Introduction to Malware Analysis (in English)

# Introduction
This article is a brief summary of malware analysis.
Also a note to myself. I may be a little too beginner-oriented.
However, abuse is strictly prohibited.


# Who am I ?
I'm a humble engineer.

# Expected readers
  - Those who are new to malware analysis and want to try it
  - others

# What is the purpose of malware analysis in the first place?
It is intended to be useful for investigation during incident response (IR). You should know how malware behaves.

# What should be prepared
The first thing to do is prepare the specimen analysis environment for analyzing malware specimens.
It is necessary to prepare a dedicated environment for running the sample, and basically an offline environment such as a dedicated VM environment should be prepared.
However, there are some malware that do not work without an Internet connection, so I think you should prepare multiple environments.
*Basically, the reason for not connecting to the Internet is that the provider may get angry.
It may also be a good idea to get into the habit of searching for and investigating malware information based on the information in the Sandbox.
In the case of targeted attacks, the specimens are tuned by the organization, so they are often not caught by Virus Total's hash search, etc., so I think it's a good idea to get into the habit of investigating the characteristics of the malware from the specimens yourself. increase.

# Example of malware dynamic analysis environment

Although it is a very miscellaneous example, I will describe an example environment for malware analysis.

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/227947/a8b79ac7-8315-7257-751d-3b0859053654.png)

localhost: physical machine (OS can be anything)
VM(1): Environment for running malware samples (OS changes according to sample type)
VM(2): Attacker's pseudo server (Any OS is fine here as well)

Take a snapshot of VM(1) and VM(2) for backup.

For VMware, the paid version of VMware WorkStation is recommended.

https://www.vmware.com/jp/products/workstation-pro.html


For details on building the environment, see "How to create a hacking lab". It looks like you are using Virtual Box.

https://www.amazon.co.jp/%E3%83%8F%E3%83%83%E3%82%AD%E3%83%B3%E3%82%B0%E3%83%BB%E3%83%A9%E3%83%9C%E3%81%AE%E3%81%A4%E3%81%8F%E3%82%8A%E3%81%8B%E3%81%9F-%E4%BB%AE%E6%83%B3%E7%92%B0%E5%A2%83%E3%81%AB%E3%81%8A%E3%81%91%E3%82%8B%E3%83%8F%E3%83%83%E3%82%AB%E3%83%BC%E4%BD%93%E9%A8%93%E5%AD%A6%E7%BF%92-IPUSIRON-ebook/dp/B07JJKLZNW

# Malware analysis environment construction and frequently used tools

Windows:

(1) Various tools

Sysinternals

You may find the following tools useful.

- Process Explorer
- Process Monitor
-TCP View
- Auto Runs

https://learn.microsoft.com/en-us/previous-versions/bb842062(v=msdn.10)?redirectedfrom=MSDN

(2) Packet capture tool

WireShark

https://www.wireshark.org/download.html

(3) A group of various tools

Ghidra

https://ghidra-sre.org/

IDA Pro

https://cyber.quality-net.co.jp/product/494/

(4) It is convenient to be able to use Linux commands (for example, WSL)

(5) Binary editor

https://www.vector.co.jp/soft/win95/util/se079072.html

(6) Debugger (if necessary)

Ollydbg

https://www.ollydbg.de/

x64dbg

https://x64dbg.com/#start

(7) Decompiler (if necessary)

dnSpy (this for .Net)

https://github.com/dnSpy/dnSpy

(8) retdec

https://github.com/avast/retdec

You can also use IDA or Ghidra decompiler.

Linux:

kali Linux

- gdb
- Ghidra
- WireShark, etc.

In addition, install tools such as Python as appropriate.

It seems that the Linux version of ProcMon (process monitor) is out.

https://gigazine.net/news/20200725-microsoft-procmon-for-linux/


# Frequently used sites

Virus Total and Hybrid Analysis are very useful at surface analysis level.

Virus Total

https://www.virustotal.com/gui/home/search

Miter Attack

https://attack.mitre.org/groups/

Hybrid Analysis

https://www.hybrid-analysis.com/

Shodan

https://www.shodan.io/

Any Run

https://app.any.run/submissions

URLhaus

https://urlhaus.abuse.ch/browse/

# lastly
Since the analysis method for malware analysis changes depending on the sample, there is no unconditional "do this" method, but I think it would be beneficial to study the general theory.