Malware Analysis for Incident Response

Malicious software continues to be an ever-evolving scourge on enterprise and consumer systems. As soon as defenses are created, malware coders create a new strain that has the power to corrupt or destroy a system. Malware is even being utilized as a weapon against nation states and global organizations. A great many of the data breaches that have made the news have some component, either in whole or in part, that involves the use of malware to achieve some goal. Organizations in every sector of the economy have faced the threat of malware. With the addition of ransomware attacks such as WannaCry and Petya, organizations have had to spring into action to address these attacks.

With malware an ever-present risk, it is critical that incident response analysts have some knowledge of the methods and tools utilized in the analysis of malicious...

Malware classifications

Malicious software, or malware, is an all-encompassing term for any software that has been created to damage, disable, or produce an unwanted condition within a computer system. This definition, while functional, is also very broad in its categorization of malware. There is malware that is coded specifically to steal credit card numbers from payment systems, while other malware is utilized to take control of a system, allowing an attacker to remotely control that system. Analysts who observe these specific behaviors—such as how a compromised system sends communications out to the internet after infection, or what actions are taken on an infected system—may be able to determine the type of the malware, and what the end goal of the attacker may be.

In general, when discussing malware, the following are some of the more specific categories:

...

Malware analysis overview

Malware analysis, or malware reverse engineering, is a highly technical and specialized field in forensics. Anti-virus and threat intelligence utilizes a highly trained cadre of programmers and forensic personnel who acquire malware from the wild, and then rip it open to determine what it does, how it does it, and who may be responsible for it. This is done utilizing two types of analysis: static and dynamic. Like much of digital forensics, each type of analysis affords some advantages, and incident response analysts should be familiar with both.

An excellent treatment of malware analysis conducted against actual malware found in the wild can be found in Kim Zetter's book Countdown to Zero Day. Comprehensively researched, this book delves deep into the Stuxnet virus, as various research teams attempt to understand what the malware is doing.

An excellent...

Analyzing malware

The tools for analyzing malware range from simple hex editors and interactive disassemblers to GUI-based tools that integrate online searching and analysis. Each incident will often dictate the specific tools or techniques utilized. A possible infection through a social engineering email that is in the process of infecting network systems may require analysts to work rapidly to identify the malware's behavior and craft a solution to remove it. In other circumstances, a security control may have identified a file that it deems suspicious. With no active incident at hand, the incident response analysts may want to completely rip apart the code, to determine if it had a specific purpose. In either case, tools described in the next section are useful in assisting in the process, but the list is by no means all-inclusive.

There are several sites that provide...

Dynamic analysis

Dynamic malware analysis is the detonation of the malware in a controlled environment or malware sandbox. During the execution of the malware, the incident responder is able to see the various processes that are created, the network connections that are established, additional packages that are downloaded, and if the malware performs any actions that allow it to maintain persistence. From this analysis, responders gain a better sense of the IoCs associated with the malware and are better able to identify other systems that have been impacted.

While gaining a sense of the actions malware takes when it executes, dynamic analysis has the advantage of not being as time-intensive as static analysis. Responders often do not need to understand the full depth of complexity of the malware in question, but rather have the ability to identify the IoCs associated with the...

Summary

This chapter addressed the various elements of malware analysis for the incident responder. First, having an understanding of malware, in general, is necessary, as it is by far the most prevalent threat available to adversaries. Second, the techniques of malware analysis—static and dynamic—provide responders with tools and techniques to extract key data points. Finally, the use of sandboxing systems allows responders to gain insight into malware behavior and attributes quickly, and in a controlled manner.

In many ways, this chapter has merely scratched the surface in regard to malware analysis. It should become apparent that, even with tools for static and dynamic analysis, incident response analysts still have a great deal of skill-building ahead of them if they want to master this highly specialized subset of digital forensics. Although it may be difficult...

Questions

1. Which of the following is not a type of malware?

A) Trojan
B) Keylogger
C) Rootkit
D) Webshell

2. Responders should create a controlled environment in which to conduct malware analysis.

A) True
B) False

3. Which of the following is a type of static analysis?

A) Runtime behavior
B) String extraction
C) Memory addressing
D) Malware coding

4. Which of the following is a type of dynamic analysis?

A) Disassembly
B) Defined point
C) Packer analysis
D) Artifact extraction

Further reading

• A source for pcap files and malware samples: https://www.malware-traffic-analysis.net/index.html
• Malware Unicorn: https://malwareunicorn.org/#/
• MalwareJake: http://malwarejake.blogspot.com/
• Florian Roth's GitHub account: https://github.com/Neo23x0/