Timing is Everything: Generic Trigger Events for Malware Memory Dumping
summary
Researchers define a small, generic set of memory-dump triggers that catch unpacked payloads across many families without per-family rules: first network behavior (46% AgentTesla, 84% Emotet, 76% LuckyBot; >90% for several families when combined), first execution and injection/termination dumps, heap content-change with size thresholds, and detection of .NET reflective loads. They implement prioritization, global quotas and discard earlier duplicates to limit pauses and storage, and report >70–99% coverage on evaluated collections depending on trigger mix.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:11Why do we need Memory Dumping?
- 3:45Goals of Memory Dumping
- 5:35Is Memory Dumping that hard?
- 6:47Simple Memory Dumping Triggers
- 8:31Common Issues with Memory Dumping
- 9:39Existing (partial) Open-Source Solutions 1/2
- 10:58Existing (partial) Open-Source Solutions 2/2
- 12:49What are Generic Trigger Events?
- 14:31Trigger Event Overview
- 14:41Aggressive Memory Dumping of Injected Process
- 16:04First Network Behavior Memory Dumping
- 18:02NET Reflective Load Memory Dumping
- 19:05Signature-based Memory Dumping
- 20:38Obstacles 1/2
- 23:10Trigger Statistics - Agent Tesla
- 24:38Trigger Statistics - Emotet
- 25:24Trigger Statistics - Lokibot
- 25:40Trigger Statistics - NanoCore
related talks
01h 00mIntroduction to memory exploitation
13mEvading and crashing anti-malware solutions via data collection overloading during...
47mPrevalent Characteristics in Modern Malware
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
37mDynamic Image Scanning Through System Tracing
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
49mProcess Injection Techniques - Gotta Catch Them All
15mMemoryTrap: Booby Trapping Memory to Counter Memory Disclosure Attacks with...