Skip to main content

Dynamic Analysis

info

The content of this Malware Analysis pages is my understanding and notes based on the course Introduction to Malware Analysis by Prof. Ahmed Lekssays.

Overview​

Dynamic Analysis involves studying malware behavior by executing it in a controlled environment.

  • Goal: Observe actual behavior, network traffic, and system modifications.
  • Requirement: A safe, isolated sandbox or VM.

Essential Tools​

1. Process Monitoring​

  • Process Monitor (ProcMon): Tracks real-time file system, registry, and process activity. It answers "What files did it touch?" and "What registry keys did it change?"
  • Process Explorer: Provides detailed information about running processes, including loaded DLLs and handles.

2. Network Analysis​

  • Wireshark: The standard for packet capture. Used to inspect C2 (Command & Control) traffic, DNS requests, and data exfiltration attempts.

Hybrid Analysis (Advanced)​

Static and Dynamic analysis both have limits. Hybrid techniques attempt to bridge the gap.

  • Taint Analysis: Tracks the flow of data from sources (e.g., user input) to sinks (dangerous system calls). Example: Does data from the network reach the system() command?
  • Symbolic Execution: Explores multiple execution paths simultaneously by treating inputs as symbols rather than concrete values. Useful for automatically finding the input required to bypass a password check or evasion routine.