Mastering Windows Network Forensics and Investigation Chapter 10: Introduction to Malware

Chapter Topics: Use various tools to monitor and analyze malicious code Use network monitoring tools to observe malware traffic Create malware analysis toolkit

The Purpose of Malware Analysis Malware is a weapon used by hackers to exploit vulnerable systems and networks These “tools” must be analyzed to understand the intent of the intruders Gain understanding about the impact done to target system(s) Understand how the intruder thinks

Tools and Techniques Constructing an effective toolkit for malware analysis –Assign a dedicated system –Isolate dedicated systems used for analysis –Use tools that analyze samples at binary level –Use tools that can analyze run time behavior –Consider freely available Internet-based resources

Analyzing Malicious Code Examine binary executable –Extract ASCII strings to expose: File names Attributes Error/success messages Author’s name or IP addresses Dependent DLLs Tools –EnCase, Ftk, X-ways –Strings –BinText –Dependency Walker –VirusTotal

Analyzing Malicious Code Dynamic Analysis –Monitor behavior of malicious code while its running live Sandbox Virtual Machines –RAM Analysis Tools –Process Monitor –Process Explorer –Wireshark