TITLE:
Security and Forensic Analysis of the Ram of a Computer Infected by a Malware
AUTHORS:
Yanogo Kiswendsida Jean Hermann, Djibo Moumouni, Kahoun Zita Phillipe, Nabollé Rachid Gaetan, Diberot Cidjeu, Gérald Yirga, Ouedraogo Tounwendyam Frederic
KEYWORDS:
Forensic, RAM, CSI Linux, Virus, Tsurugi, Volatility, LiME
JOURNAL NAME:
World Journal of Nano Science and Engineering,
Vol.15 No.1,
March
31,
2025
ABSTRACT: Our world is increasingly immersed in technology and malware pose a formidable threat. Malware exploits security vulnerabilities (on a large scale), causing enormous financial losses and compromise of vital information for many businesses, individuals and government institutions. To counter these attacks, forensic malware analysis is crucial. This research focuses on analyzing the RAM of computers infected with virus. The goal of this research is to enable digital investigators to better understand malware behavior and implement effective solutions to analyze compromised computers. The research question is how IT professionals can better analyze infected computer bur using the right method. This work uses tools such as LiME and Volatility and secure environments such as CSI Linux and Tsurugi Linux. In this search we identify suspicious processes running, as well as suspicious active network connections. The results show characteristic alterations, such as changes in system processes or unusual memory access patterns, aligned with known virus techniques. Forensic analysis on network connections shows that the virus established outbound connections to command and control (C&C) servers to receive instructions and send encrypted data by identifying communications to associated suspicious IP addresses and ports to the C&C. This research is crucial because behavioral analysis of malware contributes to the development of more effective mitigation techniques, thereby reducing the risk of infection. Additionally, this research can be valuable for designing malware decryption tools, providing an opportunity for data recovery after a file encryption attack.