Windows Memory & Network

This room continues the memory investigation from the previous analysis. This is the last room out of 3, and we will be focusing on how network activity and post-exploitation behavior are captured in RAM. We’ll examine artifacts from a live attack involving advance payloads like Meterpreter, suspicious child processes, and unusual outbound connections. All analyses will be performed using Volatility 3 and hands-on techniques applied directly to the memory dump.

We’ll walk through real indicators tied to remote shells, persistence via startup folder abuse, and malware attempting outbound communications. Users will use memory structures, plugin outputs, and process inspection to track network behavior step by step.

Learning Objectives

• Identify network connections in a memory dump.
• Identify suspicious ports and remote endpoints.
• Link connections to processes.
• Detect reverse shells and memory injections in a memory dump.
• Trace PowerShell and C2 activity in memory.

Prerequisites

• Volatility
• Yara
• Windows Memory & Processes
• Windows Memory & User Activity