Malware Analysis

1. Prerequisites

• Malware samples
• File hashes
• EDR telemetry
• Sandbox results
• Process execution telemetry
• Network telemetry
• Access to sandbox environment
• Access to reverse engineering tools
• Access to threat intelligence platforms
• Access to EDR platform
• Access to memory analysis tools

2. Step-by-Step Instructions

Common Failure Modes

• Focusing only on static hashes
• Ignoring network behaviour
• Missing secondary payloads

1. Identify Malware Family

   • Determine:
     • Malware family
     • Variant/version
     • Known threat actor associations
     • Public reporting references

2. Analyse Payload Behaviour

   • Review:
     • Process execution behaviour
     • File system modifications
     • Registry modifications
     • Service creation
     • Persistence mechanisms

3. Assess Credential Theft Capability

   • Identify:
     • Browser credential theft
     • Token theft
     • LSASS access
     • Keylogging behaviour
     • Session theft activity

4. Analyse Network Behaviour

   • Review:
     • C2 communications
     • DNS activity
     • Beaconing intervals
     • Data transfer activity
     • External infrastructure usage

5. Identify Lateral Movement Capability

   • Look for:
     • SMB propagation
     • PsExec usage
     • WMI activity
     • RDP usage
     • Remote command execution

6. Collect Indicators

   • Document:
     • Hashes
     • Domains/IPs
     • Registry keys
     • Mutexes
     • File paths
     • User agents
     • Services

3. Post-Action

• Document findings within the incident ticket

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.