Book Image

Malware Analysis Techniques

By : Dylan Barker
Book Image

Malware Analysis Techniques

By: Dylan Barker

Overview of this book

Malicious software poses a threat to every enterprise globally. Its growth is costing businesses millions of dollars due to currency theft as a result of ransomware and lost productivity. With this book, you'll learn how to quickly triage, identify, attribute, and remediate threats using proven analysis techniques. Malware Analysis Techniques begins with an overview of the nature of malware, the current threat landscape, and its impact on businesses. Once you've covered the basics of malware, you'll move on to discover more about the technical nature of malicious software, including static characteristics and dynamic attack methods within the MITRE ATT&CK framework. You'll also find out how to perform practical malware analysis by applying all that you've learned to attribute the malware to a specific threat and weaponize the adversary's indicators of compromise (IOCs) and methodology against them to prevent them from attacking. Finally, you'll get to grips with common tooling utilized by professional malware analysts and understand the basics of reverse engineering with the NSA's Ghidra platform. By the end of this malware analysis book, you’ll be able to perform in-depth static and dynamic analysis and automate key tasks for improved defense against attacks.

Related Content you might be interested in

Current Title:

Small book image
Malware Analysis Techniques
Dylan Barker
Jun, 2021 | 282 pages
Small book image
Antivirus Bypass Techniques
Uriel Kosayev | Nir Yehoshua
Jul, 2021 | 242 pages
Small book image
Incident Response Techniques for Ransomware Attacks
Oleg Skulkin
Apr, 2022 | 228 pages
Small book image
Mastering Reverse Engineering
Reginald Wong
Oct, 2018 | 436 pages
Table of Contents (17 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Download the color images
Conventions used
Get in touch
Reviews
1
Section 1: Basic Techniques
Section 1: Basic Techniques
Free Chapter
2
Chapter 1: Creating and Maintaining your Detonation Environment
Chapter 1: Creating and Maintaining your Detonation Environment
Technical requirements
Setting up VirtualBox with Windows 10
Installing the FLARE VM package
Isolating your environment
Maintenance and snapshotting
Summary
3
Chapter 2: Static Analysis – Techniques and Tooling
Chapter 2: Static Analysis – Techniques and Tooling
Technical requirements
The basics – hashing
Avoiding rediscovery of the wheel
Getting fuzzy
Picking up the pieces
Challenges
Summary
Further reading
4
Chapter 3: Dynamic Analysis – Techniques and Tooling
Chapter 3: Dynamic Analysis – Techniques and Tooling
Technical requirements
Detonating your malware
Discovering enumeration by the enemy
Case study – Dharma
Discovering persistence mechanisms
Using PowerShell for triage
Persistence identification
Checking user logons
Locating secondary stages
Examining NTFS (NT File System) alternate data streams
Challenge
Summary
5
Chapter 4: A Word on Automated Sandboxing
Chapter 4: A Word on Automated Sandboxing
Technical requirements
Using HybridAnalysis
Using Any.Run
Installing and using Cuckoo Sandbox
Shortcomings of automated analysis tools
Challenge
Summary
6
Section 2: Debugging and Anti-Analysis – Going Deep
Section 2: Debugging and Anti-Analysis – Going Deep
7
Chapter 5: Advanced Static Analysis – Out of the White Noise
Chapter 5: Advanced Static Analysis – Out of the White Noise
Technical requirements
Dissecting the PE file format
Examining packed files and packers
Utilizing NSA's Ghidra for static analysis
Challenge
Summary
Further reading
8
Chapter 6: Advanced Dynamic Analysis – Looking at Explosions
Chapter 6: Advanced Dynamic Analysis – Looking at Explosions
Technical requirements
Monitoring malicious processes
Network-based deception
Hiding in plain sight
Case study – TrickBot
Challenge
Summary
9
Chapter 7: Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
Chapter 7: Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
Technical requirements
Leveraging API calls to understand malicious capabilities
Identifying anti-analysis techniques
Tackling packed samples
Challenge
Summary
10
Chapter 8: De-Obfuscating Malicious Scripts: Putting the Toothpaste Back in the Tube
Chapter 8: De-Obfuscating Malicious Scripts: Putting the Toothpaste Back in the Tube
Technical requirements
Identifying obfuscation techniques
Deobfuscating malicious VBS scripts
Deobfuscating malicious PowerShell scripts
A word on obfuscation and de-obfuscation tools
Challenges
Summary
11
Section 3: Reporting and Weaponizing Your Findings
Section 3: Reporting and Weaponizing Your Findings
12
Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense
Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense
Technical requirements
Hashing prevention
Behavioral prevention
Network IOCs – blocking at the perimeter
Common tooling for IOC-based blocking
Challenge
Summary
13
Chapter 10: Malicious Functionality: Mapping Your Sample to MITRE ATT&CK
Chapter 10: Malicious Functionality: Mapping Your Sample to MITRE ATT&CK
Technical requirements
Understanding MITRE's ATT&CK framework
Case study: Andromeda
Utilizing MITRE ATT&CK for C-level reporting
Challenge
Summary
Further reading
14
Section 4: Challenge Solutions
Section 4: Challenge Solutions
15
Chapter 11: Challenge Solutions
Chapter 2 – Static Analysis – Techniques and Tooling
Chapter 3 – Dynamic Analysis – Techniques and Tooling
Chapter 4 – A Word on Automated Sandboxing
Chapter 5 – Advanced Static Analysis – Out of the White Noise
Chapter 6 – Advanced Dynamic Analysis – Looking at Explosions
Chapter 7 – Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
Chapter 8 – De-Obfuscating Malicious Scripts – Putting the Toothpaste Back in the Tube
Chapter 9 – The Reverse Card – Weaponization of IOCs and OSINT for Defense
Chapter 10 – Malicious Functionality – Mapping Your Sample's Behavior against MITRE ATT&CK
Summary
Why subscribe?
16
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Leave a review - let other readers know what you think

Maintenance and snapshotting

Now that the basis for the malware analysis VM has been set up, the tools installed, and everything is ready to go, it is important to ensure that the work does not have to be repeated each time we would like to dynamically analyze a new piece of malware.

If we simply detonated each piece of malware on top of the previous samples, it would confuse our indicators of compromise (IOCs), and we would likely be unable to tell what the result of a previous piece of malware was, what the result of the piece we were analyzing was, and what was just normal system activity.

VirtualBox has a built-in feature that has us covered – Snapshots. A snapshot is exactly as it sounds – a moment-in-time representation of how the VM's filesystem, registry, and other features existed precisely when that snapshot was taken. It allows an analyst to revert a VM to a time before it was purposely infected with malware.

To take a golden-image snapshot of our newly created malware analysis VM, we'll navigate to VirtualBox's main menu, click the hamburger button just to the right of our VM name, and then click Snapshots:

Figure 1.21 – The Snapshots pane to take, manage, and delete any snapshot taken of your VM

Figure 1.21 – The Snapshots pane to take, manage, and delete any snapshot taken of your VM

Once clicked, the snapshot pane opens, presenting us with the option to take a current snapshot and name it:

Analysis tip

It's best to have highly descriptive snapshot names so that you aren't left guessing and restoring snapshots blindly in an attempt to find the correct one.

Figure 1.22 – Taking our first snapshot

Figure 1.22 – Taking our first snapshot

When OK is clicked, the VM will pause for a few moments to take an image of the moment-in-time configuration and save it for later restoration. Once complete, we'll be able to see our snapshot in the list of available restore points in VirtualBox, as shown in the following screenshot:

Figure 1.23 – The snapshots panel in VirtualBox

Figure 1.23 – The snapshots panel in VirtualBox

Congratulations! You've created your malware analysis VM and ensured that we can continue to use it even after we detonate malware in it several times, returning it to its previous state with the click of a button.

Welcome to your home for the next 10 chapters.

Analysis tip

Snapshots aren't only great for keeping your VM clean! Initial vectors of malware (such as droppers) no longer work after a given period of time. If you have an infected instance of your VM that you think you'd like to study in the future and are unsure whether you'd be able to re-infect it, take a snapshot!

Previous Section
End of Section 6
Next Section