Notes for Basic Dynamic Malware Analysis

From: Basic Dynamic Analysis - Practical Malware Analysis

Here's a sample steps for malware analysis.

Setup:

1. Running procmon and setting a filter one the malware executable name and clearing out all events just before running.
2. Starting Process Explorer.
3. Gathering a first snapshot of the registry using Regshot.
4. Setting up your virtual network to your liking using INetSim and ApateDNS.
5. Setting up network traffic logging using Wireshark.

Analysis:

1. Examine ApateDNS to see if DNS request were performed.
2. Review the procmon results for file system modifications. (CreateFile, WriteFile, or Closefile)
3. Compare the two snapshots taken with Regshot to identify changes. (Registry)
4. Use Process Explorer to examine the process to determine whether it creates mutexes or listens for incoming connections.
   (Malware may created the mutex to ensure that only one version of the malware is running at a time. Mutexes can provide an excellent fingerprint for malware if they are unique enoough)
5. Review the INetSim logs for requests and attempted connections on standard services.
6. Review the Wireshark capture for network traffic generated by the malware.