Lesson 5 of 5 · 20 min read

MemProcFS and Rapid Memory Triage — Filesystem-Style Analysis

MemProcFS and rapid triage workflows exist because IR operates under time pressure. The goal is not exhaustive analysis — it’s extracting the highest-value findings as fast as possible to support containment decisions.

MemProcFS — Setup and Navigation

# Mount a memory image as a filesystem (Linux)
./memprocfs -device memory.raw -mount /mnt/memory

# Windows:
# MemProcFS.exe -device memory.raw -mount M:

# Browse the mounted memory:
ls /mnt/memory/
# Directories: forensic/ name/ pid/ proc/ py/ sys/

# List all processes (equivalent to pslist)
ls /mnt/memory/proc/
# 0/  4/  88/  352/  620/  820/  ... (directories named by PID)

# View process list with names
cat /mnt/memory/proc/*/name.txt | sort -u

# Navigate to a specific process
ls /mnt/memory/proc/4492/
# cmdline.txt  dtb.txt  files/  handles/  minidump/  modules/  name.txt  threads/ token/

# Read command line
cat /mnt/memory/proc/4492/cmdline.txt
# C:\Windows\System32\svchost.exe  (missing -k flag = suspicious)

# Read loaded modules
ls /mnt/memory/proc/4492/modules/
# kernel32.dll.txt  ntdll.dll.txt  svchost.exe.txt  ...
# Count: if fewer modules than expected = hollowed or minimal process

MemProcFS Forensic Analysis Features

# NTFS filesystem from memory (live filesystem state)
ls /mnt/memory/forensic/ntfs/
# Browse the filesystem as it existed at memory acquisition time
# Find recently modified files:
find /mnt/memory/forensic/ntfs/Users/ -newer /mnt/memory/forensic/ntfs/Windows/ 2>/dev/null

# Registry from memory
ls /mnt/memory/sys/reg/
# HKLM/  HKCU/ etc.
cat "/mnt/memory/sys/reg/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run.txt"

# Search for strings across all process memory (fast grep)
grep -r "185.220.101.9" /mnt/memory/proc/ 2>/dev/null

# Yara scan via MemProcFS (requires Yara rules directory)
ls /mnt/memory/forensic/yara/
# Place .yar files in rules directory, results appear here

# Extract a process minidump for WinDbg or Volatility analysis
cp /mnt/memory/proc/4492/minidump/minidump.dmp /forensic-share/svchost_4492.dmp

Rapid Triage Workflow

#!/bin/bash
# 20-minute memory triage
MEMORY="memory.raw"
OUT="./triage_$(date +%Y%m%d_%H%M)"
mkdir -p "$OUT"

echo "[$(date +%H:%M:%S)] 1/7 Mounting memory image with MemProcFS"
mkdir -p /mnt/memory
./memprocfs -device "$MEMORY" -mount /mnt/memory &
sleep 10  # Allow mount to initialize

echo "[$(date +%H:%M:%S)] 2/7 Process list"
ls /mnt/memory/proc/ | while read pid; do
  name=$(cat /mnt/memory/proc/$pid/name.txt 2>/dev/null)
  ppid=$(cat /mnt/memory/proc/$pid/ppid.txt 2>/dev/null)
  echo "$pid | $ppid | $name"
done | sort -k3 > "$OUT/01_processes.txt"

echo "[$(date +%H:%M:%S)] 3/7 Network connections (Volatility netscan)"
vol.py -f "$MEMORY" windows.netscan > "$OUT/02_netscan.txt" &

echo "[$(date +%H:%M:%S)] 4/7 Command lines for all processes"
for pid in $(ls /mnt/memory/proc/ | grep -E '^[0-9]+$'); do
  cmd=$(cat /mnt/memory/proc/$pid/cmdline.txt 2>/dev/null)
  echo "$pid: $cmd"
done > "$OUT/03_cmdlines.txt"

wait  # Wait for netscan to finish

echo "[$(date +%H:%M:%S)] 5/7 Identify suspicious PIDs from netscan"
# Extract PIDs with external connections
grep "ESTABLISHED" "$OUT/02_netscan.txt" | \
  grep -vE "10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\." | \
  awk '{print $2}' | sort -u > "$OUT/suspicious_pids.txt"
cat "$OUT/suspicious_pids.txt"

echo "[$(date +%H:%M:%S)] 6/7 ldrmodules + malfind on suspicious PIDs"
while read pid; do
  vol.py -f "$MEMORY" windows.ldrmodules --pid "$pid" | \
    grep "False" >> "$OUT/04_ldrmodules_hits.txt"
  vol.py -f "$MEMORY" windows.malfind --pid "$pid" >> "$OUT/05_malfind_hits.txt"
done < "$OUT/suspicious_pids.txt"

echo "[$(date +%H:%M:%S)] 7/7 Hash dump"
vol.py -f "$MEMORY" windows.hashdump > "$OUT/06_hashdump.txt"

echo "[$(date +%H:%M:%S)] Triage complete. Results in $OUT"

Interpreting Triage Output

FINDING PRIORITY MATRIX:
────────────────────────────────────────────────────────────────────────
Priority | Indicator                                   | Action
────────────────────────────────────────────────────────────────────────
P1       | Process in psscan not pslist (DKOM)         | Full kernel analysis
P1       | ldrmodules False/False/False + ESTABLISHED  | Dump + IOC extraction
P1       | LSASS dump file in filescan                 | Immediate cred rotation
P2       | malfind MZ hit in unexpected process        | Dump + static analysis
P2       | svchost.exe missing -k argument             | Process hollowing check
P2       | SSDT entry outside ntoskrnl.exe             | Full rootkit investigation
P3       | malfind hit in known browser (JIT check)    | Verify: MZ? RWX? Cross-ref net
P3       | Hidden driver in modscan not modules        | Driver dump + analysis
────────────────────────────────────────────────────────────────────────