Memhunter – Automated Memory Resident Malware Detection

 Memhunter –

Automated Memory Resident Malware Detection

Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving the threat hunter analysis process and remediation times.

It’s a self contained binary that can be deployed and managed at scale, does not use memory dumps and relies purely on memory inspection to do its work. It also does not require any complex infrastructure to deploy.

The tool was designed as a replacement of memory forensic volatility plugins such as malfind and hollowfind. The idea of not requiring memory dumps helps on performing the memory resident malware threat hunting at scale, without manual analysis, and without the complex infrastructure needed to move dumps to forensic environments.

Memhunter in a nutshell:

It is an standalone binary that gets itself deployed as a windows service

It uses a set of memory inspection heuristics and ETW data collection to find footprints left by common injection techniques.

Forensic information on findings gets reported through console or event logs for forwarding

Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving the threat hunter analysis process and remediation times.

It’s a self contained binary that can be deployed and managed at scale, does not use memory dumps and relies purely on memory inspection to do its work. It also does not require any complex infrastructure to deploy.

Memhunter in a nutshell:

.It is an standalone binary that gets itself deployed as a windows service

.It uses a set of memory inspection heuristics and ETW data collection to find footprints left by common injection techniques.

.Forensic information on findings gets reported through console or event logs for forwarding