This blog is inspired by the Certified Blue Team Level 2 Certification that covers 4 domains:
- Malware Analysis
- Threat Hunting
- Advanced SIEM
- Vulnerability Management
The Malware Analysis Process
Obtain the malware > (Static Analysis <> Dynamic Analysis) > Reporting
Static Analysis - Analyzing malware without execution
Dynamic Analysis - Analyzing the behavior of malware through execution
Focus Your Analysis
- Is the file malicious?
- How does the malware modify the system?
- Who does the malware contact and why?
- How can the malware be detected or removed?
Packers
- Compress or encrypt executables.
- Obfuscates program internals.
- May contain anti-analysis features.
Hiding Your Virtual Machine
- Make the VM look as real as possible
- Install common end-user software
- Open multiple files and documents
- Don’t install VM guest tools
- Trick the malware into thinking it is online
VM Installation Checklist
- Install the OS and patches
- Install and run your analysis tools
- Set up host-only networking
- Additional maintenance tasks
- Snapshot!
Incomplete
Account expired, need to upgrade.