Category: Endpoint Forensics

Tooling: Volatility 3

Framework: MITRE ATT&CK (Execution, Persistence, PrivEsc, Defense Evasion, C2, Exfiltration)

Overview

Reconstruct Amadey Trojan behavior by analyzing memory dumps with Volatility3 to identify malicious processes, C2 communications, payload delivery, and persistence mechanisms.

Scenario

An after-hours alert from the Endpoint Detection and Response (EDR) system flags suspicious activity on a Windows workstation. The flagged malware aligns with the Amadey Trojan Stealer. Your job is to analyze the presented memory dump and create a detailed report for actions taken by the malware.

1. Introduction

This lab simulates a real-world incident response scenario in which a cybersecurity analyst investigates a suspected malware infection involving the Amadey Trojan Stealer. Following an after-hours alert generated by an Endpoint Detection and Response (EDR) system, a memory dump from the affected Windows workstation was provided for forensic analysis.

Amadey is a well-known modular malware family specializing in:

• System reconnaissance
• Credential harvesting
• Data collection
• Persistent communication with remote Command and Control (C2) servers

Due to its ability to execute primarily in memory and dynamically load additional modules, Amadey often evades traditional disk-based detection mechanisms. As a result, memory forensics is a critical technique for identifying and understanding its behavior.

This investigation focuses on analyzing the memory image using Volatility 3 to: