reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
--- a/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/anti_analysis_bypass.md
+++ b/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/anti_analysis_bypass.md
@@ -0,0 +1,667 @@
+# Anti-Analysis Bypass Guide
+
+Reference for identifying and bypassing malware evasion techniques during dynamic analysis.
+
+---
+
+## Overview
+
+Anti-analysis techniques fall into four categories:
+
+| Category | Goal | MITRE ATT&CK |
+|----------|------|--------------|
+| VM/sandbox detection | Avoid executing in automated analysis environments | T1497 |
+| Debugger detection | Prevent live debugging and breakpoint analysis | T1622 |
+| Timing-based evasion | Delay execution past sandbox timeout windows | T1497.003 |
+| Environmental keying | Execute only when specific conditions are met | T1480 |
+
+---
+
+## VM and Sandbox Detection
+
+### How Malware Detects VMs
+
+**Registry artifact checks (MITRE T1497.001):**
+
+```
+HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions
+HKLM\SOFTWARE\VMware, Inc.\VMware Tools
+HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
+HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs
+HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier
+  → "VBOX HARDDISK", "VMWARE VIRTUAL IDE HARD DRIVE"
+```
+
+**Process enumeration:**
+
+```
+vboxservice.exe       VirtualBox guest service
+vboxtray.exe          VirtualBox system tray
+vmtoolsd.exe          VMware Tools daemon
+vmwaretray.exe        VMware system tray
+vmacthlp.exe          VMware activation helper
+vmsrvc.exe            VirtualPC service
+df5serv.exe           Parallels service
+prl_tools.exe         Parallels Tools
+```
+
+**Driver/device checks:**
+
+```
+\\.\VBoxMiniRdrDN
+\\.\VBoxGuest
+\\.\vmci
+\\.\HGFS
+\Device\VBoxGuest
+\Device\vmhgfs
+```
+
+**CPUID hypervisor bit (EAX=1, ECX bit 31):**
+
+Malware executes CPUID and checks bit 31 of ECX. If set, a hypervisor is present. Subsequent CPUID with EAX=0x40000000 returns a vendor string: "VMwareVMware", "KVMKVMKVM", "VBoxVBoxVBox", "Microsoft Hv".
+
+**MAC address OUI checks:**
+
+```
+08:00:27    VirtualBox
+00:0C:29    VMware
+00:50:56    VMware (vSphere)
+00:1C:14    VMware
+00:05:69    VMware
+00:03:FF    Microsoft Hyper-V
+```
+
+**Screen resolution / user interaction:**
+
+```
+Screen size exactly 1024x768 → sandbox default
+No mouse movement history
+No browser history / recent files
+Uptime < 10 minutes
+Single CPU core
+Total RAM < 2 GB
+```
+
+**Identifying VM detection in static analysis:**
+
+Look for these API calls in import tables or dynamic calls:
+
+```
+GetSystemInfo           → CPU count check
+GlobalMemoryStatusEx    → RAM check
+EnumProcesses           → process list scan
+CreateFile(\\.\<device>) → device existence check
+RegOpenKeyEx / RegQueryValueEx → registry artifact checks
+GetAdaptersInfo         → MAC address check
+GetTickCount / GetSystemTime → uptime / time checks
+```
+
+### Bypass Strategies
+
+**Remove VirtualBox Guest Additions:**
+
+```powershell
+# Uninstall via Control Panel or:
+Start-Process "C:\Program Files\Oracle\VirtualBox Guest Additions\uninstall.exe" -Wait
+
+# Remove leftover registry keys
+Remove-Item "HKLM:\SOFTWARE\Oracle\VirtualBox Guest Additions" -Recurse -ErrorAction SilentlyContinue
+Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\VBoxGuest" -Recurse -ErrorAction SilentlyContinue
+Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\VBoxSF" -Recurse -ErrorAction SilentlyContinue
+Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\VBoxMouse" -Recurse -ErrorAction SilentlyContinue
+
+# Stop and delete VBox services
+sc.exe stop VBoxGuest
+sc.exe delete VBoxGuest
+```
+
+**Spoof BIOS/DMI strings (VirtualBox, run on host):**
+
+```bash
+VBoxManage setextradata "VM-Name" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor"    "American Megatrends Inc."
+VBoxManage setextradata "VM-Name" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVersion"   "F10"
+VBoxManage setextradata "VM-Name" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct" "MS-7B86"
+VBoxManage setextradata "VM-Name" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemVendor"  "MSI"
+VBoxManage setextradata "VM-Name" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiBoardProduct"  "MAG Z390 TOMAHAWK"
+VBoxManage setextradata "VM-Name" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiChassisVendor" "MSI"
+```
+
+**Suppress CPUID hypervisor bit (VirtualBox):**
+
+```bash
+VBoxManage modifyvm "VM-Name" --paravirtprovider none
+```
+
+**VMware: suppress CPUID and hypervisor detection:**
+
+Add to the `.vmx` file:
+
+```
+hypervisor.cpuid.v0 = "FALSE"
+SMBIOS.reflectHost = "TRUE"
+board.vendor = "MSI"
+board.product = "MAG Z390 TOMAHAWK"
+```
+
+**Spoof MAC address:**
+
+```bash
+# VirtualBox (use a real vendor OUI)
+VBoxManage modifyvm "VM-Name" --macaddress1 "8C8D28AABBCC"
+# Intel OUIs: 8C:8D:28, 00:1B:21, F4:4D:30
+# Realtek OUI: 00:E0:4C
+```
+
+**Add realistic user artifacts:**
+
+```powershell
+# Create browser history (requires Chrome installed)
+# Open URLs from PowerShell
+Start-Process "chrome.exe" "https://www.gmail.com"
+Start-Process "chrome.exe" "https://www.stackoverflow.com"
+
+# Create recent documents
+$docs = @("budget_2024.xlsx","notes.txt","presentation.pptx")
+foreach ($d in $docs) {
+    New-Item -Path "$env:USERPROFILE\Documents\$d" -ItemType File -Force
+}
+
+# Set realistic uptime by running VM for 30+ minutes before analysis
+```
+
+**Use VBoxHardenedLoader (advanced):**
+
+VBoxHardenedLoader patches the VirtualBox kernel driver to pass CPUID and other checks transparently without removing guest additions.
+
+```
+# https://github.com/hfiref0x/VBoxHardenedLoader
+# Load driver: VBoxHLinstall.cmd
+# Provides transparent VM hiding while keeping shared folders functional
+```
+
+---
+
+## Debugger Detection
+
+### How Malware Detects Debuggers (MITRE T1622)
+
+**IsDebuggerPresent / CheckRemoteDebuggerPresent:**
+
+Most common check. Reads the PEB (Process Environment Block) `BeingDebugged` flag directly.
+
+```
+PEB offset 0x2 (32-bit) / 0x2 (64-bit): BeingDebugged byte
+PEB offset 0x68 (32-bit) / 0xBC (64-bit): NtGlobalFlag (set to 0x70 under debugger)
+```
+
+**NtQueryInformationProcess:**
+
+```
+ProcessDebugPort         (class 7)  → non-zero if debugged
+ProcessDebugObjectHandle (class 30) → valid handle if debugged
+ProcessDebugFlags        (class 31) → 0 if debugged
+```
+
+**Heap flags (PEB.ProcessHeap):**
+
+```
+Heap.Flags:       normally 0x2, under debugger 0x50000062
+Heap.ForceFlags:  normally 0x0, under debugger 0x40000060
+```
+
+**Hardware breakpoint detection:**
+
+Malware reads the debug registers DR0–DR3 via `GetThreadContext`. If any are non-zero, a hardware breakpoint is set.
+
+**Timing-based debugger detection:**
+
+```c
+DWORD t1 = GetTickCount();
+// execute a few instructions
+DWORD t2 = GetTickCount();
+if ((t2 - t1) > threshold) { /* debugger detected */ }
+```
+
+When single-stepping in a debugger, even a few instructions take milliseconds vs. nanoseconds normally.
+
+**Exception-based detection:**
+
+Malware raises an exception (INT3, divide-by-zero) and checks if the debugger swallows it instead of passing it to the exception handler.
+
+**Window/process name enumeration:**
+
+```
+FindWindow("OLLYDBG", NULL)
+FindWindow("WinDbgFrameClass", NULL)
+FindWindow("ID", NULL)   → Immunity Debugger
+FindWindow("Qt5QWindowIcon", NULL)  → x64dbg
+
+EnumProcesses → scan for:
+  ollydbg.exe, x32dbg.exe, x64dbg.exe, windbg.exe,
+  ida.exe, ida64.exe, idag.exe, idaq.exe,
+  immunitydebugger.exe, dnspy.exe, cheatengine.exe
+```
+
+### Bypass Strategies
+
+**ScyllaHide (primary tool):**
+
+ScyllaHide is an anti-anti-debug plugin for x64dbg, OllyDbg, and IDA Pro. It patches all common detection methods transparently.
+
+```
+# Download: https://github.com/x64dbg/ScyllaHide
+
+# Install in x64dbg:
+# Copy ScyllaHide.dp32 / ScyllaHide.dp64 to x64dbg\plugins\
+# Restart x64dbg
+# Plugins → ScyllaHide → Options
+
+# Enable all protections for evasive samples:
+[x] PEB BeingDebugged
+[x] PEB NtGlobalFlag
+[x] PEB HeapFlags
+[x] NtQueryInformationProcess
+[x] Unhandled Exception Handler
+[x] Hardware Breakpoint Protection
+[x] GetTickCount Hook
+[x] NtSetInformationThread
+```
+
+**TitanHide (kernel-level, for advanced evasion):**
+
+TitanHide is a kernel driver that hides debuggers at the OS level, defeating NtQueryInformationProcess and similar kernel-query-based checks.
+
+```
+# Download: https://github.com/mrexodia/TitanHide
+# Requires: Windows with test signing enabled or TESTSIGNING boot flag
+# Load driver: TitanHide.sys
+# Use x64dbg plugin interface for configuration
+```
+
+**Manual PEB patching in x64dbg:**
+
+```
+# In x64dbg, after attaching:
+# Open Memory Map → find PEB
+# Manually zero BeingDebugged byte:
+
+# 32-bit:
+#   FS:[0x30] → PEB base
+#   PEB+0x2   → BeingDebugged (set to 0x00)
+#   PEB+0x68  → NtGlobalFlag  (set to 0x00)
+
+# Use x64dbg script:
+mov byte ptr [peb()]:2, 0       # Clear BeingDebugged
+mov dword ptr [peb()]:0x68, 0   # Clear NtGlobalFlag
+```
+
+**Handle timing checks — NOP the sleep/delay:**
+
+```
+# In x64dbg, find GetTickCount/QueryPerformanceCounter calls
+# Identify the comparison instruction after the delta calculation
+# NOP the conditional jump (JNE, JA, JBE, etc.)
+# Or patch the threshold to an impossibly large value
+```
+
+**Handle exception-based detection:**
+
+```
+# In x64dbg: Options → Preferences → Exceptions
+# Add exception codes to "pass to program":
+#   0x80000003  (INT3 / STATUS_BREAKPOINT)
+#   0xC0000094  (divide by zero)
+#   0xC0000005  (access violation, if used as detection)
+```
+
+---
+
+## Timing-Based Evasion
+
+### How Malware Uses Timing (MITRE T1497.003)
+
+**Sleep-based evasion:**
+
+Malware calls `Sleep(600000)` (10 minutes) or longer. Automated sandboxes that have a 2-5 minute timeout never observe the payload.
+
+```
+Sleep(DWORD dwMilliseconds)
+SleepEx(DWORD dwMilliseconds, BOOL bAlertable)
+WaitForSingleObject(HANDLE, INFINITE)
+NtDelayExecution(BOOLEAN Alertable, PLARGE_INTEGER DelayInterval)
+```
+
+**Date/time checks:**
+
+Malware compares the current date against a hardcoded activation date. If before that date, it does nothing (making sandbox captures useless). If after an expiry date, it also does nothing (anti-forensics).
+
+**Idle/user activity checks:**
+
+```
+GetLastInputInfo() → returns milliseconds since last user input
+GetCursorPos()     → called twice, checks if cursor moved
+GetForegroundWindow() → checks for active user window
+```
+
+If no mouse movement or keyboard input for N seconds, the malware assumes it is in a sandbox.
+
+### Bypass Strategies
+
+**Patch Sleep calls in x64dbg:**
+
+```
+# Find calls to Sleep / SleepEx / NtDelayExecution
+# Option 1: NOP the entire Sleep call
+# Option 2: Patch the millisecond argument to 0 or 1
+
+# In x64dbg, set a breakpoint on Sleep:
+# Breakpoints → Add → "Sleep"
+# When hit, change RCX (x64) or stack arg (x86) to 0 before continuing
+
+# x64dbg script to auto-patch:
+bp Sleep
+loopSleep:
+erun
+mov rcx, 0      // Zero the sleep duration (x64 first arg)
+erun
+goto loopSleep
+```
+
+**Accelerate sandbox clock (Cuckoo/CAPE):**
+
+```yaml
+# In cuckoo.conf:
+[timeouts]
+critical = 60
+vm_state = 60
+
+# Enable clock skipping in analysis options:
+options: "clock=20200101120000"
+```
+
+**Manipulate system time on Windows VM:**
+
+```powershell
+# Set date forward to trigger time-gated payloads
+Set-Date -Date "2025-06-15 12:00:00"
+
+# Use faketime (Linux / Wine)
+faketime '2025-06-15 12:00:00' wine sample.exe
+```
+
+**Simulate user activity:**
+
+```powershell
+# Move mouse programmatically
+Add-Type -AssemblyName System.Windows.Forms
+while ($true) {
+    $x = Get-Random -Minimum 100 -Maximum 1800
+    $y = Get-Random -Minimum 100 -Maximum 900
+    [System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point($x, $y)
+    Start-Sleep -Milliseconds 500
+}
+```
+
+**Extend sandbox timeout:**
+
+For CAPE/Cuckoo, increase the analysis timeout:
+
+```bash
+python3 utils/submit.py --file sample.exe --timeout 300
+```
+
+For manual analysis, simply wait — set observation window to 60+ minutes for suspected sleep-evasive samples.
+
+---
+
+## Environmental Keying
+
+### How Malware Implements Environmental Checks (MITRE T1480)
+
+Environmental keying means the malware will only execute its payload if specific environmental conditions are met. This is distinct from VM detection — the malware is looking for a specific victim configuration.
+
+**Domain/hostname checks:**
+
+```
+GetComputerNameEx(ComputerNameDnsDomain, ...)
+NetGetJoinInformation()
+LookupAccountSid()
+→ Malware may require a specific AD domain name or NETBIOS name
+```
+
+**Username checks:**
+
+```
+GetUserName() → compare against hardcoded victim username
+WNetGetUser()
+```
+
+**Installed software checks:**
+
+```
+HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\  → enumerate installed apps
+HKLM\SOFTWARE\  → check for specific vendor keys
+```
+
+**Language/locale checks:**
+
+```
+GetSystemDefaultLangID()
+GetUserDefaultLCID()
+→ Some malware won't run if locale is English or matches researcher's profile
+→ Others skip execution if locale is Russian/Ukrainian (avoiding domestic prosecution)
+```
+
+**Network environment checks:**
+
+```
+GetAdaptersInfo()  → check for specific IP ranges
+DnsQuery()         → verify domain membership via DNS
+NetServerGetInfo() → check for domain controller presence
+```
+
+### Bypass Strategies
+
+**Domain/hostname spoofing:**
+
+```powershell
+# Change computer name (requires restart)
+Rename-Computer -NewName "WORKSTATION-01" -Force
+
+# Join a fake workgroup matching expected domain name
+# (Does not require actual domain controller)
+Add-Computer -WorkgroupName "TARGETCORP"
+```
+
+**Username spoofing:**
+
+```powershell
+# Create a user matching expected victim name
+New-LocalUser -Name "jsmith" -NoPassword
+Add-LocalGroupMember -Group "Administrators" -Member "jsmith"
+# Log in as that user, then execute sample
+```
+
+**Locale patching:**
+
+```
+# In x64dbg, break on GetSystemDefaultLangID / GetUserDefaultLCID
+# Patch EAX return value to match expected locale
+# Russian: 0x0419, Romanian: 0x0418, Ukrainian: 0x0422
+```
+
+**Registry keying bypass:**
+
+```
+# If malware checks for a specific product registry key:
+# Identify the expected key via static analysis (strings, IDA)
+# Create a fake registry entry before execution:
+New-Item -Path "HKLM:\SOFTWARE\TargetVendor\TargetProduct" -Force
+New-ItemProperty -Path "HKLM:\SOFTWARE\TargetVendor\TargetProduct" `
+  -Name "Version" -Value "1.0" -PropertyType String
+```
+
+---
+
+## Tools for Anti-Analysis Bypass
+
+### ScyllaHide
+
+Purpose: Plugin for x64dbg, OllyDbg, IDA Pro, TitanHide. Patches all common anti-debug checks transparently.
+
+```
+Download:  https://github.com/x64dbg/ScyllaHide/releases
+Platforms: x32dbg, x64dbg, OllyDbg 1.10, OllyDbg 2.01, IDA Pro
+Install:   Copy DLL to debugger plugins folder
+
+Key options:
+- PEB patch (BeingDebugged, NtGlobalFlag, HeapFlags)
+- NtQueryInformationProcess hooks
+- Timing hooks (GetTickCount, QueryPerformanceCounter)
+- NtSetInformationThread (hide from debugger)
+- Unhandled exception fix
+```
+
+### TitanHide
+
+Purpose: Kernel-mode driver that hides debugger presence from NtQueryInformationProcess and related syscalls.
+
+```
+Download:  https://github.com/mrexodia/TitanHide
+Requires:  Windows with test signing or driver certificate
+Use case:  When ScyllaHide user-mode hooks are insufficient
+           (malware uses direct syscalls to bypass user-mode hooks)
+```
+
+### al-khaser
+
+Purpose: Open-source tool that tests over 170 anti-analysis checks. Use to validate VM hardening before analyzing evasive samples.
+
+```
+Download:  https://github.com/LordNoteworthy/al-khaser
+Build:     Visual Studio solution (.sln)
+Run:       al-khaser.exe
+Output:    Pass/fail for each check category:
+           - Anti-VM
+           - Anti-debug
+           - Anti-sandbox
+           - Anti-disassembly
+           - Timing
+```
+
+### pafish
+
+Purpose: Lightweight VM/sandbox detection tester. Faster than al-khaser for quick pre-analysis validation.
+
+```
+Download:  https://github.com/a0rtega/pafish/releases
+Run:       pafish.exe
+Green:     Check passed (not detected)
+Red:       Check failed (artifact detected — fix before analyzing evasive samples)
+```
+
+### hollows_hunter / pe-sieve
+
+Purpose: Scan a running process for injected code, hollowed sections, and unpacked payloads in memory. Useful after malware defeats initial analysis controls.
+
+```
+Download:  https://github.com/hasherezade/hollows_hunter
+Run:       hollows_hunter.exe /pid <malware_pid>
+Output:    Dumps hollowed/injected regions to disk for static analysis
+```
+
+### x64dbg Plugins for Anti-Analysis
+
+```
+ScyllaHide      Anti-debug bypass (essential)
+xAnalyzer       Extended analysis and comment generation
+xHotConvert     Quick conversion utilities
+OllyDumpEx      Process dumper for unpacking
+```
+
+---
+
+## Identifying Anti-Analysis at a Glance
+
+During static analysis, flag these patterns for targeted bypass:
+
+**String indicators:**
+
+```
+"IsDebuggerPresent"      → debugger detection
+"CheckRemoteDebugger"    → remote debugger detection
+"NtQueryInformationProcess" → advanced debugger/VM detection
+"VBOX", "VMWARE", "QEMU", "VIRTUAL" → VM string checks
+"GetTickCount"           → timing-based detection
+"GetLastInputInfo"       → user interaction check
+"GetSystemDefaultLangID" → locale-based keying
+"GetComputerName"        → hostname keying
+"EnumProcesses"          → process-list scanning
+```
+
+**Import table red flags:**
+
+```
+kernel32.dll: IsDebuggerPresent, CheckRemoteDebuggerPresent,
+              GetTickCount, QueryPerformanceCounter,
+              GetLastInputInfo, GetCursorPos
+ntdll.dll:    NtQueryInformationProcess, NtSetInformationThread,
+              NtDelayExecution, RtlQueryProcessHeapInformation
+advapi32.dll: RegOpenKeyEx (combined with SYSTEM\CurrentControlSet\Services)
+iphlpapi.dll: GetAdaptersInfo (MAC address check)
+```
+
+**Behavioral indicators during dynamic analysis:**
+
+```
+Process exits immediately (< 2 seconds)   → VM or debugger detected
+No network activity despite expected C2   → sandbox/network detection
+Sleep calls with long durations (> 30s)   → timing evasion
+Repeated GetTickCount/RDTSC in tight loop → timing check
+CreateFile on \\.\VBoxGuest or \\.\vmci   → device probing
+```
+
+---
+
+## MITRE ATT&CK Reference
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Virtualization/Sandbox Evasion | T1497 | Parent technique |
+| System Checks | T1497.001 | Registry, filesystem, hardware artifacts |
+| User Activity Based Checks | T1497.002 | Mouse movement, input, idle time |
+| Time Based Evasion | T1497.003 | Sleep calls, date checks, RDTSC |
+| Debugger Evasion | T1622 | IsDebuggerPresent, NtQueryInformationProcess |
+| Execution Guardrails | T1480 | Environmental keying, domain/locale checks |
+| Obfuscated Files or Information | T1027 | Packed/encrypted payloads that unpack in memory |
+
+---
+
+## Analysis Decision Tree
+
+```
+Sample exits immediately?
+├─ Yes → Check: is VM artifact present? → Fix VM hardening, retry
+│         Check: debugger detected?    → Enable ScyllaHide, retry
+│         Check: locale/domain check?  → Spoof environment, retry
+└─ No  → Sample is executing
+
+No network activity?
+├─ Check: INetSim running and configured?
+├─ Check: DNS resolving to INetSim IP?
+├─ Check: malware performing HTTPS certificate pinning?
+│         → Use Proxifier + mitmproxy to intercept
+└─ Check: malware waiting for sleep delay?
+          → Patch Sleep calls, extend timeout
+
+Behavior stops after initial activity?
+├─ Check: C2 response expected? → Configure INetSim response templates
+├─ Check: time-gated payload?  → Advance system clock
+└─ Check: requires second-stage download? → Serve fake C2 response via INetSim
+```
--- a/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/sandbox_setup.md
+++ b/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/sandbox_setup.md
@@ -0,0 +1,465 @@
+# Sandbox Setup Guide
+
+Quick reference for building and maintaining isolated malware analysis environments.
+
+---
+
+## REMnux - Linux Analysis VM
+
+REMnux is a curated Ubuntu-based distro pre-loaded with reverse engineering and network simulation tools.
+
+### Installation
+
+```bash
+# Option 1: Download pre-built OVA (recommended)
+# https://remnux.org/#distro
+# Import via VirtualBox/VMware: File → Import Appliance → remnux-vX.X.ova
+
+# Option 2: Add REMnux to existing Ubuntu 22.04 LTS
+wget https://REMnux.org/remnux-cli
+mv remnux-cli /usr/local/bin/remnux
+chmod +x /usr/local/bin/remnux
+sudo remnux install
+```
+
+### Key Pre-Installed Tools
+
+| Category | Tools |
+|----------|-------|
+| Network simulation | INetSim, FakeNet-NG |
+| Traffic analysis | Wireshark, tshark, tcpdump, NetworkMiner |
+| Static analysis | FLOSS, strings, binwalk, file, ssdeep |
+| PDF analysis | pdf-parser, pdfid, peepdf |
+| Office analysis | olevba, mraptor, msodde |
+| Disassembly | Ghidra, Binary Ninja (trial) |
+| Scripting | Python 3, Ruby, Node.js |
+| Memory forensics | Volatility 3, bulk_extractor |
+
+### Initial Configuration
+
+```bash
+# Update REMnux tools
+sudo remnux upgrade
+
+# Set timezone to UTC for consistent timestamps
+sudo timedatectl set-timezone UTC
+
+# Disable automatic updates (prevent unintended network activity)
+sudo systemctl disable apt-daily.timer
+sudo systemctl disable apt-daily-upgrade.timer
+
+# Verify INetSim is ready
+sudo systemctl status inetsim
+```
+
+### INetSim Configuration on REMnux
+
+```bash
+sudo nano /etc/inetsim/inetsim.conf
+```
+
+Key settings to configure:
+
+```
+# Bind to interface facing Windows analysis VM
+service_bind_address    192.168.56.1
+
+# DNS: respond to all queries with INetSim's own IP
+dns_default_ip          192.168.56.1
+dns_version             "Microsoft DNS 6.1.7601"
+
+# HTTP/HTTPS
+http_bind_port          80
+https_bind_port         443
+http_fakemode           yes
+
+# SMTP
+smtp_bind_port          25
+smtp_banner             "220 mail.example.com ESMTP"
+```
+
+```bash
+# Start INetSim
+sudo inetsim
+
+# View INetSim logs
+tail -f /var/log/inetsim/service.log
+```
+
+---
+
+## FlareVM - Windows Analysis VM
+
+FlareVM is a Chocolatey-based installer that transforms Windows into a malware analysis workstation.
+
+### Prerequisites
+
+- Windows 10 (version 1903 or later) — fresh install strongly preferred
+- At minimum 60 GB disk, 4 GB RAM (8 GB recommended)
+- PowerShell 5+ with execution policy set to unrestricted
+- .NET 4+ installed
+- Disable Windows Defender and Windows Update before installing
+
+### Disable Defender Before Installation
+
+```powershell
+# Run PowerShell as Administrator
+
+# Disable real-time protection (temporary, for installation)
+Set-MpPreference -DisableRealtimeMonitoring $true
+
+# Disable all Defender components
+Set-MpPreference -DisableBehaviorMonitoring $true
+Set-MpPreference -DisableIOAVProtection $true
+Set-MpPreference -DisableScriptScanning $true
+
+# Disable Windows Update
+sc.exe config wuauserv start=disabled
+sc.exe stop wuauserv
+```
+
+### Installation
+
+```powershell
+# Run PowerShell as Administrator
+Set-ExecutionPolicy Unrestricted -Force
+
+# Download and run FlareVM installer
+(New-Object net.webclient).DownloadFile(
+    'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
+    "$env:temp\install.ps1"
+)
+Unblock-File "$env:temp\install.ps1"
+& "$env:temp\install.ps1"
+```
+
+The installer opens a GUI for package selection. Installation takes 1-2 hours.
+
+### Key Installed Tools
+
+| Category | Tools |
+|----------|-------|
+| Debuggers | x64dbg, WinDbg, OllyDbg |
+| Disassemblers | IDA Free, Ghidra, Binary Ninja (trial) |
+| Process analysis | System Informer (formerly Process Hacker), ProcDOT, Process Monitor |
+| Network | Wireshark, FakeNet-NG, TCPView |
+| Static analysis | PE-bear, CFF Explorer, PEiD, Detect-It-Easy |
+| String extraction | FLOSS, strings |
+| .NET | dnSpy, de4dot |
+| Office | olevba, oletools |
+| Hex editors | HxD, 010 Editor |
+| Scripting | Python 3, Ruby |
+
+### Post-Installation Hardening
+
+```powershell
+# Disable Windows Firewall (analysis VM only — never production)
+netsh advfirewall set allprofiles state off
+
+# Disable UAC prompts that interrupt malware execution
+Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0
+
+# Show hidden files and extensions
+Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name Hidden -Value 1
+Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt -Value 0
+```
+
+---
+
+## Network Isolation Configuration
+
+### VirtualBox Host-Only Network Setup
+
+Host-only networking creates a private network between the host and VMs only — no internet access.
+
+**Create Host-Only Adapter (VirtualBox):**
+
+```
+File → Host Network Manager → Create
+  IPv4 Address: 192.168.56.1
+  IPv4 Network Mask: 255.255.255.0
+  DHCP Server: Disabled (assign static IPs manually)
+```
+
+**Configure Windows Analysis VM:**
+
+```
+VM Settings → Network
+  Adapter 1: Host-Only Adapter → vboxnet0
+```
+
+**Set static IP on Windows VM:**
+
+```
+Network and Sharing Center → Change adapter settings
+→ Right-click adapter → Properties → IPv4 → Manual:
+  IP Address:   192.168.56.10
+  Subnet Mask:  255.255.255.0
+  Gateway:      192.168.56.1   (REMnux INetSim)
+  DNS Server:   192.168.56.1   (REMnux INetSim)
+```
+
+**Configure REMnux VM:**
+
+```
+VM Settings → Network
+  Adapter 1: Host-Only Adapter → vboxnet0
+  (Static IP: 192.168.56.1 — set during OS install or via netplan)
+```
+
+### VMware Host-Only Network Setup
+
+```
+Edit → Virtual Network Editor → Add Network → VMnet1 (Host-only)
+  Subnet IP: 192.168.56.0
+  Subnet mask: 255.255.255.0
+  Disable: Use local DHCP service
+```
+
+**Assign to analysis VM:**
+
+```
+VM Settings → Network Adapter → Custom: VMnet1
+```
+
+### Verifying Isolation
+
+From the Windows analysis VM, confirm no external connectivity:
+
+```cmd
+# Should resolve (INetSim responds)
+nslookup google.com
+
+# Should fail (no external routing)
+ping 8.8.8.8
+
+# Verify gateway is INetSim, not external router
+tracert google.com
+```
+
+From REMnux, confirm INetSim is intercepting:
+
+```bash
+# Watch live connections from Windows VM
+tail -f /var/log/inetsim/service.log
+```
+
+---
+
+## Snapshot Management
+
+Snapshots are the single most important operational practice. A corrupted or infected baseline wastes hours.
+
+### Snapshot Strategy
+
+**Baseline snapshot** — taken once after clean VM build, before any analysis:
+- OS fully patched (final time)
+- All analysis tools installed and tested
+- INetSim/FakeNet configured
+- Sysmon installed with SwiftOnSecurity config
+- Defender disabled
+- Named: `BASELINE-CLEAN-YYYY-MM-DD`
+
+**Pre-execution snapshot** — taken at the start of each analysis session:
+- All monitoring tools open and ready (Procmon capturing, Wireshark running)
+- INetSim running on REMnux
+- Sample copied to VM but not yet executed
+- Named: `PRE-EXEC-<sample-hash>-YYYY-MM-DD`
+
+**Mid-analysis snapshots** — optional, taken at significant milestones:
+- After installation phase completes
+- Before triggering a specific behavior
+- Named: `MID-<phase>-<sample-hash>`
+
+### VirtualBox Snapshot Commands
+
+```bash
+# List snapshots
+VBoxManage snapshot "Windows10-Analysis" list
+
+# Take snapshot
+VBoxManage snapshot "Windows10-Analysis" take "PRE-EXEC-abc123-2024-01-15" \
+  --description "Sample abc123 loaded, tools running"
+
+# Restore snapshot
+VBoxManage snapshot "Windows10-Analysis" restore "BASELINE-CLEAN-2024-01-01"
+
+# Delete old snapshots (free disk space)
+VBoxManage snapshot "Windows10-Analysis" delete "MID-install-abc123"
+```
+
+### VMware Snapshot Commands
+
+```bash
+# Take snapshot (VMware CLI)
+vmrun snapshot /path/to/vm.vmx "PRE-EXEC-abc123-2024-01-15"
+
+# Revert to snapshot
+vmrun revertToSnapshot /path/to/vm.vmx "BASELINE-CLEAN-2024-01-01"
+
+# List snapshots
+vmrun listSnapshots /path/to/vm.vmx
+```
+
+### Discipline Rules
+
+- **Always revert to baseline after each sample** — never analyze two samples in the same session without reverting
+- **Never take a snapshot while malware is running** — the snapshot captures infected state
+- **Store baseline OVA/OVF off the analysis machine** — backup in case of host compromise
+- **Label snapshots with dates** — baselines age; tools need updates
+
+---
+
+## VM Detection Countermeasures
+
+Malware commonly fingerprints VMs to avoid analysis. See `references/anti_analysis_bypass.md` for full bypass techniques. Common baseline hardening steps:
+
+### Hardware Fingerprint Spoofing
+
+**VirtualBox — spoof BIOS/hardware strings:**
+
+```bash
+# Run on host before starting VM
+VBoxManage setextradata "Windows10-Analysis" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor" "American Megatrends Inc."
+
+VBoxManage setextradata "Windows10-Analysis" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct" "MS-7B86"
+
+VBoxManage setextradata "Windows10-Analysis" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemVendor" "MSI"
+
+VBoxManage setextradata "Windows10-Analysis" \
+  "VBoxInternal/Devices/pcbios/0/Config/DmiChassisVendor" "MSI"
+```
+
+**Spoof MAC address (remove VirtualBox OUI 08:00:27:xx:xx:xx):**
+
+```
+VM Settings → Network → Advanced → MAC Address → Generate new
+```
+
+Or set manually to a real vendor OUI (e.g., Intel: `8C:8D:28`):
+
+```bash
+VBoxManage modifyvm "Windows10-Analysis" --macaddress1 "8C8D28AABBCC"
+```
+
+### Remove VM Artifacts on Windows Guest
+
+```powershell
+# Remove VirtualBox Guest Additions (if installed)
+# Control Panel → Programs → Uninstall VirtualBox Guest Additions
+
+# Remove VMware Tools
+# Control Panel → Programs → Uninstall VMware Tools
+
+# Remove obvious registry keys
+Remove-Item -Path "HKLM:\SOFTWARE\Oracle\VirtualBox Guest Additions" -Recurse -ErrorAction SilentlyContinue
+Remove-Item -Path "HKLM:\SOFTWARE\VMware, Inc." -Recurse -ErrorAction SilentlyContinue
+
+# Remove VBox/VMware processes from autostart
+# Check: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+```
+
+### Screen Resolution and User Activity
+
+```
+Set VM resolution to common values: 1920x1080 or 1366x768
+Create desktop shortcuts, browser history, recent documents
+Place realistic-looking files in Downloads, Documents, Desktop
+Add a few installed applications (Chrome, 7-Zip, Notepad++)
+```
+
+### Testing VM Hardening
+
+Use pafish (Paranoid Fish) to verify detection resistance:
+
+```
+# Download: https://github.com/a0rtega/pafish
+# Run pafish.exe in the VM
+# Each red "FAIL" is a detectable artifact
+# Aim for all green before analyzing evasive samples
+```
+
+---
+
+## CAPE Sandbox - Local Automated Sandbox
+
+CAPE (Config And Payload Extraction) automates dynamic analysis at scale.
+
+### Quick Install (Docker)
+
+```bash
+# Clone CAPE
+git clone https://github.com/kevoreilly/CAPEv2.git
+cd CAPEv2
+
+# Use Docker Compose (simplest setup)
+sudo docker-compose up -d
+
+# Web interface available at:
+# http://localhost:8000
+```
+
+### Submit Sample via CLI
+
+```bash
+# Submit file
+python3 utils/submit.py --file /path/to/sample.exe
+
+# Submit with options
+python3 utils/submit.py \
+  --file /path/to/sample.exe \
+  --timeout 120 \
+  --options "procmemdump=yes,extraction=yes"
+```
+
+### Submit via Web UI
+
+```
+http://localhost:8000/submit
+→ Upload file
+→ Set timeout (60-300 seconds)
+→ Select package (exe, dll, doc, pdf, etc.)
+→ Submit
+```
+
+### Retrieve Report
+
+```bash
+# List tasks
+python3 utils/process.py -r <task_id>
+
+# Reports stored at:
+# /opt/CAPEv2/storage/analyses/<task_id>/reports/report.json
+```
+
+---
+
+## Troubleshooting
+
+**Windows VM has internet access (should not):**
+- Verify adapter is Host-Only, not NAT or Bridged
+- Check default gateway points to INetSim IP, not router IP
+- Disable any secondary adapters
+
+**INetSim not responding to DNS queries:**
+- Confirm `service_bind_address` matches REMnux's host-only IP
+- Check INetSim is running: `sudo systemctl status inetsim`
+- Verify no firewall blocking port 53 on REMnux: `sudo ufw status`
+
+**Snapshot restore fails (VirtualBox):**
+- Ensure VM is fully powered off before restoring
+- Verify sufficient disk space on host
+- Try: `VBoxManage snapshot <vm> restorecurrent`
+
+**FlareVM installation fails partway through:**
+- Re-run installer — Chocolatey packages are idempotent
+- Check Windows Update is fully disabled
+- Verify Defender exclusions cover `C:\ProgramData\chocolatey`
+
+**pafish detects VM even after hardening:**
+- Check CPUID hypervisor bit: requires CPU passthrough or nested virt disabled
+- VMware: add `hypervisor.cpuid.v0 = FALSE` to .vmx file
+- VirtualBox: `VBoxManage modifyvm <vm> --paravirtprovider none`
--- a/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/tool_setup.md
+++ b/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/tool_setup.md
@@ -0,0 +1,397 @@
+# Dynamic Analysis Tool Setup Guide
+
+Quick reference for configuring essential dynamic analysis tools.
+
+## Process Monitor (Procmon) - Sysinternals
+
+### Initial Setup
+1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
+2. Run as Administrator
+3. Procmon starts capturing immediately
+
+### Essential Filters (Reduce Noise)
+
+**Filter by Process:**
+```
+Process Name → is → sample.exe → Include
+Process Name → is → rundll32.exe → Include (if DLL execution)
+Process Name → is → explorer.exe → Exclude
+Process Name → is → svchost.exe → Exclude
+```
+
+**Filter by Operation Type:**
+```
+Operation → contains → Reg → Include (registry operations)
+Operation → contains → File → Include (file operations)
+Operation → begins with → Process → Include (process operations)
+```
+
+**Filter by Result:**
+```
+Result → is → SUCCESS → Include (focus on successful operations)
+```
+
+### Columns to Enable
+- Time
+- Process Name
+- PID
+- Operation
+- Path
+- Result
+- Detail
+
+### Export Options
+```
+File → Save → All Events → CSV
+File → Save → Filtered Events → CSV (recommended)
+```
+
+### Pro Tips
+- Clear capture (Ctrl+X) before malware execution for clean logs
+- Use bookmarks (Ctrl+B) to mark important events
+- Stack duplicate events: Tools → Count Occurrences
+- Enable boot logging for persistence analysis: Options → Enable Boot Logging
+
+---
+
+## Wireshark - Network Analysis
+
+### Capture Setup
+1. Download from: https://www.wireshark.org
+2. Start → Options → Select adapter connected to INetSim
+3. Start capture before executing malware
+
+### Display Filters (During Analysis)
+
+**DNS Traffic:**
+```
+dns
+dns.qry.name contains "malicious"
+```
+
+**HTTP Traffic:**
+```
+http
+http.request.method == "POST"
+http.request.uri contains "/api"
+```
+
+**HTTPS/TLS:**
+```
+tls
+tls.handshake.type == 1
+```
+
+**Specific IP:**
+```
+ip.addr == 192.168.1.100
+ip.dst == 192.168.1.100
+```
+
+**Specific Port:**
+```
+tcp.port == 443
+udp.port == 53
+```
+
+### Export Options
+```
+File → Export Specified Packets → Save as PCAPNG
+File → Export Objects → HTTP (extract downloaded files)
+```
+
+### Command-Line Analysis (tshark)
+```bash
+# Extract DNS queries
+tshark -r capture.pcapng -Y dns.qry.name -T fields -e dns.qry.name | sort -u
+
+# Extract HTTP hosts
+tshark -r capture.pcapng -Y http.request -T fields -e http.host -e http.request.uri
+
+# Extract all contacted IPs
+tshark -r capture.pcapng -T fields -e ip.dst | sort -u
+```
+
+---
+
+## System Informer (formerly Process Hacker) - Process/Memory Analysis
+
+### Setup
+1. Download from: https://systeminformer.sourceforge.io
+2. Run as Administrator
+3. Enable: View → Update Speed → Fast
+
+### Key Features
+
+**Process Tree View:**
+```
+View → Tree View
+Expand malware process to see child processes
+```
+
+**Memory Inspection:**
+```
+Double-click process → Memory tab
+Look for RWX regions (suspicious)
+Right-click memory region → Read/Write → String scan
+```
+
+**Handles:**
+```
+Double-click process → Handles tab
+Filter: Type → Mutant (mutexes)
+Filter: Type → File (open files)
+```
+
+**Network Connections:**
+```
+Double-click process → Network tab
+Shows all connections made by process
+```
+
+**Memory Dump:**
+```
+Right-click process → Create dump file
+Save full memory for Volatility analysis
+```
+
+### Highlighting Rules
+```
+Options → Highlight → New
+Condition: Process Name → contains → sample.exe
+Color: Red
+```
+
+---
+
+## Sysmon - Advanced Windows Logging
+
+### Installation
+```powershell
+# Download Sysmon
+# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
+
+# Install with a community config
+sysmon64.exe -accepteula -i sysmonconfig.xml
+
+# Config sources (pick one):
+# https://github.com/olafhartong/sysmon-modular   (actively maintained, MITRE-mapped; use sysmonconfig.xml)
+# https://github.com/SwiftOnSecurity/sysmon-config (classic, less frequently updated)
+```
+
+### View Logs
+```powershell
+# Event Viewer
+eventvwr.msc → Applications and Services Logs → Microsoft → Windows → Sysmon → Operational
+
+# PowerShell
+Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 100 | Format-List
+
+# Export logs
+wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx
+```
+
+### Key Event IDs
+- **Event 1**: Process creation (command line, hashes, parent process)
+- **Event 3**: Network connection (source/dest IP, port, process)
+- **Event 5**: Process terminated
+- **Event 7**: Image loaded (DLL loading)
+- **Event 8**: CreateRemoteThread (injection)
+- **Event 10**: ProcessAccess (process manipulation)
+- **Event 11**: FileCreate (file creation time)
+- **Event 12/13/14**: Registry operations
+- **Event 22**: DNS query
+
+---
+
+## Regshot - Registry Comparison
+
+### Workflow
+1. Download from: https://sourceforge.net/projects/regshot/
+2. Run Regshot
+3. Click "1st shot" (before malware execution)
+4. Execute malware
+5. Wait for all malware activity to complete
+6. Click "2nd shot" (after malware execution)
+7. Click "Compare"
+8. Output saved as HTML (registry_changes.html)
+
+### Output Interpretation
+- **Keys added**: New persistence mechanisms
+- **Keys deleted**: Cleanup activities
+- **Values modified**: Configuration changes
+- **Values added**: New settings
+
+### Pro Tips
+- Scan selected folders only for faster scans
+- Use during specific malware phases (install vs. runtime)
+- Export both shots for archival
+
+---
+
+## TCPView - Real-Time Network Connections
+
+### Setup
+1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
+2. Run as Administrator
+3. Shows all active TCP/UDP connections
+
+### Features
+- Real-time connection monitoring
+- Color-coded (green = new, red = closed)
+- Right-click → Close Connection (for testing)
+- Right-click → Whois (lookup IP)
+
+### Save Output
+```
+File → Save → CSV
+```
+
+---
+
+## Noriben - Automated Procmon Analysis
+
+### Setup
+```bash
+# Download from: https://github.com/Rurik/Noriben
+git clone https://github.com/Rurik/Noriben.git
+cd Noriben
+```
+
+### Usage
+```bash
+# Automated execution with Procmon
+python Noriben.py --cmd sample.exe --timeout 300
+
+# Manual mode (execute malware yourself)
+python Noriben.py --output noriben_report.txt
+```
+
+### Output
+- Filtered Procmon events
+- Suspicious behaviors highlighted
+- Timeline of activities
+- File, registry, network artifacts
+
+---
+
+## INetSim - Fake Internet Simulation
+
+### Installation (Linux VM)
+```bash
+sudo apt update
+sudo apt install inetsim
+
+# Configure
+sudo nano /etc/inetsim/inetsim.conf
+```
+
+### Configuration
+```
+service_bind_address    0.0.0.0
+dns_default_ip          192.168.56.1  # INetSim host IP
+https_bind_port         443
+http_bind_port          80
+smtp_bind_port          25
+```
+
+### Start INetSim
+```bash
+sudo inetsim
+```
+
+### Configure Windows VM
+```
+Set DNS server to INetSim IP (192.168.56.1)
+Set gateway to INetSim IP (if using NAT)
+```
+
+### Verify
+```cmd
+# From Windows VM
+ping google.com  # Should resolve to INetSim IP
+nslookup microsoft.com  # Should resolve to INetSim IP
+```
+
+---
+
+## FakeNet-NG - Windows Internet Simulation
+
+### Installation
+```bash
+# Download from: https://github.com/mandiant/flare-fakenet-ng
+pip install flare-fakenet-ng
+```
+
+### Usage
+```cmd
+# Run as Administrator
+fakenet.exe
+
+# Execute malware (FakeNet intercepts all network)
+```
+
+### Features
+- Simulates HTTP, HTTPS, DNS, FTP, SMTP
+- Captures all network traffic
+- No external VM needed
+- Logs all requests/responses
+
+---
+
+## Tool Startup Sequence
+
+**Recommended Order:**
+1. Take VM snapshot
+2. Start INetSim (if using)
+3. Start Sysmon (already installed)
+4. Start Procmon (clear capture first)
+5. Start Wireshark
+6. Start System Informer
+7. Start Regshot → 1st shot (if using)
+8. Execute malware
+9. Monitor for 15+ minutes
+10. Regshot → 2nd shot (if using)
+11. Stop all captures
+12. Export all evidence
+13. Revert to snapshot
+
+---
+
+## Quick Reference Card
+
+| Tool | Purpose | When to Use |
+|------|---------|-------------|
+| **Procmon** | File/Registry/Process activity | Always |
+| **Wireshark** | Network traffic | Always |
+| **System Informer** | Process/Memory analysis | Always |
+| **Sysmon** | Windows event logging | Always (background) |
+| **Regshot** | Registry comparison | When need before/after snapshot |
+| **TCPView** | Real-time connections | Quick network checks |
+| **Noriben** | Automated Procmon | Time-constrained analysis |
+| **INetSim** | Fake internet | Always (network isolation) |
+| **FakeNet-NG** | Windows fake internet | Alternative to INetSim |
+
+---
+
+## Troubleshooting
+
+**Procmon not capturing:**
+- Run as Administrator
+- Clear filters (Ctrl+R)
+- Check "Capture Events" is enabled
+
+**Wireshark shows no traffic:**
+- Verify correct network adapter selected
+- Check malware actually made network requests
+- Verify VM network settings
+
+**System Informer can't dump process:**
+- Run as Administrator
+- Process may be protected
+- Try x64dbg or WinDbg instead
+
+**Sysmon not logging:**
+- Verify installation: `sc query sysmon64`
+- Check config file is valid XML
+- View logs: Event Viewer → Sysmon/Operational