Analyzing command-line arguments

Analyzing command-line arguments is very important because it allows you to check the location from which the executable was run and the arguments passed to it. These arguments can include IP addresses or hostnames of other compromised hosts, stolen credentials, malicious filenames, and entire scripts, as shown in the following screenshot:

Figure 5.8 – The command-line arguments used by the Emotet operators

Let's explore a few ways to get the data of interest.

Command line arguments of the processes

First of all, we can use the pstree plugin that we are already familiar with and add the -v option to it. This will allow us to output the process tree together with detailed information about the command line used to start a particular program. This is how the output, as shown in Figure 5.7, will change with the addition of the -v option:

Figure 5.9 – The verbose pstree output

As...