Mandiant® - Detect. Respond. Contain.

Software Downloads

Memoryze™

  • Find Evil in Live Memory

    Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.

    Mandiant’s Memoryze features:

    • image the full range of system memory (not reliant on API calls).
    • image a process’ entire address space to disk. This includes a process’ loaded DLLs, EXEs, heaps and stacks. image a specified driver or all drivers loaded in memory to disk.
    • enumerate all running processes (including those hidden by rootkits). For each process, Memoryze can:
      • report all open handles in a process (for example, all files, registry keys, etc.). list the virtual address space of a given process including:
        • displaying all loaded DLLs.
        • displaying all allocated portions of the heap and execution stack.
      • list all network sockets that the process has open, including any hidden by rootkits.
      • specify the functions imported by the EXE and DLLs.
      • specify the functions exported by the EXE and DLLs.
      • hash the EXE and DLLs in the process address space> (MD5, SHA1, SHA256.  This is disk based.)
      • verify the digital signatures of the EXE and DLLs. (This is disk based.)
      • output all strings in memory on a per process basis.
    • identify all drivers loaded in memory, including those hidden by rootkits. For each driver, Memoryze can:
      • specify the functions the driver imports.
      • specify the functions the driver exports.
      • hash the driver. (MD5, SHA1, SHA256. this is disk based.)
      • verify the digital signature of the driver (This is disk based.)
      • output all strings in memory on a per driver base.
    • report device and driver layering, which can be used to intercept network packets, keystrokes and file activity.
    • identify all loaded kernel modules by walking a linked list.
    • identify hooks (often used by rootkits) in the System Call Table, the Interrupt Descriptor Tables (IDTs) and driver function tables (IRP tables).


    Mandiant’s Memoryze can perform all these functions on live system memory or memory image files – whether they were acquired by Memoryze or other memory acquisition tools.

    Memoryze officially supports:

    • Windows 2000 Service Pack 4 (32-bit)
    • Windows XP Service Pack 2 and Service Pack 3 (32-bit)
    • Windows Vista Service Pack 1 and Service Pack 2 (32-bit)
    • Windows 2003 Service Pack 2 (32-bit)
    • Windows 2003 Service Pack 2 (64-bit)
    • Windows 7 Service Pack 0 (32-bit)
    • Windows 7 Service Pack 0 (64-bit)
    • *Windows 2008 Service Pack 1 and Service Pack 2 (32-bit)
    • Windows 2008 R2 Service Pack 0 (64-bit)

    *Beta Support

    In order to visualize Memoryze’s output, please download Redline™ or use an XML viewer.  Redline is Mandiant’s premier free tool for investigating hosts for signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.

    Check out the ways you can use Memoryze.

    Learn more about Memoryze…check out the Mandiant forums.



    Current Version: Memoryze 2.0
    Release Date: September 28, 2011

    Supported Operating Systems: Windows 2000, Windows 2003, Windows XP, Windows 2008, Windows Vista, Windows 7 (32-bit and 64-bit)

    File Size: 8.37 MB

    Integrity Hashes:

    ZIP
      MD5: 0E1D6E428F025C5565BB497AA315A328
      SHA-1: BEFCC31DDCC7CEA940A3C3CA4B0E39646EBCF603

    Extracted
      MD5: 66e62d5c2ce62f9d77f139e623f7f48d
      SHA-1: bf4fc70d4756ed8b654b485737f836764a72153e

    Download Memoryze™