# Hunting Advanced Malware (Malfind)

If an attacker is somewhat sophisticated, they won't even leave an `evil.exe` running on the system. Instead, they will use **Code Injection**. 

They will take malicious payload code and inject it directly into the memory space of a completely legitimate process, like the real, Microsoft-signed `explorer.exe` (the taskbar). 
If you check `pslist`, `explorer.exe` looks fine. If you check `netscan`, `explorer.exe` is talking to the internet (which is suspicious, but not definitive proof).

How do you prove the legitimate process is "infected"?

## Memory Protections (VAD - Virtual Address Descriptor)
To understand injection, you must understand how Windows protects memory. Windows assigns permissions to blocks of memory using a structure called the Virtual Address Descriptor (VAD).
*   **PAGE_READONLY:** The program can read this memory, but not change it.
*   **PAGE_READWRITE (RW):** The program can store variables and data here.
*   **PAGE_EXECUTE_READ (RX):** The memory contains actual CPU instructions (code) that are allowed to run.

**The Golden Rule:** Data should be `RW`. Code should be `RX`.
It is a massive security risk to allow memory to be both writable AND executable at the same time: **PAGE_EXECUTE_READWRITE (RWX)**.
If a block of memory is `RWX`, an attacker can write malicious code into it, and then instantly execute it. Modern Windows compiles very few programs with `RWX` permissions.

## windows.malfind
The `windows.malfind` plugin is the ultimate malware hunter. 

It ignores the names of processes. It ignores parent-child relationships. Instead, it scans the Virtual Address Descriptor (VAD) of every single process, looking for memory regions marked as **PAGE_EXECUTE_READWRITE (RWX)**.

If it finds an `RWX` section, it then checks if there is an unbacked executable (a program in memory that does not correspond to a physical file on the hard drive).

*   **Syntax:** `python3 vol.py -f image.raw windows.malfind`
*   **Output:** For every hit, it prints the Process Name, the PID, the starting memory address of the injected code, and a hex dump of the first few bytes of that injected code.
*   **What to look for in the Hex Dump:** 
    *   `4D 5A` (MZ) - These are the magic bytes that signify a Windows Executable (PE file).
    *   If you see a legitimate process like `svchost.exe`, and `malfind` highlights a memory region marked `RWX` that starts with `4D 5A`, you have found a reverse shell or beacon fully injected into that process.

## Extracting the Malware
Once `malfind` or `pslist` identifies a malicious PID, you can extract the malware out of the RAM image and save it to your forensic workstation for reverse engineering.

*   **windows.pslist --pid <PID> --dump:** Dumps the entire executable of a running process.
*   **windows.malfind --pid <PID> --dump:** Dumps specifically the hidden, injected code sections identified by the malfind plugin.