Exploring basic malware analysis techniques and tools

Introduction:#

Malware, short for malicious software, poses a constant threat to the digital world. As cyber threats continue to evolve, so must our defenses. One crucial aspect of cybersecurity is malware analysis – the process of dissecting malicious code to understand its behavior and intent. In this blog, we will delve into the basics of malware analysis, covering essential tools and techniques for both static and dynamic analysis.

Importance of a safe sandboxed environment#

Setting up a safe malware analysis sandbox environment is crucial to ensure that the analysis process is controlled, isolated, and does not pose a risk to the surrounding network. Here are important steps for establishing a secure malware analysis sandbox:

1. Isolate the Sandbox:

   • Physically or logically isolate the malware analysis environment from the production network. Use a dedicated machine or virtual environment that is not connected to critical systems.

2. Virtualization:

   • Use virtualization technology such as VMware, VirtualBox, or Hyper-V to create isolated and snapshot-capable environments for analyzing malware. This allows you to revert to a clean state after each analysis session.

3. Network Segmentation:

   • Implement network segmentation to isolate the malware analysis environment from the production network. Use separate subnets or VLANs to prevent the spread of malware beyond the sandbox.

4. Air-Gapped Environment:

   • Consider creating an air-gapped environment by disconnecting the malware analysis machine from the internet. This prevents the malware from communicating with external servers, reducing the risk of unintentional network infections.

5. Use of Proxy Servers:

   • If internet access is necessary for analysis, route traffic through a proxy server. This allows you to monitor and control the network activity of the sandboxed environment.

6. Host-Based Firewall:

   • Enable and configure the host-based firewall on the malware analysis machine to restrict inbound and outbound network traffic. Allow only the necessary communication for analysis purposes.

7. Regular Snapshots and Backups:

   • Take regular snapshots or backups of the malware analysis environment. This ensures that you can quickly revert to a clean state in case of an accidental infection or if the environment becomes compromised.

8. Limited User Privileges:

   • Run the malware analysis environment with limited user privileges. Avoid using administrator accounts for analysis to minimize the impact of potential privilege escalation attempts by malware.

9. Monitoring Tools:

   • Implement monitoring tools such as intrusion detection systems (IDS) or antivirus software within the sandbox. These tools can help identify and contain any malicious activity that may occur during analysis.

My Setup#

I personally have the following setup on VirtualBox which is sufficient for handling generic Malware:

1. FlareVM: A FlareVM host which has no access to the internet but a plethora of tools which would help you analyze the malware. It treats the linux host as a router.
2. RemNUX: A linux host which hosts a variety of tools to aid in your analysis. Typically InetSim and Wireshark gets the work done.
   The Network is supposed to be airtight and no VM is able to connect to the host.

I. Generic Tools of the Trade:#

1. IDA Pro:

   • IDA Pro is a powerful disassembler and debugger that aids in the analysis of binary code. Its interactive interface allows analysts to navigate through assembly code and understand the functionality of a malware sample.

2. Wireshark:

   • Network analysis is fundamental in malware analysis. Wireshark helps in capturing and analyzing network traffic, providing insights into communication patterns, potential command and control servers, and data exfiltration.

3. Process Monitor:

   • For dynamic analysis, Process Monitor by Sysinternals is invaluable. It monitors system and registry activity in real-time, allowing analysts to observe how malware interacts with the operating system.

4. PEiD (PE iDentifier):

   • PEiD is a tool that identifies the packer or compiler used to create a specific executable. Knowing the packer is crucial as it helps in understanding the evasion techniques employed by the malware.

5. YARA:

   • YARA is a powerful pattern-matching tool that helps analysts create custom rules to identify and classify malware based on specific characteristics or behavior.

II. Basic Static Analysis:#

Static analysis involves examining the malware without executing it. Key aspects include:

1. File Metadata:

   • Examine file properties such as file size, creation date, and author information. This data can provide initial insights into the legitimacy of the file.

2. File Type and Headers:

   • Analyze file headers to determine the file type and potential abnormalities. Some malware may try to disguise itself by modifying headers.

3. Strings Analysis:

   • Extract and analyze strings within the binary. This can reveal hardcoded URLs, IP addresses, or other indicators of compromise.

4. Packer Identification:

   • Use tools like PEiD to identify packers. Compressed or encrypted binaries often indicate an attempt to evade detection.

5. Hash Analysis:

   • Calculate and compare hash values (MD5, SHA-1, SHA-256) to identify known malicious files. This aids in building threat intelligence.

6. Procmon (Process Monitor):

   • Procmon, part of the Sysinternals suite, is a real-time monitoring tool that captures system activity, including registry changes, file system activity, and process creations. It helps analysts observe the dynamic behavior of malware during execution.

7. Wireshark:

   • Wireshark, mentioned earlier, is a packet analyzer that allows you to capture and inspect the data traveling back and forth on a network. In dynamic analysis, Wireshark helps identify malicious network communication, including command and control traffic.

8. API Monitor:

   • API Monitor allows analysts to monitor API calls made by a program in real-time. This is crucial for understanding how malware interacts with the operating system and other processes.

9. Dependency Walker:

   • Dependency Walker is a tool that shows the dependencies of a binary, including DLLs and APIs it relies on. Analyzing dependencies can reveal code injection or the use of specific functions indicative of malicious behavior.

10. Regshot:

    • Regshot captures and compares snapshots of the Windows registry. It's useful for identifying changes made by malware to registry keys during execution, such as the creation of autorun entries for persistence.

11. Process Explorer:

    • Also part of the Sysinternals suite, Process Explorer provides a detailed view of active processes, including their associated DLLs and open handles. It's valuable for spotting anomalies and understanding process relationships.

12. Fakenet-NG:

    • Fakenet-NG is a tool designed to simulate network services to deceive malware into revealing its capabilities. It can be configured to imitate services such as HTTP, DNS, and FTP, helping analysts understand how malware interacts with these protocols.

13. CaptureBAT:

    • CaptureBAT (Capture Behavioral Artifacts Tool) is designed to capture and analyze the runtime behavior of malware. It focuses on collecting behavioral artifacts such as file modifications, network activity, and process creations.

III. Basic Dynamic Analysis:#

Dynamic analysis involves executing the malware in a controlled environment to observe its behavior. Key aspects include:

1. Sandboxing:

   • Execute the malware in a controlled environment like a sandbox to monitor its behavior without affecting the host system.

2. Process and Memory Analysis:

   • Use tools like Process Monitor and Process Explorer to observe the malware's interaction with the system and memory.

3. Network Traffic Analysis:

   • Employ Wireshark to capture and analyze network traffic generated by the malware. This reveals communication with external servers.

4. Registry and File System Changes:

   • Monitor changes to the registry and file system using tools like RegShot. Malware often makes modifications to these areas to maintain persistence.

5. Behavioral Analysis:

   • Observe the malware's runtime behavior. Does it attempt to establish network connections, create new processes, or modify system settings?

6. Debugging:

   • Debugging a piece of Malware using something like x32dbg can help pinpoint exactly the instructions and location which cause the actions observed during the dynamic analysis phase. keeping a track of the memory dump can also help understand fully how data is actually being stored or manipulated.

InetSim#

InetSim is one tool which can truly elevate the quality of a sandbox environment by giving it a simulated network connection which is able to respond to multiple internet and network services. FakeNet-NG performs a similar function in a windows centric environment, but I have had better experiences with InetSim.
InetSim, short for Internet Services Simulation, is a versatile and robust tool designed for simulating various internet services in a controlled environment. Developed to aid in cybersecurity training, research, and malware analysis, InetSim provides a simulated environment that mimics the behavior of common internet services without actually connecting to the internet. Let's take a closer look at what makes InetSim a valuable asset
Key Features:

1. Service Emulation:

   • InetSim emulates a range of internet services, including HTTP, HTTPS, FTP, DNS, and more. This allows security professionals and researchers to create a controlled network environment for testing and analysis.

2. Realistic Responses:

   • When malware interacts with the simulated services provided by InetSim, it receives realistic responses. This aids analysts in observing how the malware behaves without exposing it to a real internet connection.

3. Customizable Scenarios:

   • Users can customize InetSim to mimic specific scenarios. For example, it can be configured to simulate a system with certain vulnerabilities or an environment with a specific network setup.

4. Logging and Reporting:

   • InetSim logs all interactions with its simulated services, providing detailed information about the actions taken by malware or other software under analysis. This data is invaluable for post-analysis and threat intelligence.

5. Offline Analysis:

   • InetSim enables analysts to perform offline analysis by creating a controlled environment without the need for an internet connection. This is particularly useful for situations where connectivity poses a risk.
     Use Cases:

6. Malware Analysis:

   • InetSim is widely used in malware analysis to observe how malware interacts with internet services. By creating a controlled environment, analysts can study the behavior of malware without exposing their network to potential threats.

7. Security Training:

   • InetSim serves as a valuable tool in cybersecurity training programs. It allows trainees to experience and respond to simulated cyber threats in a safe and controlled setting.

8. Research and Development:

   • Researchers leverage InetSim to simulate specific network conditions and study the behavior of software under different scenarios. This aids in understanding potential vulnerabilities and developing effective countermeasures.

Conclusion:#

Basic malware analysis is a fundamental skill in the ever-evolving landscape of cybersecurity. By leveraging powerful tools and employing static and dynamic analysis techniques, analysts can gain critical insights into the inner workings of malicious code. As threats continue to advance, so too must our ability to dissect and neutralize them, making malware analysis an indispensable component of a robust cybersecurity strategy.