Dynamic Malware Analysis
What is Dynamic Analysis?
Dynamic malware analysis is the process of observing malware behavior while it’s running in a controlled environment, focusing on its actions such as file system modifications, registry changes, network communication, and process behavior. Unlike static analysis, which examines the code without execution, dynamic analysis reveals how malware interacts with the system in real-time, including its ability to hide, persist, or spread.
Information that can be found during Dynamic Malware Analysis
Behavioral Patterns: Observing how the malware behaves during execution, including file manipulation, registry changes, and interactions with other processes.
Network Traffic: Detailed information about outbound and inbound network connections, including communication with command-and-control (C2) servers, data exfiltration, and protocol analysis.
API Call Analysis: Monitoring specific system calls or APIs used by the malware (e.g., network communication functions, file system access, or cryptographic operations).
Memory Forensics: Analyzing in-memory artifacts, such as hidden malware code, injection techniques, or runtime decryption keys.
Process Injection Techniques: Identifying if the malware attempts to inject itself into other running processes or exploits vulnerabilities in memory.
File System Access: Detecting the creation, modification, or deletion of files by the malware, as well as hidden files or directories.
Evasion Techniques: Methods used by the malware to avoid detection, such as code that checks for debuggers, sandbox environments, or virtual machines.
Privilege Escalation: Malware attempting to gain higher privileges or exploit system vulnerabilities to gain administrative access.
System Resource Consumption: Monitoring changes in system resources like CPU usage, memory consumption, or disk activity triggered by the malware.
Command-Line Arguments: Any command-line arguments passed to the malware during execution, which may provide insight into its function or configuration.
Impact on Other Processes: Effects on other running programs, such as crash, slowdown, or abnormal behavior when interacting with the malware.
User Interaction: If the malware requires user interaction for activation or if it mimics legitimate software or phishing attempts to deceive users.
How to perform Dynamic Analysis and tools used for it
RegShot(Registry Snapshot) is a lightweight Windows tool that captures snapshots of the system’s registry before and after making changes, allowing for easy comparison to detect modifications. It is commonly used in malware analysis to identify changes made by suspicious programs.
Select “1st shot” to take the first shot
The report after taking the first shot.
Now run the malware
There is no option to close this window
Now take the 2nd shot
This is the result of the second shot
Now compare both the shot to check if there is any change in files by selecting “compare”
A txt file will be opened after comparing both the results showing in detail of things and its path that gets changed
Get Dante’s stories in your inbox
Join Medium for free to get updates from this writer.
here we can see the keys added
We can see that a “READ_IT.txt” file has been created like what we saw during static analysis.
The READ_IT.txt is created in the desktop
Now to test if it really encrypts a file i created a txt file called “test.txt”
After executing the malware we can see that the file type has been changed.
unable to open this type of file
I changed the name by removing .WINDOWS back to “test.txt” and opened it but the text inside it was encrypted.
Change the network to NAT and run FAKENET
Wireshark is a powerful network analysis tool that captures and inspects live or recorded network traffic, helping detect malware communication patterns. It is used in malware analysis to identify malicious domains, C2 server connections, and data exfiltration attempts.
Open wireshark select loopback traffic capture
Loopback Traffic Capture: Captures traffic that stays within the same device, such as communication between local applications (e.g., a browser talking to a local proxy). It does not go through a physical network interface and is often used for analyzing malware that communicates internally.
Procmon (Process Monitor) is a Windows tool from Sysinternals that captures real-time system activity, including file, registry, process, and network operations.
We can see the change in the registry values which we found in regshot
We can see file activity.
There is no network activity for this Ransomware
Dynamic Analysis Findings
- Registry Changes: 5 registry keys were deleted, and 20 new keys were added, indicating potential persistence mechanisms or system modifications.
- File System Activity: Files in
C:/Userswere encrypted, confirming ransomware behavior. - Network Activity: No outbound or inbound network activity was detected, suggesting offline encryption without C2 communication.
- Process Behavior: The malware executed encryption routines without external dependencies.
