Hello, welcome to Siberia.
My name is Sean Pearson on the
subject matter expert for malware
analysis.
And today I will be covering
letter to
basic dynamic malware
analysis, Part one.
So I mentioned this last
time, but let's go over
it again, what exactly is dynamic
analysis?
And it's basically when
you just execute some malware
either on a lot of machine or
in a virtual machine or
wherever you're doing your
analysis from above
or from whatever,
but it's really easy.
It's a great way to quickly
try to identify something that's
typically the first thing I do.
Besides looking at the hash, I
just drop into a virtual machine and
I just run the code.
The disadvantage to that is
sometimes I ones to write.
Sometimes code won't
get executed if the conditions
are met or
you don't have the right libraries
on their computer is wrong version
of some software or whatever the
reason may be.
And we'll cover some of those
reasons later on.
But the bottom
line is some code may not get
executed.
And really
what we're just trying to get out of
quickly executes
malware is to get
the IONSYS or the indicators
of compromise.
Now, if you work in enterprise and
you've had infection, maybe you see
some spam in your inbox
and you say, oh, I wonder if anyone
accidentally ran this.
You can pop into a virtual machine,
execute it and then say, OK,
it makes these files, makes these
registry changes.
I need to search across my
enterprise to
see if anyone has those same
indicators, because then that's a
positive indicator of
compromised IOC.
And there are agencies out
there are very
different formats.
I think the biggest,
newest one out there is open IOC.
I think out by Mandiant
and there are
exchanges for IOC
is another
one is Yahoo!
There's a large group out there.
And there's there's all sorts of
ways to categorize
indicators from malware.
And that's what we're trying to do
here. Foremost, that's
the first thing we're trying to do.
And a more advanced
question we're trying to ask is
determine what malware family
it is.
What type of malware is a back
door? Is a Trojan, is
it just some bot is trying
to steal the personal information
that's going after something
specific and then you can begin to
go on to the next stage, which is
which is assess
the risk and impact
your organization, which is
really very important to
a business person
who will say, OK, well,
you know, this would be a high risk
because it's crypto locker, but
it's low impact because command and
control servers down the bad guys
no longer have access to a single,
you know, so it cannot actually
execute
or it cannot actually encrypt the
files.
So it's not much it's not
very high impact.
I remember I was working in a place
where their payment gateway
for their payment system was
compromised by a piece of malware
and they could not take it down even
for one.
It would be a tremendous loss
of revenue. If they if they did
so, they decided to just firewall
off that computer from
speaking to anything else on the
Internet besides the payment
gateway that it went to.
So they were able to
assess the risk and then assess
the impact and said, OK, we can let
it be compromised as long as it
doesn't send out any data or
receiving instructions, as long as
it's not dangerous and bring down
the machine or keep it from getting
updated.
So in a business
sense, this is really important.
And further
than that, if you're farther along
in the information security maturity
model, you will try
to determine the attribution, the
actors that are
attempting to infiltrate
organization or compromised you in
some way or somehow, because then
that will lead you to prioritize
different actions.
If you're a large enterprise, you
may be getting attacked every
single day. You need to prioritize
which actors are more sophisticated
and how you should pay
more attention to their actions
and so on and so forth.
But like I said, we're just trying
to get some indicators of
compromise.