# ATMMalScan | Tool for Windows which helps to search for malware traces

**URL:** <https://onehack.st/t/atmmalscan-tool-for-windows-which-helps-to-search-for-malware-traces/170784>\
**Category:** Tools & Scripts\
**Tags:** tools, windows, documents\
**Created:** [January 25, 2021, 2:06am UTC](https://onehack.st/t/atmmalscan-tool-for-windows-which-helps-to-search-for-malware-traces/170784 "2021-01-25T02:06:21Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [January 25, 2021, 2:06am UTC](https://onehack.st/t/atmmalscan-tool-for-windows-which-helps-to-search-for-malware-traces/170784/1 "2021-01-25T02:06:21Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/7/1779f94b387213eb77829f5959a23340a8ad3a01.png)

# Introduction

ATMMalScan is a commandline tool for Windows operating systems version 7 and higher, which helps to search for malware traces on an ATM during the DFIR process. This tool examines the running processes of a system, as well as the hard disk, depending on the specified file path. To scan a system, a user with standard rights is sufficient. However, ATMMalScan provides the best results with administrator privileges.

# Known issues:

Currently ATMMalScan does not support codepages that require Unicode, this means Windows operating systems that are set to e.g. Cyrillic or Chinese characters, no representative result can be guaranteed.

# Requirements:

Make sure at least Visual C++ Redistributable for Visual Studio 2015 has been installed on the ATM, you like to scan.

# Usage (Example)

Step1 =\> Scan process memory and disk. ===\> Check if Admin privileges are available on the device for best results! [![](https://github.com/fboldewin/ATMMalScan/raw/main/graphics/1-Scan-Mem-Disk.PNG)](https://github.com/fboldewin/ATMMalScan/blob/main/graphics/1-Scan-Mem-Disk.PNG)

Step2 =\> ATMMalScan detected a Malware called XFS\_DIRECT in a process, gives details about the thread and its rules matches. Further a full processmemory dump has been saved to disk, to catch the malicious process, its modules, as well as its stack and heap pages. [![](https://github.com/fboldewin/ATMMalScan/raw/main/graphics/2-Scan-Malware-Detected.PNG)](https://github.com/fboldewin/ATMMalScan/blob/main/graphics/2-Scan-Malware-Detected.PNG)

Step3 =\> Dump can be found here =\> .\Dump  
[![](https://github.com/fboldewin/ATMMalScan/raw/main/graphics/3-Scan-Malware-Dump.PNG)](https://github.com/fboldewin/ATMMalScan/blob/main/graphics/3-Scan-Malware-Dump.PNG)

Step4 =\> Open dumpfile with Windbg and extract the ATM malware to disk using “.writemem” [![](https://github.com/fboldewin/ATMMalScan/raw/main/graphics/4-Windbg-Malware-Extraction.PNG)](https://github.com/fboldewin/ATMMalScan/blob/main/graphics/4-Windbg-Malware-Extraction.PNG)

Step5 =\> Repair the dumped PE with one of your favorite PE-Fixers and start analysing the malware in detail. [![](https://github.com/fboldewin/ATMMalScan/raw/main/graphics/5-PEDumpFixer%2BIDA.PNG)](https://github.com/fboldewin/ATMMalScan/blob/main/graphics/5-PEDumpFixer%2BIDA.PNG)

## GitHub:

> **[GitHub - fboldewin/ATMMalScan](https://github.com/fboldewin/ATMMalScan)**
>
> Contribute to fboldewin/ATMMalScan development by creating an account on GitHub.