So, Memoryze works with output from other tool and works well, but what can it really do? I've already established that it can acquire an image of physical memory from a running Windows system. It can image just the memory of a single process or a driver, list all running processes (even those hidden by rootkits), and list network sockets and strings (might find URLs, e-mail addresses, passwords). Memoryze also has several specific capabilities that can help determine if a rootkit is running such as reporting on device and driver layering, identify all loaded kernel modules and identify hooks often used by rootkits.
Jamie Butler, MIR Agent Team Lead at MANDIANT said, "Memoryze is designed to catch the most sophisticated of threats. It analyzes physical memory and even parses the paging files, bypassing the operating system's APIs. In the lab, we have shown that Memoryze can find memory resident-only shellcode that does not exist on disk. If the attacker is there, Memoryze can pull the malicious code directly from memory, so our malware analysis team can begin the analysis."
Memoryze contains a small subset of the functionality available from Mandiant Intelligent Response (MIR) that can do all of the above and more but at an enterprise level to remote hosts. I'm sure Memoryze is meant to be a bit of a teaser of what MIR can do and is intended partially to entice companies to look at MIR, but there's no point in looking a gift horse in the mouth -- it's a good tool and likely to find a home in many first responders' toolkits.
John H. Sawyer is a Senior Security Engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.