Abstract Advances in malware development have led to the widespread use of attacker toolkits that do not leave any trace in the local filesystem. This negatively impacts traditional investigative procedures that rely on filesystem analysis to reconstruct attacker activities. As a solution, memory forensics has replaced filesystem analysis in these scenarios. Unfortunately, existing memory forensics tools leave many capabilities inaccessible to all but the most experienced investigators, who are well versed in operating systems internals and reverse engineering. The goal of the research described in this paper is to make investigation of one of the greatest threats that organizations face, userland keyloggers, less error-prone and less dependent on manual reverse engineering. To accomplish this, we have added significant new capabilities to HookTracer, which is an engine capable of emulating code discovered in a physical memory captures and recording all actions taken by the emulated code. Based on this work, we present new memory forensics capabilities, embodied in a new Volatility plugin, hooktracer_messagehooks, that uses Hooktracer to automatically decide whether a hook in memory is associated with a malicious keylogger or benign software. We also include a detailed case study that illustrates our technique’s ability to successfully analyze very sophisticated keyloggers, such as Turla.

中文翻译：

---

Hooktracer：使用内存取证自动检测和分析按键记录器

摘要 恶意软件开发的进步导致攻击者工具包的广泛使用，这些工​​具包不会在本地文件系统中留下任何痕迹。这会对依赖文件系统分析来重建攻击者活动的传统调查程序产生负面影响。作为一种解决方案，内存取证已在这些场景中取代了文件系统分析。不幸的是，除了精通操作系统内部结构和逆向工程的最有经验的调查人员之外，现有的内存取证工具使许多人无法使用许多功能。本白皮书中描述的研究目标是调查组织面临的最大威胁之一，即用户空间键盘记录器，不易出错且不太依赖手动逆向工程。为了实现这一点，我们为 HookTracer 添加了重要的新功能，该引擎能够模拟在物理内存捕获中发现的代码并记录模拟代码采取的所有操作。基于这项工作，我们提出了新的内存取证功能，体现在新的 Volatility 插件 hooktracer_messagehooks 中，该插件使用 Hooktracer 自动确定内存中的钩子是否与恶意键盘记录器或良性软件相关联。我们还包括一个详细的案例研究，说明我们的技术能够成功分析非常复杂的键盘记录器，例如 Turla。hooktracer_messagehooks，它使用 Hooktracer 自动确定内存中的钩子是否与恶意键盘记录器或良性软件相关联。我们还包括一个详细的案例研究，说明我们的技术能够成功分析非常复杂的键盘记录器，例如 Turla。hooktracer_messagehooks，它使用 Hooktracer 自动确定内存中的钩子是否与恶意键盘记录器或良性软件相关联。我们还包括一个详细的案例研究，说明我们的技术能够成功分析非常复杂的键盘记录器，例如 Turla。