Dynamic malware analysis
As we mentioned previously, the goal of dynamic analysis is to identify any artifacts that are generated in the operating system during file execution and then identify which of these are indicators of compromise that can be associated with the file. The predominant amount of malware that exists continues to target the Windows operating system. So, in this section, we're only going to focus on standing up and developing a dynamic malware analysis environment for Windows-based malware. However, keep in mind that a dynamic analysis environment can be set up for every targeted operating system.
After creating an environment to perform dynamic analysis and execute the file, it is important to understand what types of artifacts are generated during file execution. Four types of categories of artifacts are generated. Let's take a look:
- Network: As we mentioned earlier in this chapter, there are infrastructure-based IOCs that are usually associated...
