Malware Analysis Techniques

Dylan Barker

• Publisher: Packt Publishing
• Year: 2021
• eBook ISBN: 9781839210068
• Edition: 1
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Analyze malicious samples, write reports, and use industry-standard methodologies to confidently triage and analyze adversarial software and malwareKey Features• Investigate, detect, and respond to various types of malware threat• Understand how to use what you've learned as an analyst to produce actionable IOCs and reporting• Explore complete solutions, detailed walkthroughs, and case studies of real-world malware samplesBook DescriptionMalicious software poses a threat to every enterprise globally. Its growth is costing businesses millions of dollars due to currency theft as a result of ransomware and lost productivity. With this book, you'll learn how to quickly triage, identify, attribute, and remediate threats using proven analysis techniques. Malware Analysis Techniques begins with an overview of the nature of malware, the current threat landscape, and its impact on businesses. Once you've covered the basics of malware, you'll move on to discover more about the technical nature of malicious software, including static characteristics and dynamic attack methods within the MITRE ATT&CK framework. You'll also find out how to perform practical malware analysis by applying all that you've learned to attribute the malware to a specific threat and weaponize the adversary's indicators of compromise (IOCs) and methodology against them to prevent them from attacking. Finally, you'll get to grips with common tooling utilized by professional malware analysts and understand the basics of reverse engineering with the NSA's Ghidra platform. By the end of this malware analysis book, you'll be able to perform in-depth static and dynamic analysis and automate key tasks for improved defense against attacks.What you will learn• Discover how to maintain a safe analysis environment for malware samples• Get to grips with static and dynamic analysis techniques for collecting IOCs• Reverse-engineer and debug malware to understand its purpose• Develop a well-polished workflow for malware analysis• Understand when and where to implement automation to react quickly to threats• Perform malware analysis tasks such as code analysis and API inspectionWho this book is forThis book is for incident response professionals, malware analysts, and researchers who want to sharpen their skillset or are looking for a reference for common static and dynamic analysis techniques. Beginners will also find this book useful to get started with learning about malware analysis. Basic knowledge of command-line interfaces, familiarity with Windows and Unix-like filesystems and registries, and experience in scripting languages such as PowerShell, Python, or Ruby will assist with understanding the concepts covered.

Section 1: Basic Techniques

The primary goal of Section 1 will be to, through examples, labs, and challenges, build a foundation for you to understand malware analysis and basic techniques that can be utilized to understand adversarial software.

We'll use case study labs to demonstrate the efficacy of even basic analysis techniques and how they have saved time, property, and sometimes the world in the past.

This part of the book comprises the following chapters:

• Chapter 1, Creating and Maintaining Your Detonation Environment
• Chapter 2, Static Analysis – Techniques and Tooling
• Chapter 3, Dynamic Analysis – Techniques and Tooling
• Chapter 4, A Word on Automated Sandboxing

Chapter 1: Creating and Maintaining your Detonation Environment

Malware can be slippery, difficult to dissect, and prone to escapism. As malware analysts, however, we frequently find ourselves in a position where it's necessary to be able to both examine the binaries and samples we come across, as well as actively run the samples and observe their behavior in a semi-live environment. Observing how the malware behaves within a real-world OS informs us as analysts how to better defend and remediate infections of the same kind we come across.

Such needs present several challenges:

• How do we execute and study malicious code while ensuring our real environments remain safe and we do not assist the malware authors in propagating their code?
• What tools do we require to ensure that we're able to adequately study the malware?
• How do we achieve the two aforementioned goals in a repeatable fashion so that we do not have to rebuild our environment after every piece of malware we study?

In this chapter, we'll review how it's possible to set up a VM specifically for the purposes of analyzing adversarial code, while simultaneously ensuring that we remain on good terms with our friends in Systems Administration, and do not spread our samples across the network, thereby defeating the purposes of our analysis.

In this chapter, we'll cover the following topics:

• Setting up VMware Workstation with Windows 10
• Tooling installation – FLARE
• Isolating your environment
• Maintenance and snapshotting

Technical requirements

The following are the requirements for this chapter:

• A PC/Mac with at least 8 GB of memory and a quad-core processor
• An internet connection
• FLARE VM GitHub package: https://github.com/fireeye/flare-vm
• The latest VirtualBox installer: https://virtualbox.org/wiki/downloads
• A Windows 10 ISO and product key

Setting up VirtualBox with Windows 10

An excellent tool, which is also free (as in beer), is Oracle's VirtualBox. We'll utilize this software package to create our malware analysis environment with a Windows 10 VM.

To begin, we'll navigate to the VirtualBox download page, which can be found at https://virtualbox.org/wiki/downloads. The page should look like the one shown in the following screenshot:

Figure 1.1 – Downloading VirtualBox for macOS, Windows, and Linux

Let's now move on to downloading and installing VirtualBox.

Downloading and verifying VirtualBox

Here, we can select our host OS, with Linux, macOS, and Windows all supported platforms. In this instance, the process will be completed in macOS, but post-installation, the steps are largely the same, and generally platform-agnostic. Begin by selecting your host OS and downloading the latest package for VirtualBox.

As with downloading any binary or package from the internet, it is an excellent idea to ensure that the download is neither corrupt nor has been tampered with during transit.

Thankfully, Oracle provides pre-computed SHA256 sums of their packages, and we can use sha256sum on either Linux or Mac to ascertain whether we have the correct package:

Figure 1.2 – The SHA256 sum of the downloaded file

Once we have computed the SHA256 in our terminal, we can compare it to known hashes on the VirtualBox page found at https://www.virtualbox.org/download/hashes/6.1.12/SHA256SUMS. Here, we can see that we have a matching hash and can proceed with the installation:

Figure 1.3 – The list of known good hashes published for VirtualBox's installer packages

Installing Windows 10

Once you have gone through the installation steps for VirtualBox on your platform and have run the application, you'll be presented with the following screen. We can now begin building our environment:

Figure 1.4 – The VirtualBox main screen

In order to create our malware analysis environment, it will be necessary to have a Windows 10 installation ISO....

Table of contents

• Malware Analysis Techniques
• Contributors
• Preface
• Section 1: Basic Techniques
• Chapter 1: Creating and Maintaining your Detonation Environment
• Chapter 2: Static Analysis – Techniques and Tooling
• Chapter 3: Dynamic Analysis – Techniques and Tooling
• Chapter 4: A Word on Automated Sandboxing
• Section 2: Debugging and Anti-Analysis – Going Deep
• Chapter 5: Advanced Static Analysis – Out of the White Noise
• Chapter 6: Advanced Dynamic Analysis – Looking at Explosions
• Chapter 7: Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
• Chapter 8: De-Obfuscating Malicious Scripts: Putting the Toothpaste Back in the Tube
• Section 3: Reporting and Weaponizing Your Findings
• Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense
• Chapter 10: Malicious Functionality: Mapping Your Sample to MITRE ATT&CK
• Section 4: Challenge Solutions
• Chapter 11: Challenge Solutions
• Other Books You May Enjoy