Book Image

Malware Analysis Techniques

By : Dylan Barker
Book Image

Malware Analysis Techniques

By: Dylan Barker

Overview of this book

Malicious software poses a threat to every enterprise globally. Its growth is costing businesses millions of dollars due to currency theft as a result of ransomware and lost productivity. With this book, you'll learn how to quickly triage, identify, attribute, and remediate threats using proven analysis techniques. Malware Analysis Techniques begins with an overview of the nature of malware, the current threat landscape, and its impact on businesses. Once you've covered the basics of malware, you'll move on to discover more about the technical nature of malicious software, including static characteristics and dynamic attack methods within the MITRE ATT&CK framework. You'll also find out how to perform practical malware analysis by applying all that you've learned to attribute the malware to a specific threat and weaponize the adversary's indicators of compromise (IOCs) and methodology against them to prevent them from attacking. Finally, you'll get to grips with common tooling utilized by professional malware analysts and understand the basics of reverse engineering with the NSA's Ghidra platform. By the end of this malware analysis book, you’ll be able to perform in-depth static and dynamic analysis and automate key tasks for improved defense against attacks.

Related Content you might be interested in

Current Title:

Small book image
Malware Analysis Techniques
Dylan Barker
Jun, 2021 | 282 pages
Small book image
Hands-On Data Structures and Algorithms with Python – Third Edition
Dr. Basant Agarwal
Jul, 2022 | 496 pages
Table of Contents (17 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Download the color images
Conventions used
Get in touch
Reviews
1
Section 1: Basic Techniques
Section 1: Basic Techniques
Free Chapter
2
Chapter 1: Creating and Maintaining your Detonation Environment
Chapter 1: Creating and Maintaining your Detonation Environment
Technical requirements
Setting up VirtualBox with Windows 10
Installing the FLARE VM package
Isolating your environment
Maintenance and snapshotting
Summary
3
Chapter 2: Static Analysis – Techniques and Tooling
Chapter 2: Static Analysis – Techniques and Tooling
Technical requirements
The basics – hashing
Avoiding rediscovery of the wheel
Getting fuzzy
Picking up the pieces
Challenges
Summary
Further reading
4
Chapter 3: Dynamic Analysis – Techniques and Tooling
Chapter 3: Dynamic Analysis – Techniques and Tooling
Technical requirements
Detonating your malware
Discovering enumeration by the enemy
Case study – Dharma
Discovering persistence mechanisms
Using PowerShell for triage
Persistence identification
Checking user logons
Locating secondary stages
Examining NTFS (NT File System) alternate data streams
Challenge
Summary
5
Chapter 4: A Word on Automated Sandboxing
Chapter 4: A Word on Automated Sandboxing
Technical requirements
Using HybridAnalysis
Using Any.Run
Installing and using Cuckoo Sandbox
Shortcomings of automated analysis tools
Challenge
Summary
6
Section 2: Debugging and Anti-Analysis – Going Deep
Section 2: Debugging and Anti-Analysis – Going Deep
7
Chapter 5: Advanced Static Analysis – Out of the White Noise
Chapter 5: Advanced Static Analysis – Out of the White Noise
Technical requirements
Dissecting the PE file format
Examining packed files and packers
Utilizing NSA's Ghidra for static analysis
Challenge
Summary
Further reading
8
Chapter 6: Advanced Dynamic Analysis – Looking at Explosions
Chapter 6: Advanced Dynamic Analysis – Looking at Explosions
Technical requirements
Monitoring malicious processes
Network-based deception
Hiding in plain sight
Case study – TrickBot
Challenge
Summary
9
Chapter 7: Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
Chapter 7: Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
Technical requirements
Leveraging API calls to understand malicious capabilities
Identifying anti-analysis techniques
Tackling packed samples
Challenge
Summary
10
Chapter 8: De-Obfuscating Malicious Scripts: Putting the Toothpaste Back in the Tube
Chapter 8: De-Obfuscating Malicious Scripts: Putting the Toothpaste Back in the Tube
Technical requirements
Identifying obfuscation techniques
Deobfuscating malicious VBS scripts
Deobfuscating malicious PowerShell scripts
A word on obfuscation and de-obfuscation tools
Challenges
Summary
11
Section 3: Reporting and Weaponizing Your Findings
Section 3: Reporting and Weaponizing Your Findings
12
Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense
Chapter 9: The Reverse Card: Weaponizing IOCs and OSINT for Defense
Technical requirements
Hashing prevention
Behavioral prevention
Network IOCs – blocking at the perimeter
Common tooling for IOC-based blocking
Challenge
Summary
13
Chapter 10: Malicious Functionality: Mapping Your Sample to MITRE ATT&CK
Chapter 10: Malicious Functionality: Mapping Your Sample to MITRE ATT&CK
Technical requirements
Understanding MITRE's ATT&CK framework
Case study: Andromeda
Utilizing MITRE ATT&CK for C-level reporting
Challenge
Summary
Further reading
14
Section 4: Challenge Solutions
Section 4: Challenge Solutions
15
Chapter 11: Challenge Solutions
Chapter 2 – Static Analysis – Techniques and Tooling
Chapter 3 – Dynamic Analysis – Techniques and Tooling
Chapter 4 – A Word on Automated Sandboxing
Chapter 5 – Advanced Static Analysis – Out of the White Noise
Chapter 6 – Advanced Dynamic Analysis – Looking at Explosions
Chapter 7 – Advanced Dynamic Analysis Part 2 – Refusing to Take the Blue Pill
Chapter 8 – De-Obfuscating Malicious Scripts – Putting the Toothpaste Back in the Tube
Chapter 9 – The Reverse Card – Weaponization of IOCs and OSINT for Defense
Chapter 10 – Malicious Functionality – Mapping Your Sample's Behavior against MITRE ATT&CK
Summary
Why subscribe?
16
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Leave a review - let other readers know what you think

Installing the FLARE VM package

Before the critical step of isolating our VM from the outside world can be undertaken, tools that require the internet to be downloaded must first be loaded on the VM. Our brand-new VM would be largely useless to us without the requisite tools utilized by malware analysts to glean information, of which there are a multitude.

Thankfully, the folks at FireEye have created a wonderful installation package called FLARE VM, a PowerShell script that can automatically download and install nearly every tool a malware analyst would need. The script is publicly available on GitHub at the following address: https://github.com/fireeye/flare-vm. This script will save a great deal of tedium and allow us to instantly install the necessary tooling:

Figure 1.15 – Downloading the FLARE VM package from GitHub

Figure 1.15 – Downloading the FLARE VM package from GitHub

Once you have downloaded the ZIP file containing the repository for FLARE VM, right-click the ZIP archive and extract it. Once extracted, you'll be presented with a directory containing several files, including a .ps1 script. From here, we can begin the tooling installation process.

To begin the tooling installation process, it is first necessary that we obtain an administrative console in PowerShell. To do so, we can utilize WinKey + X, which presents the option to open a Windows PowerShell prompt as an administrator:

Figure 1.16 – Administrative PowerShell option in the Start menu

Figure 1.16 – Administrative PowerShell option in the Start menu

Once the administrative shell has been obtained, starting the installation is a matter of two commands issued in a single line:

cd C:\Users\$Your_Username\Downloads\flare-vm-master\flare-vm-master; powershell.exe -ExecutionPolicy Bypass -File .\Install.ps1

With these commands issued, FLARE's Chocolatey-based installer will take over and prompt for credentials stored as secure strings. Once these credentials are entered, the installation will proceed, rebooting the VM several times, and logging in automatically following each reboot. No further action is required on our part during the installation:

Figure 1.17 – FLARE's install.ps1 prompting for credentials

Figure 1.17 – FLARE's install.ps1 prompting for credentials

Analysis tip

FLARE installs a lot of tools. It may take quite a while to install, depending on the speed of your internet connection. It would be wise to utilize this time to make a sandwich, relax, or catch up on your favorite TV show.

Once the entire process has been completed, you'll be presented with the following desktop:

Figure 1.18 – The FLARE VM desktop

Figure 1.18 – The FLARE VM desktop

Several changes are apparent here. First, we have a FLARE folder, which is chock full of great malware analysis and dissection tools.

Additionally, you have the official FLARE VM wallpaper. Our malware analysis workstation is now set up and very nearly ready to go!

Previous Section
End of Section 4
Next Section