Memhunter – Automated Memory Resident Malware Detection


Memhunter is an Automated Memory Resident Malware Detection tool for the hunting of memory resident malware at scale, improving the threat hunter analysis process and remediation times.

Memhunter - Automated Memory Resident Malware Detection


It’s a self contained binary that can be deployed and managed at scale, does not use memory dumps and relies purely on memory inspection to do its work. It also does not require any complex infrastructure to deploy.

The tool was designed as a replacement of memory forensic volatility plugins such as malfind and hollowfind. The idea of not requiring memory dumps helps on performing the memory resident malware threat hunting at scale, without manual analysis, and without the complex infrastructure needed to move dumps to forensic environments.

Memhunter in a nutshell:

  • It is an standalone binary that gets itself deployed as a windows service
  • It uses a set of memory inspection heuristics and ETW data collection to find footprints left by common injection techniques.
  • Forensic information on findings gets reported through console or event logs for forwarding

Memhunter Automated Memory Resident Malware Detection Features

The detection process is performed through a combination of endpoint data collection and memory inspection scanners. The tool is a standalone binary that, upon execution, deploys itself as a windows service. Once running as a service, memhunter starts the collection of ETW events that might indicate code injection attacks. The live stream of collected data events is feed into memory inspection scanners that use detection heuristics to down select the potential attacks. The entire detection process does not require human intervention, neither memory dumps, and it can be performed by the tool itself at scale.

  • 9 hunter heuristics included (see next slide)
  • 15 code injection techniques implemented on minjector test tool
  • ETW data collection of suspicious events used for heuristic triggering
  • Windows Event Log generation
  • Exclusion of baseline detection
  • Basic forensic information
  • Sqlite storage integration

Memhunter Automated Memory Resident Malware Detection minjector.exe

Besides the data collection and hunting heuristics, the project has also led to the creation of a companion tool called “minjector” that contains +15 code injection techniques. The minjector tool cannot only be used to exercise memhunter detections, but also as a one-stop location to learn on well-known code injection techniques out there.

You can download Memhunter here:

memhunter-master.zip

Or read more here.

Posted in: Forensics


Latest Posts:


Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.
trident - Automated Password Spraying Tool trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling
tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.
Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.


3 Responses to Memhunter – Automated Memory Resident Malware Detection

  1. Sajid al orchid April 5, 2020 at 5:03 pm #

    I want hacking education

  2. Memespeak April 20, 2020 at 11:21 pm #

    If you don\’t mind importing unknown/foriegn libraries blindly, go for it.

    • Darknet April 22, 2020 at 2:24 pm #

      The code is all public on Github, feel free to actually get to know the code and what it does vs whinging.