Detonating your malware

In malware analysis, some of the most useful information we can gain as analysts comes from simply executing malware and observing the behavior of the sample in question.

While static analysis is invaluable in the sense that it can provide the equivalent of OSINT (Open-Source Intelligence) regarding a sample, it becomes a bit harder for the adversary to hide their intentions when taking action on objective – when their software is executed.

Basic dynamic analysis techniques and tooling will allow us to identify the actions taken by the adversarial software on the machine as well as on the network and allow us to ascertain more about how the malware works – and perhaps what the author's goals are.

Monitoring for processes

In executing malware, it's important to realize that the binary file or scripted malware dropper that we are presented with as an initial vector of infection is rarely all there is to see. Often, the malware...