Using Volatility 3 to Combat Modern Malware

The talk makes the case for memory forensics. Many serious intrusions, including nation-state campaigns and well-built ransomware, keep their key payloads only in RAM, where disk and network tools miss them. It introduces Volatility 3, a full rewrite of the open-source memory analysis framework, and explains the checks that compare memory region permissions, file backing and loaded-module lists to flag code that was not loaded through legitimate APIs.

The middle section walks through injection techniques. Classic remote DLL injection, raw shellcode and reflective DLL loading stand out when memory regions are compared against the loaded-module lists. Process hollowing, where a legitimate service process is started in a suspended state and its image is replaced, is caught by comparing kernel and user-mode image base addresses, checking for regions with no backing file, and inspecting thread start addresses. The talk also covers cloned processes that split API calls to evade EDRs, process ghosting that runs from deleted files, and a plugin that flags suspended threads. Examples include Stuxnet and Cobalt Strike samples.

The closing point is operational. The speaker ran the suspended-thread check across a set of several hundred Windows memory samples and reported no false positives. Practitioners should capture memory before terminating a suspicious process, because killing it can erase evidence and remove a file-backed payload. The new plugins are meant to fit into production triage across many samples.