https://zviarcyber.github.io/tags/memory-forensics/Recent content in Memory-Forensics on Blue Team Write-upsHugoen-usWed, 24 Jun 2026 00:00:00 +0000https://zviarcyber.github.io/posts/blackenergy-cyberdefenders/Wed, 24 Jun 2026 00:00:00 +0000https://zviarcyber.github.io/posts/blackenergy-cyberdefenders/<h2 id="scenario">Scenario</h2> <blockquote> <p>A multinational corporation has suffered a cyber attack resulting in the theft of sensitive data. The attack used a previously unseen variant of the BlackEnergy v2 malware. The security team obtained a memory dump from the infected machine and needs a SOC analyst to analyse it to understand the scope and impact of the attack.</p></blockquote> <p><strong>Tool used:</strong> Volatility 3.</p> <h2 id="investigation">Investigation</h2> <h3 id="q1-which-volatility-profile-is-best-for-this-machine">Q1. Which Volatility profile is best for this machine?</h3> <p>Starting with <code>windows.info</code> to fingerprint the OS:</p>