Moneta¶
What Moneta does¶
Guided SUSA tool journey
Moneta supports memory analysis. In this guide, you will use it to review a controlled process for suspicious memory characteristics and validate the result. The procedure and screenshots provide the practical reference; the surrounding context explains what to record and how to judge the result.
Tool guide at a glance¶
Review a controlled process for suspicious memory characteristics and validate the result.
A verified training memory image with operating-system and acquisition context.
A reproducible memory finding supported by commands, plugin output, and another evidence source.
Evidence and safety
Memory images can contain credentials and personal data. Store them securely and avoid unsupported attribution. Record the input identifier, tool version, relevant commands or settings, time and time zone, output location, and any errors or limitations as you work.
Choose your journey¶
01Understand the evidenceLearn the memory analysis concepts and limitations.Complete when you can explain what the evidence can and cannot show.Beginner · No tool required · 15–25 min 02Follow the Moneta guideWork through the commands, screenshots, and instructional sequence below.Complete when the documented workflow produces its expected output.Guided · SUSA workstation · Time varies 03Interactive labPractise the tool workflow in a safe browser simulation.Complete when the guided result is supported by the case evidence.Beginner · Browser only · 10–20 min 04Full LabInvestigate an authorised training scenario with fewer prompts and preserve a reviewable result.Complete when another analyst can reproduce and verify the outcome.Intermediate · Isolated lab · 45–90 min
How the labs complement this guide
The Interactive Lab is a safe browser simulation for practising the workflow and validation logic. The Full Lab is an independent exercise for an isolated, authorised environment. Confirm the installed tool version and expected output before relying on either exercise in a real case.
Accessing Moneta in SUSA¶
Moneta is a free, open-source live memory analysis tool for Windows. It scans the memory of running processes and looks for indicators of compromise (IOCs) that are commonly associated with malware, process injection, shellcode, reflective DLL loading, process hollowing, and other fileless attack techniques.
Download Moneta from the GitHub repository.
Move the executable to C:\Tools\Moneta.
Open an administrator Command Prompt and navigate to C:\Tools\Moneta. List the running processes:
Replace the example process identifier with the current PID of the authorised process you want to inspect, then run:
Moneta findings require analyst validation, as legitimate software may generate false positives. Prioritise investigation of unbacked executable memory, private RWX regions, injected code, reflectively loaded DLLs, and suspicious memory artefacts in high-risk processes.