Memory Forensics Attack Simulation Dataset

A curated collection of six Windows 10 memory dumps from controlled attack simulations, intended for memory forensics research, detection engineering, malware analysis, incident response, and hands-on training. The scenarios support investigation of process injection, remote access trojans, Cobalt Strike beacons, suspicious execution, persistence, evasion, and command-and-control activity using tools such as Volatility 3, YARA, and Malcat.

Dataset contents

attack1_Unknown_Win10_hard — Win10_Unknown.mem (approximately 7 GB). Unknown infection with suspicious execution, possible beaconing, masquerading, and native tool abuse; persistence is not confirmed.

attack2_process_Injection_hard — attack2_process_Injection.mem (approximately 5 GB). NimPlantv2 process injection, scheduled-task persistence, and suspected outbound command-and-control activity.

attack3_cobaltstrike_beacon_Hard — ColbaltStrike_memdump.mem (approximately 2 GB). Cobalt Strike beacon activity with named pipes and obfuscation; persistence is not confirmed.

attack4_AsyncRAT_infection_Intermediate — AsyncRAT_Win10.mem (approximately 2 GB). Standalone AsyncRAT infection with encrypted HTTP/HTTPS beaconing and activity that blends with normal processes; persistence is unknown.

attack5_MasonRAT_intermediate — MasonRATmemdump.mem (approximately 5 GB). Standalone MasonRAT with outbound command-and-control activity and no injection; persistence is unknown.

attack6_Cobaltstrike_process_inj_Hard — CobaltStrike_Injection_2.mem (approximately 6.28 GB). Cobalt Strike process injection with suspected command-and-control activity; persistence is unknown.

The scenario names above identify the folders in the original source dataset. The six memory images are provided as individual files. Sizes are approximate values reported by Google Drive.

Dataset documentation and scenario overview: https://daniyyell.com/datasets/Memory-Forensics-Attack-Simulation-Dataset/

Authors: Daniel Jeremiah and Husnain Rafiq. Licence: Creative Commons Attribution 4.0 International (CC BY 4.0).

Compression and extraction: Win10_Unknown.mem and CobaltStrike_Injection_2.mem are distributed as losslessly compressed Win10_Unknown.mem.gz and CobaltStrike_Injection_2.mem.gz. Extract each with 7-Zip or gzip -d before analysis to recover the original .mem file. The scenario sizes above describe the uncompressed images. Both archives were extracted and verified against the original byte counts and MD5 checksums.

Original MD5: Win10_Unknown.mem = da46bebebbd3ae046d898a221d44efa9; CobaltStrike_Injection_2.mem = 2594be2d3ffe2f041be4fa68b4fb0279.