## 5 Study Cases
### Red October Analysis
#### 5.1.3 Behavior Analysis  
In this phase, we proceed to analyze the behavior of malware at runtime in order to catch and monitor the changes suffered by the victim to compare with its initial status. The main conclusion to be drawn from executing this phase within the proposed methodological model is the large amount of information that the analyst already has at this point of analysis, reducing the number of baseline hypotheses required. This fact makes it possible to substantially optimize the analysis to be carried out. Likewise, the application of the iteration proposal between the behavioral analysis phase and the code analysis phase demonstrates the continuous and optimized generation of information during the analysis, which translates into a continuous optimization of the analysis phases based on the findings obtained previously during the perform in the previous phases. The most relevant findings during this phase are presented below. * Initial Tasks. Situation of the analysis starting point and establishing two work areas: the execution environment and the monitoring environment. * Considering that the malware has been identified requires a network communication environment, the victim's host file has been modified to allow the monitoring team resolves queries about domains
* The monitor computer has been configured as the main DNS server being the authority over the domain. * The monitoring tool used was 'Wireshark'
* The configuration of the environment of the victim computer has been prepared by capturing its initial state using the tools 'Systracer', 'Regshot. The paths in which the malware, supposedly, creates the files have been marked. Tools 'Diskpulse', 'ProcessMonitor' and VMMap' have been installed to monitor the changes in real time. * Running malware
* The file'red_oct.bin.drop' is executed
* It is detected that after 15 s of its execution, the executed file disappears from the computer
* Activation of malware services
* Three modifications are detected in the DNS services. A first deactivation, an activation as a secondary server and an activation as a primary server. * Considering that, the malware being analyzed is the piece in charge of the initial infection and establishment of the Backdoor, so the detected behavior makes sense. * Subsequent Tasks. During this stage in the behavior analysis phase, the results are analyzed after the malware execution period. It is identified that the greatest activity after the execution of the file to analyze is done during the first 20 min. The changes detected at the victim and network are presented below. Figure 14: Ida Pro results. * Victim host
* 12:04:25, the malware is run on the computer. A process named'red_oct-bin.exe' and PID 2340 identifier is created that initiates access to registry variables related to communication processes
* 12:04:30, the files'svchost.exe','msc.bat' and 'hafd.gcp' are created
* 12:04:36, the previously created'svchost.exe' file is activated as a process with the PID identifier 2464 and it starts loading the malicious code into memory
* 12:04:40, the file'msc.bat' is accessed
* 12:04:41, the file'red_oct.bin.exe' is deleted. The process is created with the name 'cmd.exe'. The file'msc.bat' is deleted
* 12:19:44, the process'svchost.exe' accesses registry variables related to communication processes. This phase coincides with the detection of network traffic related to the malware, concluding that it is, at this point, where it starts attempting to communicate with the C & C.
* 12:22:30, From this moment on, the process'svchost.exe' initiates a cyclic behavior, every 3 min approximately, by means of which it tries to establish the connection with the exterior. It is interesting to detect the attempt to access routes related to web browsing applications such as Opera or Firefox, which could mean that the sample was aimed at a victim using this type of browser. The files responsible for the infection process are analyzed:
* The file'msc.bat' remains temporarily in the system.