Malware Analysis Guide

This document outlines a basic approach to malware analysis, covering static and dynamic techniques, with a progression from basic to advanced methods.

1. Basic Static Analysis

Basic static analysis involves examining a malware sample without executing it. The goal is to quickly gather initial information and identify potential red flags.

Techniques:

• Hashing:
  • Calculate the hash (e.g., MD5, SHA256) of the file.
  • Submit the hash to online services like VirusTotal to check if it's been previously identified as malicious. This provides immediate insight and avoids time spent on already known malware.
• String Extraction:
  • Use strings64.exe (or similar tool) to extract printable strings from the executable.
  • Look for URLs, file paths, registry keys, and other indicators that could hint at the malware's functionality.
    • Note: This is most effective on non-obfuscated or unencrypted malware.
• PE File Analysis:
  • Utilize a tool like PEStudio to inspect the Portable Executable (PE) header.
  • Analyze information such as:
    • Imported and exported functions
    • Section headers
    • Resource information
    • Dependencies
  • This provides a high-level view of how the executable interacts with the system.

2. Basic Dynamic Analysis

Basic dynamic analysis involves executing the malware in a controlled environment to observe its behavior. It's crucial to isolate this environment to prevent infection of your host system or network.

Setup:

• Network Isolation:
  • Crucially Important: Create a dedicated, isolated VLAN (Virtual Local Area Network). Avoid using NAT (Network Address Translation), as this can potentially expose your host network.
  • This isolation prevents malicious activities from spreading to your personal computer or other systems.
• Environment Options:
  • Beginner Friendly: FlareVM is a pre-configured virtual machine for malware analysis, offering a good starting point.
  • Custom Environment: For more control and learning, create your own environment (e.g., Debian for network simulation, Windows 10 Enterprise for the target machine.)
• Recommended Setup:
  • Network Simulation: Use inetd (or inetsim) on your Debian system to mimic real internet services (DNS, HTTP). This will catch malware trying to communicate outside your environment.
  • Victim Machine: Use Windows 10 Enterprise with tools like flarevm or a custom setup tailored to your needs.
  • Note: Be cautious and meticulous with your setup. Many malware authors implement techniques to evade analysis.

Techniques:

• Fake Network:
  • Monitor network activity to see if the malware attempts to connect to a Command and Control (C2) server.
  • inetsim can simulate network services and log DNS requests and HTTP requests.
• Registry Monitoring:
  • Use Regshot to capture registry snapshots before and after executing the malware.
  • Compare the snapshots to identify any changes made by the malware. This is useful for identifying persistence mechanisms.
• Process Monitoring:
  • Use Procmon64 to record all file system, registry, and network activities of the malware.
  • This provides a granular view of what the malware does.
• Process Exploration:
  • Use Process Explorer to monitor active processes.
  • Watch for any abnormal processes, changes, or resource usage.

3. Advanced Static Analysis

Advanced static analysis requires more in-depth knowledge of assembly language and reverse engineering techniques.

Techniques:

• Disassembly:
  • Use tools like Ghidra or IDA Pro to disassemble the malware's binary code.
  • Learn x86 assembly to understand the code flow.
  • Analyze function calls, control flow, and algorithms used by the malware.
  • Note: This technique takes time to learn and master. Start with learning ASM basics before jumping into a full-blown malware disassembling project.

4. Advanced Dynamic Analysis

Advanced dynamic analysis uses debuggers to control the execution of malware and examine its internal state.

Techniques:

• Debugging:
  • Use debuggers such as x64dbg or x32dbg to step through the malware's code.
  • Set breakpoints, inspect registers, and examine memory to understand the logic behind the malware's actions.
  • This is the most powerful but also most complex form of malware analysis.
  • This also takes time to master. You will need to use debugging process in the beginning with some simple projects to see the functionality of a debugger

Important Notes:

• Practice is key: Malware analysis is a skill that takes time and practice to master.
• Start small: Begin with simpler malware samples before tackling more complex ones.
• Stay updated: New malware techniques emerge constantly. Continuously learn and update your skills.
• Be careful: Always practice safe analysis practices within isolated environments and take necessary precautions.