In Chapter 7, Malware Functionalities and Persistence, we looked at how an attacker can persist on the system by installing on or modifying an existing service. In this section, we will focus on how to investigate services from the memory image. To list the services and their information such as display name, type of service, and startup type from the memory image, you can use the svcscan plugin. In the following example, the malware creates a service of type WIN32_OWN_PROCESS with the display name and service name as svchost. From the binary path, you can tell that the svchost.exe is malicious because it is running from the non-standard path C:\Windows instead of C:\Windows\System32:

$ python vol.py -f svc.vmem --profile=Win7SP1x86 svcscan
Volatility Foundation Volatility Framework 2.6
[REMOVED]
Offset: 0x58e660
Order: 396
Start: SERVICE_AUTO_START
Process ID: 4080
Service Name: svchost
Display Name: svchost
Service Type: SERVICE_WIN32_OWN_PROCESS
Service State: SERVICE_RUNNING
Binary Path: C:\Windows\svchost.exe

For a service that is implemented as DLL (a service DLL), you can display the full path of the service DLL (or a kernel driver) by passing the -v (--verbose) option to the svcscan plugin. The -v option prints detailed information related to the service. The following is an example of the malware that runs a service as a DLL. The Service State is set to SERVICE_START_PENDING, and the start type is set to SERVICE_AUTO_START, which tells you that this service is not yet started and will be automatically started during system startup:

$ python vol.py -f svc.vmem --profile=Win7SP1x86 svcscan
[REMOVED]
Offset: 0x5903a8
Order: 396
Start: SERVICE_AUTO_START
Process ID: -
Service Name: FastUserSwitchingCompatibility
Display Name: FastUserSwitchingCompatibility
Service Type: SERVICE_WIN32_SHARE_PROCESS
Service State: SERVICE_START_PENDING
Binary Path: -
ServiceDll: C:\Windows\system32\FastUserSwitchingCompatibilityex.dll
ImagePath: %SystemRoot%\System32\svchost.exe -k netsvcs

Some malicious programs hijack the existing service that is unused or disabled to persist on the system. An example of such a malware is BlackEnergy, which replaces a legitimate kernel driver called aliide.sys on the disk. This kernel driver is associated with a service named aliide. After replacing the driver, it modifies the registry entry associated with the aliide service and sets it to autostart (that is, the service starts automatically when the system starts). It is hard to detect such attacks. One method to detect such a modification is to keep a list of all the services from a clean memory image, and compare that with the list of services from the suspect image to look for any modification. The following is the service configuration of the aliide service from the clean memory image. The legitimate aliide service is set to on-demand start (the service needs to be manually started) and the service is in the stopped state:

$ python vol.py -f win7_clean.vmem --profile=Win7SP1x64 svcscan
Offset: 0x871c30
Order: 11
Start: SERVICE_DEMAND_START
Process ID: -
Service Name: aliide
Display Name: aliide
Service Type: SERVICE_KERNEL_DRIVER
Service State: SERVICE_STOPPED
Binary Path: -

The following is the svcscan output from a memory image infected with BlackEnergy. After modification, the aliide service is set to autostart (the service starts automatically when the system starts) and is still in the stopped state. What this means is that after restarting the system, the service will automatically start and load the malicious aliide.sys driver. For a detailed analysis of this BlackEnergy dropper, refer to the author's blog post at https://cysinfo.com/blackout-memory-analysis-of-blackenergy-big-dropper/:

$ python vol.py -f be3_big.vmem --profile=Win7SP1x64 svcscan
Offset: 0x881d30
Order: 12
Start: SERVICE_AUTO_START
Process ID: -
Service Name: aliide
Display Name: aliide
Service Type: SERVICE_KERNEL_DRIVER
Service State: SERVICE_STOPPED
Binary Path: -