Moving on from our general static
analysis, we go to
that step of dynamic analysis
and with static analysis,
we can study the program without
actually executing it.
So that's what makes it static.
And then the tools
of the trade that we're going to use
within that static analysis.
We're going to have our
disassembles, we're going to have
our decompiled.
We're going to look at the source
code analyzers and then
we're going to use basic utilities
like strings and grep
all of those things we can use
to to statically look
at that file without actually having
to execute it.
One of the advantages that static
analysis has is that it can reveal
how a program would behave under
unusual circumstances.
And by unusual, I mean that we can
examine parts of the program that
would normally not execute
and that helps us get more
information about that plot.
However,
those are unusual circumstances.
So dynamic analysis.
We can study a program as
it actually executes
and then with dynamic analysis,
the tools of the trade that you're
going to use for that dynamic
analysis are going to be
your debuggers, your function
call tracer's your machine
and immolators logic analyzers
and network snippers.
And the advantage of dynamic
analysis is that
it can also be fast
and accurate, but
it does have a lot of potential
to to be destructive,
especially if you're doing it on a
system that is not OBM
or if you're doing it on a
a standalone laptop.
So some of the tools that we're
going to use for dynamic analysis
are Proxima Process,
Monitor and Brockmann
as a free tool that's developed by
Windows system internals
and to choose to monitor the Windows
File System Registry and
process activity in real time.
So as you're executing
that malware, you're going to be
able to see some of those changes
within that
within those processes.
The next thing that we're going to
use for dynamic analysis is
going to be our process.
Explore and
with process explore.
It's going to monitor the running
processes and it will show
you the handles and deals that
are going to be loaded for each
process.
And that way you can kind of look at
that and compare
with your victim machine
and see if you can find some of
those commonalities with the handles
and the Dow else that you might see
on your test machine.
The next program that we're going to
talk about is Red Shot.
And Red Shot is a opensource
utility to monitor your registry
for changes.
And what's going to happen is it's
going to essentially take a snapshot
of your registry before
you run this
malware on your system, and then
it's going to take a snapshot
as the malware runs.
And that way you can compare
before and after and see what,
if anything, has changed within your
registry.
And then the last tool we're going
to talk about is a pathway
DNS. But the DNS,
it's a tool for controlling the DNS
responses on your system
and it's going to act as a DNS
server.
And then what what that's going to
do is it will spoof DNS
responses generated
by that malware.
So those are for programs that you
can use throughout that dynamic
analysis to examine that file
as it's being executed and to
see exactly what it's going to do
natively in the real world.
And obviously, again, you want to be
doing this on your
your VM and
or your standalone machine.
One of the last things that we're
going to want to do after we have
kind of torn this file apart and
examined and see and have seen what
it does
is that you can kind of start to
guard against these things.
Essentially, you can't fight
something that you haven't defined
or that you don't know exactly what
it is or what it's going
to do.
So this whole
analyzing the processes of
this malware from from
the automated analysis, static
and dynamic, you're getting
information about that file
and that information is going to
help you determine
what actions you want to take next.
And then that malware file
that you're analyzing, it's also
going to help give you some type of
idea about what it may have done
on your network.
Once you start the analysis process,
you're going to be able to find some
commonalities with
these malware.
That you're going to look at may
have infected your network or
machine on your network,
and some of those commonalities
would include maybe five patches,
call back IP addresses,
downloads, common file names,
and then any of those you can
configure your firewall to
essentially block that.
So the more commonalities that you
can find, the more specifically
you can protect your system
to guard against those.
A lot of times I've seen, especially
recently, malware
writers will change
a lot of the names of files
that they're sending.
They're going to change the IP
addresses within
the the
file itself.
So it's going to get a lot harder to
try and block some of these things.
So the analysis will help
you try and identify
very specific features and functions
of this malware.
That way you can
set your configuration settings
in that firewall to to catch it and
to block it.
Otherwise, you're going to have to
to try and block
50 different email
addresses. You're going to have to
block 50 different
IPS.
And it's a lot of work.
So if you can analyze those files
and get the specific information
that seems to be shared among all of
those files, it will make your life
a lot easier.
And then you can also
send the files to your antivirus
provider so you can receive
updates to your antivirus
definitions.
But again, helping
unpack that file and identify
what you want to have blocked and
what you're trying to protect
against will also help
your antivirus provider
create the right definition
for you.
So this was a quick
down and dirty of
our malware
analysis of malware remediation.
This is was not designed to
essentially be a complete reverse
engineering malware class.
And I think we have one of those
coming on the cyber website.
So if you're interested in learning
how to reverse engineering malware,
I would would recommend definitely
checking that out.
This was designed to provide you an
overview of
what use an incident responder can
do to look
and analyze at some of that malware.
So what we talked about
is from going from
least difficult, most difficult,
least difficult is going to be
submitting that malware
to an online
analysis tool like
virus total or
malware dotcom or some
type of automated program
that's going to help identify what
this piece of malware is doing
and that will help focus your
efforts moving up
on that pyramid.
We talked about static
analysis where you're kind of
looking in that looking at that file
through ways that it wouldn't
necessarily run
natively.
And what that'll do, that's going to
help you identify some IP
addresses.
You URLs are some of the
processes that might be created
with that malware
above that level.
We're going to have the dynamic
analysis and the dynamic analysis
will help us look at the file
as it actually runs
on a system.
And the dynamic analysis
will help us identify
some of the changes that the program
is going to make in the registry or
some of the processes and the lives
that that program is going to
create.
So all of those
processes have their strengths and
weaknesses, and those
are some of the tools and techniques
that you can use as your beginning
to investigate your malware.
And then once you find some of those
commonalities for those malware
files, you can then go about
starting that remediation process,
submitting those files to your
antivirus providers
and or changing or
strengthening your firewall settings
to try and prevent those
files from coming in again.
So that concludes
our section on malware
analysis as it relates
to incident response and advanced
forensics.
I hope you enjoyed this course
and come back next time.
Our next video is going to talk
about the remediation
process for malware.
So thank you and I hope to see you
again.