reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
@@ -0,0 +1,397 @@
|
||||
# Dynamic Analysis Tool Setup Guide
|
||||
|
||||
Quick reference for configuring essential dynamic analysis tools.
|
||||
|
||||
## Process Monitor (Procmon) - Sysinternals
|
||||
|
||||
### Initial Setup
|
||||
1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
|
||||
2. Run as Administrator
|
||||
3. Procmon starts capturing immediately
|
||||
|
||||
### Essential Filters (Reduce Noise)
|
||||
|
||||
**Filter by Process:**
|
||||
```
|
||||
Process Name → is → sample.exe → Include
|
||||
Process Name → is → rundll32.exe → Include (if DLL execution)
|
||||
Process Name → is → explorer.exe → Exclude
|
||||
Process Name → is → svchost.exe → Exclude
|
||||
```
|
||||
|
||||
**Filter by Operation Type:**
|
||||
```
|
||||
Operation → contains → Reg → Include (registry operations)
|
||||
Operation → contains → File → Include (file operations)
|
||||
Operation → begins with → Process → Include (process operations)
|
||||
```
|
||||
|
||||
**Filter by Result:**
|
||||
```
|
||||
Result → is → SUCCESS → Include (focus on successful operations)
|
||||
```
|
||||
|
||||
### Columns to Enable
|
||||
- Time
|
||||
- Process Name
|
||||
- PID
|
||||
- Operation
|
||||
- Path
|
||||
- Result
|
||||
- Detail
|
||||
|
||||
### Export Options
|
||||
```
|
||||
File → Save → All Events → CSV
|
||||
File → Save → Filtered Events → CSV (recommended)
|
||||
```
|
||||
|
||||
### Pro Tips
|
||||
- Clear capture (Ctrl+X) before malware execution for clean logs
|
||||
- Use bookmarks (Ctrl+B) to mark important events
|
||||
- Stack duplicate events: Tools → Count Occurrences
|
||||
- Enable boot logging for persistence analysis: Options → Enable Boot Logging
|
||||
|
||||
---
|
||||
|
||||
## Wireshark - Network Analysis
|
||||
|
||||
### Capture Setup
|
||||
1. Download from: https://www.wireshark.org
|
||||
2. Start → Options → Select adapter connected to INetSim
|
||||
3. Start capture before executing malware
|
||||
|
||||
### Display Filters (During Analysis)
|
||||
|
||||
**DNS Traffic:**
|
||||
```
|
||||
dns
|
||||
dns.qry.name contains "malicious"
|
||||
```
|
||||
|
||||
**HTTP Traffic:**
|
||||
```
|
||||
http
|
||||
http.request.method == "POST"
|
||||
http.request.uri contains "/api"
|
||||
```
|
||||
|
||||
**HTTPS/TLS:**
|
||||
```
|
||||
tls
|
||||
tls.handshake.type == 1
|
||||
```
|
||||
|
||||
**Specific IP:**
|
||||
```
|
||||
ip.addr == 192.168.1.100
|
||||
ip.dst == 192.168.1.100
|
||||
```
|
||||
|
||||
**Specific Port:**
|
||||
```
|
||||
tcp.port == 443
|
||||
udp.port == 53
|
||||
```
|
||||
|
||||
### Export Options
|
||||
```
|
||||
File → Export Specified Packets → Save as PCAPNG
|
||||
File → Export Objects → HTTP (extract downloaded files)
|
||||
```
|
||||
|
||||
### Command-Line Analysis (tshark)
|
||||
```bash
|
||||
# Extract DNS queries
|
||||
tshark -r capture.pcapng -Y dns.qry.name -T fields -e dns.qry.name | sort -u
|
||||
|
||||
# Extract HTTP hosts
|
||||
tshark -r capture.pcapng -Y http.request -T fields -e http.host -e http.request.uri
|
||||
|
||||
# Extract all contacted IPs
|
||||
tshark -r capture.pcapng -T fields -e ip.dst | sort -u
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## System Informer (formerly Process Hacker) - Process/Memory Analysis
|
||||
|
||||
### Setup
|
||||
1. Download from: https://systeminformer.sourceforge.io
|
||||
2. Run as Administrator
|
||||
3. Enable: View → Update Speed → Fast
|
||||
|
||||
### Key Features
|
||||
|
||||
**Process Tree View:**
|
||||
```
|
||||
View → Tree View
|
||||
Expand malware process to see child processes
|
||||
```
|
||||
|
||||
**Memory Inspection:**
|
||||
```
|
||||
Double-click process → Memory tab
|
||||
Look for RWX regions (suspicious)
|
||||
Right-click memory region → Read/Write → String scan
|
||||
```
|
||||
|
||||
**Handles:**
|
||||
```
|
||||
Double-click process → Handles tab
|
||||
Filter: Type → Mutant (mutexes)
|
||||
Filter: Type → File (open files)
|
||||
```
|
||||
|
||||
**Network Connections:**
|
||||
```
|
||||
Double-click process → Network tab
|
||||
Shows all connections made by process
|
||||
```
|
||||
|
||||
**Memory Dump:**
|
||||
```
|
||||
Right-click process → Create dump file
|
||||
Save full memory for Volatility analysis
|
||||
```
|
||||
|
||||
### Highlighting Rules
|
||||
```
|
||||
Options → Highlight → New
|
||||
Condition: Process Name → contains → sample.exe
|
||||
Color: Red
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Sysmon - Advanced Windows Logging
|
||||
|
||||
### Installation
|
||||
```powershell
|
||||
# Download Sysmon
|
||||
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
|
||||
|
||||
# Install with a community config
|
||||
sysmon64.exe -accepteula -i sysmonconfig.xml
|
||||
|
||||
# Config sources (pick one):
|
||||
# https://github.com/olafhartong/sysmon-modular (actively maintained, MITRE-mapped; use sysmonconfig.xml)
|
||||
# https://github.com/SwiftOnSecurity/sysmon-config (classic, less frequently updated)
|
||||
```
|
||||
|
||||
### View Logs
|
||||
```powershell
|
||||
# Event Viewer
|
||||
eventvwr.msc → Applications and Services Logs → Microsoft → Windows → Sysmon → Operational
|
||||
|
||||
# PowerShell
|
||||
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 100 | Format-List
|
||||
|
||||
# Export logs
|
||||
wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx
|
||||
```
|
||||
|
||||
### Key Event IDs
|
||||
- **Event 1**: Process creation (command line, hashes, parent process)
|
||||
- **Event 3**: Network connection (source/dest IP, port, process)
|
||||
- **Event 5**: Process terminated
|
||||
- **Event 7**: Image loaded (DLL loading)
|
||||
- **Event 8**: CreateRemoteThread (injection)
|
||||
- **Event 10**: ProcessAccess (process manipulation)
|
||||
- **Event 11**: FileCreate (file creation time)
|
||||
- **Event 12/13/14**: Registry operations
|
||||
- **Event 22**: DNS query
|
||||
|
||||
---
|
||||
|
||||
## Regshot - Registry Comparison
|
||||
|
||||
### Workflow
|
||||
1. Download from: https://sourceforge.net/projects/regshot/
|
||||
2. Run Regshot
|
||||
3. Click "1st shot" (before malware execution)
|
||||
4. Execute malware
|
||||
5. Wait for all malware activity to complete
|
||||
6. Click "2nd shot" (after malware execution)
|
||||
7. Click "Compare"
|
||||
8. Output saved as HTML (registry_changes.html)
|
||||
|
||||
### Output Interpretation
|
||||
- **Keys added**: New persistence mechanisms
|
||||
- **Keys deleted**: Cleanup activities
|
||||
- **Values modified**: Configuration changes
|
||||
- **Values added**: New settings
|
||||
|
||||
### Pro Tips
|
||||
- Scan selected folders only for faster scans
|
||||
- Use during specific malware phases (install vs. runtime)
|
||||
- Export both shots for archival
|
||||
|
||||
---
|
||||
|
||||
## TCPView - Real-Time Network Connections
|
||||
|
||||
### Setup
|
||||
1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
|
||||
2. Run as Administrator
|
||||
3. Shows all active TCP/UDP connections
|
||||
|
||||
### Features
|
||||
- Real-time connection monitoring
|
||||
- Color-coded (green = new, red = closed)
|
||||
- Right-click → Close Connection (for testing)
|
||||
- Right-click → Whois (lookup IP)
|
||||
|
||||
### Save Output
|
||||
```
|
||||
File → Save → CSV
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Noriben - Automated Procmon Analysis
|
||||
|
||||
### Setup
|
||||
```bash
|
||||
# Download from: https://github.com/Rurik/Noriben
|
||||
git clone https://github.com/Rurik/Noriben.git
|
||||
cd Noriben
|
||||
```
|
||||
|
||||
### Usage
|
||||
```bash
|
||||
# Automated execution with Procmon
|
||||
python Noriben.py --cmd sample.exe --timeout 300
|
||||
|
||||
# Manual mode (execute malware yourself)
|
||||
python Noriben.py --output noriben_report.txt
|
||||
```
|
||||
|
||||
### Output
|
||||
- Filtered Procmon events
|
||||
- Suspicious behaviors highlighted
|
||||
- Timeline of activities
|
||||
- File, registry, network artifacts
|
||||
|
||||
---
|
||||
|
||||
## INetSim - Fake Internet Simulation
|
||||
|
||||
### Installation (Linux VM)
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install inetsim
|
||||
|
||||
# Configure
|
||||
sudo nano /etc/inetsim/inetsim.conf
|
||||
```
|
||||
|
||||
### Configuration
|
||||
```
|
||||
service_bind_address 0.0.0.0
|
||||
dns_default_ip 192.168.56.1 # INetSim host IP
|
||||
https_bind_port 443
|
||||
http_bind_port 80
|
||||
smtp_bind_port 25
|
||||
```
|
||||
|
||||
### Start INetSim
|
||||
```bash
|
||||
sudo inetsim
|
||||
```
|
||||
|
||||
### Configure Windows VM
|
||||
```
|
||||
Set DNS server to INetSim IP (192.168.56.1)
|
||||
Set gateway to INetSim IP (if using NAT)
|
||||
```
|
||||
|
||||
### Verify
|
||||
```cmd
|
||||
# From Windows VM
|
||||
ping google.com # Should resolve to INetSim IP
|
||||
nslookup microsoft.com # Should resolve to INetSim IP
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## FakeNet-NG - Windows Internet Simulation
|
||||
|
||||
### Installation
|
||||
```bash
|
||||
# Download from: https://github.com/mandiant/flare-fakenet-ng
|
||||
pip install flare-fakenet-ng
|
||||
```
|
||||
|
||||
### Usage
|
||||
```cmd
|
||||
# Run as Administrator
|
||||
fakenet.exe
|
||||
|
||||
# Execute malware (FakeNet intercepts all network)
|
||||
```
|
||||
|
||||
### Features
|
||||
- Simulates HTTP, HTTPS, DNS, FTP, SMTP
|
||||
- Captures all network traffic
|
||||
- No external VM needed
|
||||
- Logs all requests/responses
|
||||
|
||||
---
|
||||
|
||||
## Tool Startup Sequence
|
||||
|
||||
**Recommended Order:**
|
||||
1. Take VM snapshot
|
||||
2. Start INetSim (if using)
|
||||
3. Start Sysmon (already installed)
|
||||
4. Start Procmon (clear capture first)
|
||||
5. Start Wireshark
|
||||
6. Start System Informer
|
||||
7. Start Regshot → 1st shot (if using)
|
||||
8. Execute malware
|
||||
9. Monitor for 15+ minutes
|
||||
10. Regshot → 2nd shot (if using)
|
||||
11. Stop all captures
|
||||
12. Export all evidence
|
||||
13. Revert to snapshot
|
||||
|
||||
---
|
||||
|
||||
## Quick Reference Card
|
||||
|
||||
| Tool | Purpose | When to Use |
|
||||
|------|---------|-------------|
|
||||
| **Procmon** | File/Registry/Process activity | Always |
|
||||
| **Wireshark** | Network traffic | Always |
|
||||
| **System Informer** | Process/Memory analysis | Always |
|
||||
| **Sysmon** | Windows event logging | Always (background) |
|
||||
| **Regshot** | Registry comparison | When need before/after snapshot |
|
||||
| **TCPView** | Real-time connections | Quick network checks |
|
||||
| **Noriben** | Automated Procmon | Time-constrained analysis |
|
||||
| **INetSim** | Fake internet | Always (network isolation) |
|
||||
| **FakeNet-NG** | Windows fake internet | Alternative to INetSim |
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
**Procmon not capturing:**
|
||||
- Run as Administrator
|
||||
- Clear filters (Ctrl+R)
|
||||
- Check "Capture Events" is enabled
|
||||
|
||||
**Wireshark shows no traffic:**
|
||||
- Verify correct network adapter selected
|
||||
- Check malware actually made network requests
|
||||
- Verify VM network settings
|
||||
|
||||
**System Informer can't dump process:**
|
||||
- Run as Administrator
|
||||
- Process may be protected
|
||||
- Try x64dbg or WinDbg instead
|
||||
|
||||
**Sysmon not logging:**
|
||||
- Verify installation: `sc query sysmon64`
|
||||
- Check config file is valid XML
|
||||
- View logs: Event Viewer → Sysmon/Operational
|
||||
Reference in New Issue
Block a user