Malware Basic Dynamic analysis

In previous blog we studied basics of malware https://medium.com/@jain.sm/malware-introduction-eeb3eb201cb3

In this blog we go over the Dynamic/Run time analysis of malware and tools and setup needed to accomplish the same.

Dynamic analysis is a technique to launch the malware and analyze its behavior during run time. Since we don’t want to run the malware directly to avoid any harm caused by it, we take certain steps to isolate the execution of the malware and then analyze.

One way of doing it is to shut off internet connectivity and run the malware on a physical machine. But malware might not just be doing an internet based attack, but also might be trying things like process hollowing or manipulating registry etc. This might lead to a corrupted physical machine.

Other way is to run the malware in a virtual machine and shut of outside communication by following a host only networking (no NAT to outside). This has a disadvantage as some malwares detect if they are running on virtual environments and they don’t exhibit the desired behavior. Another advantage of using a virtual machine is that we can take a snapshot of the VM post the setup and also if needed from time to time. This will allow us to restore to the functional state even if malware corrupts the VM.

Network setup for the VM could look like the below

The host is connected to internet, but VM traffic cant go to internet to avoid malware establishing an internet…