SlideShare a Scribd company logo
11
Most read
17
Most read
20
Most read
1
Basic Dynamic Analysis
- malware
by @x00itachi
2
Why and what is malware analysis ?
 To gain an understanding of how a specific piece of malware functions so that
defenses can be built to protect an organization’s network.
 We can write,
 Host-based signatures(HIPS), or indicators, are used to detect malicious code on victim
computers.
 Network signatures(NIPS) are used to detect malicious code by monitoring network
traffic.
 Malware Analysis types –
 Static/Code Analysis
 Dynamic/Behavioral Analysis
3
Brief intro on static analysis….
 Taking a closer look at the suspicious file by examining its static
properties.
 Static properties include the strings embedded into the file, header
details, hashes, embedded resources, packer signatures, metadata such
as the creation date, etc.
 This process also helps determine whether the analyst should take
closer look at the specimen using more comprehensive techniques and
where to focus the subsequent steps.
4
What is dynamic analysis ?
 When performing behavioral analysis, look for changes to the system
as well as any unusual behavior on an infected system.
 Changes on the system that should raise a red flag include files that
have been added and/or modified, new services that have been
installed, new processes that are running, any registry modifications
noting which modifications took place, and finally, if any systems
settings have been modified.
 Beside the behavior of the system itself, network traffic will also be
examined.
5
Why dynamic analysis ?
 Both types accomplish the same goal of explaining how malware
works, the tools, time and skills required to perform the analysis are
very different.
 Behavioral analysis is how the malware behaves when executed, who it
talks to, what gets installed, and how it runs.
 Both static and dynamic analysis should be performed to gain a
complete understanding on how a particular malware functions.
 Knowing how malware functions allows for better defenses to protect
the organization from this piece of malware
6
Caution while doing!!!
 you must set up a safe environment.
 For the best protection of production
networks, the malware lab should never be
connected to any network.
 Dynamic analysis techniques are extremely
powerful & dynamic analysis can put your
network and system at risk.
7
How we do it ?.....Use tools
 Sandboxes
 Process monitors
 Registry snapshots
 Network service faking tools
 Domain faking tools
 Packet sniffers
8
Tools & use case
9
Sandboxes
 A sandbox is a security mechanism for running untrusted programs in a
safe environment without fear of harming “real” systems.
 Ex: Norman SandBox, GFI Sandbox, Anubis, Joe Sandbox, ThreatExpert, BitBlaze, and
Comodo Instant Malware Analysis
 Malware sandboxes do have a few major drawbacks.
 Ex: the sandbox simply runs the executable, without command-line options.
 The sandbox also may not record all events, because neither you nor the
sandbox may wait long enough.
 Malware may detect the virtual machine, and it might stop running or
behave differently.
Source: Arial 9pt.
10
Monitoring with Process Monitor
 Process Monitor, or procmon,
is an advanced monitoring tool
for Windows that provides a
way to monitor certain registry,
file system, network, process,
and thread activity.
 Procmon monitors all system
calls it can gather as soon as it
is run. sometimes more than
50,000 events a minute. It can
crash a virtual machine using
all available memory.
Source: Arial 9pt.
11
Processes with Process Explorer
 The Process Explorer, free from
Microsoft, is an extremely
powerful task manager that
should be running when you are
performing dynamic analysis.
 You can use Process Explorer to
list active processes, DLLs loaded
by a process, various process
properties, and overall system
information.
Source: Arial 9pt.
12
Registry Snapshots with Regshot
 Regshot is an open source registry comparison tool that allows you to
take and compare two registry snapshots.
Source: Arial 9pt.
13
Faking a Network Using ApateDNS
 Malware often beacons out and eventually communicates with a
commandand-control server.
 You can create a fake network and quickly obtain network indicators,
without actually connecting to the Internet.
 ApateDNS spoofs DNS responses to a user-specified IP address by
listening on UDP port 53 on the local machine.
 It responds to DNS requests with the DNS response set to an IP address
you specify.
Source: Arial 9pt.
14
Source: Arial 9pt.
15
Using INetSim
 INetSim is a free, Linux-based software suite for simulating common
Internet services.
 INetSim is the best free tool for providing fake services, allowing you to
analyze the network behavior of unknown malware samples by
emulating services such as HTTP, HTTPS, FTP, IRC, DNS, SMTP, and
others.
 INetSim does its best to look like a real server, and it has many easily
configurable features to ensure success.
 Ex: by default, it returns the banner of Microsoft IIS web server if is it scanned
and INetSim can serve almost any file requested.
Source: Arial 9pt.
16
Source: Arial 9pt.
17
Monitoring with Netcat
 Netcat, the “TCP/IP Swiss Army knife,” can be used over both inbound
and outbound connections for port scanning, tunneling, proxying, port
forwarding, and much more.
Source: Arial 9pt.
18
Packet Sniffing with Wireshark
 Wireshark is an open source sniffer, a packet capture tool that intercepts and logs network
traffic.
 Wireshark provides visualization, packet-stream analysis, and in-depth analysis of individual
packets.
Source: Arial 9pt.
19
Demo
Source: Arial 9pt.
20
Source: Arial 9pt.
THANKS TO :

More Related Content

PPTX
Malware Static Analysis
PPTX
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
PPT
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
PPTX
Introduction to Malware Analysis
PDF
Threat Intelligence 101 - Steve Lodin - Submitted
PDF
Threat Intelligence
PDF
Network Address Translation (NAT)
PDF
Introduction to artificial intelligence
Malware Static Analysis
Practical Malware Analysis: Ch 2 Malware Analysis in Virtual Machines & 3: Ba...
Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs
Introduction to Malware Analysis
Threat Intelligence 101 - Steve Lodin - Submitted
Threat Intelligence
Network Address Translation (NAT)
Introduction to artificial intelligence

What's hot (20)

PPTX
Ethical Hacking n VAPT presentation by Suvrat jain
PPTX
Malware analysis
PPTX
Directory Traversal & File Inclusion Attacks
PPT
Intrusion Detection Systems and Intrusion Prevention Systems
PPTX
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
PPTX
Introduction to penetration testing
PPTX
Metasploit framwork
PPTX
WannaCry Ransomware
PPTX
Cross Site Scripting ( XSS)
PPTX
Malware forensic
PPT
Penetration Testing Basics
PDF
Malware detection-using-machine-learning
PPTX
Ethical hacking : Its methodologies and tools
PPT
Introduction to Web Application Penetration Testing
PPTX
Red Team vs. Blue Team
PPTX
Basic malware analysis
PDF
Nessus Software
PPTX
Introduction to IDS & IPS - Part 1
PPTX
Basic Malware Analysis
PPTX
Web application security
Ethical Hacking n VAPT presentation by Suvrat jain
Malware analysis
Directory Traversal & File Inclusion Attacks
Intrusion Detection Systems and Intrusion Prevention Systems
Practical Malware Analysis: Ch 0: Malware Analysis Primer & 1: Basic Static T...
Introduction to penetration testing
Metasploit framwork
WannaCry Ransomware
Cross Site Scripting ( XSS)
Malware forensic
Penetration Testing Basics
Malware detection-using-machine-learning
Ethical hacking : Its methodologies and tools
Introduction to Web Application Penetration Testing
Red Team vs. Blue Team
Basic malware analysis
Nessus Software
Introduction to IDS & IPS - Part 1
Basic Malware Analysis
Web application security
Ad

Similar to Basic Dynamic Analysis of Malware (20)

PDF
Cyber Defense Forensic Analyst - Real World Hands-on Examples
PPTX
IDS+Honeypots Making Security Simple
PDF
Bro Policy Assignment
PPTX
Cyber warfare introduction
DOCX
Security Handbook
PPTX
Information security & EthicalHacking
PDF
Pentesting Tools to Find Bugs Before Hackers | CyberPro Magazine
PPTX
Security Threats and Vulnerabilities-2.pptx
PPSX
Security measures for networking
PPTX
Cryptography and system security
PPTX
Final project.ppt
PDF
SANS Digital Forensics and Incident Response Poster 2012
PPTX
Honeypots.ppt1800363876
PDF
Network Vulnerabilities And Cyber Kill Chain Essay
PPTX
scanning and analysis tools Fuzz testing
PPTX
Introduction To Ethical Hacking
DOCX
Running Head Security Assessment Repot (SAR) .docx
PDF
Attackers May Depend On Social Engineering To Gain...
PDF
Incident handling is a clearly defined set of procedures to manage and respon...
PDF
Bsides Tampa Blue Team’s tool dump.
Cyber Defense Forensic Analyst - Real World Hands-on Examples
IDS+Honeypots Making Security Simple
Bro Policy Assignment
Cyber warfare introduction
Security Handbook
Information security & EthicalHacking
Pentesting Tools to Find Bugs Before Hackers | CyberPro Magazine
Security Threats and Vulnerabilities-2.pptx
Security measures for networking
Cryptography and system security
Final project.ppt
SANS Digital Forensics and Incident Response Poster 2012
Honeypots.ppt1800363876
Network Vulnerabilities And Cyber Kill Chain Essay
scanning and analysis tools Fuzz testing
Introduction To Ethical Hacking
Running Head Security Assessment Repot (SAR) .docx
Attackers May Depend On Social Engineering To Gain...
Incident handling is a clearly defined set of procedures to manage and respon...
Bsides Tampa Blue Team’s tool dump.
Ad

Recently uploaded (20)

PDF
Advanced methodologies resolving dimensionality complications for autism neur...
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
PDF
Approach and Philosophy of On baking technology
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
PDF
Electronic commerce courselecture one. Pdf
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
PDF
Review of recent advances in non-invasive hemoglobin estimation
PPTX
Understanding_Digital_Forensics_Presentation.pptx
PDF
Network Security Unit 5.pdf for BCA BBA.
PDF
Encapsulation_ Review paper, used for researhc scholars
DOCX
The AUB Centre for AI in Media Proposal.docx
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
PPT
“AI and Expert System Decision Support & Business Intelligence Systems”
PDF
cuic standard and advanced reporting.pdf
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
PPTX
Big Data Technologies - Introduction.pptx
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
Advanced methodologies resolving dimensionality complications for autism neur...
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Reach Out and Touch Someone: Haptics and Empathic Computing
Approach and Philosophy of On baking technology
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
Electronic commerce courselecture one. Pdf
Per capita expenditure prediction using model stacking based on satellite ima...
Review of recent advances in non-invasive hemoglobin estimation
Understanding_Digital_Forensics_Presentation.pptx
Network Security Unit 5.pdf for BCA BBA.
Encapsulation_ Review paper, used for researhc scholars
The AUB Centre for AI in Media Proposal.docx
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
CIFDAQ's Market Insight: SEC Turns Pro Crypto
Mobile App Security Testing_ A Comprehensive Guide.pdf
“AI and Expert System Decision Support & Business Intelligence Systems”
cuic standard and advanced reporting.pdf
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
Big Data Technologies - Introduction.pptx
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx

Basic Dynamic Analysis of Malware

  • 1. 1 Basic Dynamic Analysis - malware by @x00itachi
  • 2. 2 Why and what is malware analysis ?  To gain an understanding of how a specific piece of malware functions so that defenses can be built to protect an organization’s network.  We can write,  Host-based signatures(HIPS), or indicators, are used to detect malicious code on victim computers.  Network signatures(NIPS) are used to detect malicious code by monitoring network traffic.  Malware Analysis types –  Static/Code Analysis  Dynamic/Behavioral Analysis
  • 3. 3 Brief intro on static analysis….  Taking a closer look at the suspicious file by examining its static properties.  Static properties include the strings embedded into the file, header details, hashes, embedded resources, packer signatures, metadata such as the creation date, etc.  This process also helps determine whether the analyst should take closer look at the specimen using more comprehensive techniques and where to focus the subsequent steps.
  • 4. 4 What is dynamic analysis ?  When performing behavioral analysis, look for changes to the system as well as any unusual behavior on an infected system.  Changes on the system that should raise a red flag include files that have been added and/or modified, new services that have been installed, new processes that are running, any registry modifications noting which modifications took place, and finally, if any systems settings have been modified.  Beside the behavior of the system itself, network traffic will also be examined.
  • 5. 5 Why dynamic analysis ?  Both types accomplish the same goal of explaining how malware works, the tools, time and skills required to perform the analysis are very different.  Behavioral analysis is how the malware behaves when executed, who it talks to, what gets installed, and how it runs.  Both static and dynamic analysis should be performed to gain a complete understanding on how a particular malware functions.  Knowing how malware functions allows for better defenses to protect the organization from this piece of malware
  • 6. 6 Caution while doing!!!  you must set up a safe environment.  For the best protection of production networks, the malware lab should never be connected to any network.  Dynamic analysis techniques are extremely powerful & dynamic analysis can put your network and system at risk.
  • 7. 7 How we do it ?.....Use tools  Sandboxes  Process monitors  Registry snapshots  Network service faking tools  Domain faking tools  Packet sniffers
  • 9. 9 Sandboxes  A sandbox is a security mechanism for running untrusted programs in a safe environment without fear of harming “real” systems.  Ex: Norman SandBox, GFI Sandbox, Anubis, Joe Sandbox, ThreatExpert, BitBlaze, and Comodo Instant Malware Analysis  Malware sandboxes do have a few major drawbacks.  Ex: the sandbox simply runs the executable, without command-line options.  The sandbox also may not record all events, because neither you nor the sandbox may wait long enough.  Malware may detect the virtual machine, and it might stop running or behave differently. Source: Arial 9pt.
  • 10. 10 Monitoring with Process Monitor  Process Monitor, or procmon, is an advanced monitoring tool for Windows that provides a way to monitor certain registry, file system, network, process, and thread activity.  Procmon monitors all system calls it can gather as soon as it is run. sometimes more than 50,000 events a minute. It can crash a virtual machine using all available memory. Source: Arial 9pt.
  • 11. 11 Processes with Process Explorer  The Process Explorer, free from Microsoft, is an extremely powerful task manager that should be running when you are performing dynamic analysis.  You can use Process Explorer to list active processes, DLLs loaded by a process, various process properties, and overall system information. Source: Arial 9pt.
  • 12. 12 Registry Snapshots with Regshot  Regshot is an open source registry comparison tool that allows you to take and compare two registry snapshots. Source: Arial 9pt.
  • 13. 13 Faking a Network Using ApateDNS  Malware often beacons out and eventually communicates with a commandand-control server.  You can create a fake network and quickly obtain network indicators, without actually connecting to the Internet.  ApateDNS spoofs DNS responses to a user-specified IP address by listening on UDP port 53 on the local machine.  It responds to DNS requests with the DNS response set to an IP address you specify. Source: Arial 9pt.
  • 15. 15 Using INetSim  INetSim is a free, Linux-based software suite for simulating common Internet services.  INetSim is the best free tool for providing fake services, allowing you to analyze the network behavior of unknown malware samples by emulating services such as HTTP, HTTPS, FTP, IRC, DNS, SMTP, and others.  INetSim does its best to look like a real server, and it has many easily configurable features to ensure success.  Ex: by default, it returns the banner of Microsoft IIS web server if is it scanned and INetSim can serve almost any file requested. Source: Arial 9pt.
  • 17. 17 Monitoring with Netcat  Netcat, the “TCP/IP Swiss Army knife,” can be used over both inbound and outbound connections for port scanning, tunneling, proxying, port forwarding, and much more. Source: Arial 9pt.
  • 18. 18 Packet Sniffing with Wireshark  Wireshark is an open source sniffer, a packet capture tool that intercepts and logs network traffic.  Wireshark provides visualization, packet-stream analysis, and in-depth analysis of individual packets. Source: Arial 9pt.