likely Redline has identified a potential compromise.

You should inspect each process that is redlined (i.e., given a high MRI score) to determine the reasons Redline scored it as a threat.

In this case, Redline didnt label the threat very high, but it is interesting that it is the highest scoring process, and it wasnt running before the malware was executed on the box.

Conclusion Every malware attack is different, and every investigation must follow a path based on the evidence, but that doesnt mean you cant bring your incidence response team together in advance and assemble the necessary tools, so youll be ready in a crisis.

In this article, I described some tools investigators use for obtaining and analyzing the memory of an infected system.

In a later article, I will take a closer look at memory analysis tools such as Volatility and Mandiant Redline.

Redline Memory Analysis How To Dig Deep

We show you how to dig deep to find hidden and covert processes, clandestine communications, and signs of misconduct on your network.

When you examine the memory of a computer after a break-in, take advantage of active support from the Volatility framework to analyze important memory structures and read the volatile traces of an attack.

No matter how insecure Android might appear, you cant escape the bring your own device philosophy in todays corporate environment.

In this article, we show how admins can use on-board tools in Android phones to regain a little control.

Redline Memory Analysis Download