Learning Malware Analysis

5.2 Dynamic Analysis of the Sample

To understand the malware's behavior, the dynamic analysis tools discussed in this chapter were used, and the following dynamic analysis steps were followed:

1. Both the Windows VM and the Linux VM were reverted to the clean snapshots.
2. On Windows VM, Process Hacker was started with administrator privileges to determine process attributes, and the Noriben Python script was executed (which in turn started Process Monitor) to inspect the malware's interaction with the system.
3. On the Linux VM, INetSim was launched to simulate network services, and Wireshark was executed and configured to capture the network traffic on the network interface.
4. With all the monitoring tools running, the malware was executed with administrator ...