reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/tool_setup.md

Dynamic Analysis Tool Setup Guide

Quick reference for configuring essential dynamic analysis tools.

Process Monitor (Procmon) - Sysinternals

Initial Setup

1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
2. Run as Administrator
3. Procmon starts capturing immediately

Essential Filters (Reduce Noise)

Filter by Process:

Process Name → is → sample.exe → Include
Process Name → is → rundll32.exe → Include (if DLL execution)
Process Name → is → explorer.exe → Exclude
Process Name → is → svchost.exe → Exclude

Filter by Operation Type:

Operation → contains → Reg → Include (registry operations)
Operation → contains → File → Include (file operations)
Operation → begins with → Process → Include (process operations)

Filter by Result:

Result → is → SUCCESS → Include (focus on successful operations)

Columns to Enable

• Time
• Process Name
• PID
• Operation
• Path
• Result
• Detail

Export Options

File → Save → All Events → CSV
File → Save → Filtered Events → CSV (recommended)

Pro Tips

• Clear capture (Ctrl+X) before malware execution for clean logs
• Use bookmarks (Ctrl+B) to mark important events
• Stack duplicate events: Tools → Count Occurrences
• Enable boot logging for persistence analysis: Options → Enable Boot Logging

---

Wireshark - Network Analysis

Capture Setup

1. Download from: https://www.wireshark.org
2. Start → Options → Select adapter connected to INetSim
3. Start capture before executing malware

Display Filters (During Analysis)

DNS Traffic:

dns
dns.qry.name contains "malicious"

HTTP Traffic:

http
http.request.method == "POST"
http.request.uri contains "/api"

HTTPS/TLS:

tls
tls.handshake.type == 1

Specific IP:

ip.addr == 192.168.1.100
ip.dst == 192.168.1.100

Specific Port:

tcp.port == 443
udp.port == 53

Export Options

File → Export Specified Packets → Save as PCAPNG
File → Export Objects → HTTP (extract downloaded files)

Command-Line Analysis (tshark)

# Extract DNS queries
tshark -r capture.pcapng -Y dns.qry.name -T fields -e dns.qry.name | sort -u

# Extract HTTP hosts
tshark -r capture.pcapng -Y http.request -T fields -e http.host -e http.request.uri

# Extract all contacted IPs
tshark -r capture.pcapng -T fields -e ip.dst | sort -u

---

System Informer (formerly Process Hacker) - Process/Memory Analysis

Setup

1. Download from: https://systeminformer.sourceforge.io
2. Run as Administrator
3. Enable: View → Update Speed → Fast

Key Features

Process Tree View:

View → Tree View
Expand malware process to see child processes

Memory Inspection:

Double-click process → Memory tab
Look for RWX regions (suspicious)
Right-click memory region → Read/Write → String scan

Handles:

Double-click process → Handles tab
Filter: Type → Mutant (mutexes)
Filter: Type → File (open files)

Network Connections:

Double-click process → Network tab
Shows all connections made by process

Memory Dump:

Right-click process → Create dump file
Save full memory for Volatility analysis

Highlighting Rules

Options → Highlight → New
Condition: Process Name → contains → sample.exe
Color: Red

---

Sysmon - Advanced Windows Logging

Installation

# Download Sysmon
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

# Install with a community config
sysmon64.exe -accepteula -i sysmonconfig.xml

# Config sources (pick one):
# https://github.com/olafhartong/sysmon-modular   (actively maintained, MITRE-mapped; use sysmonconfig.xml)
# https://github.com/SwiftOnSecurity/sysmon-config (classic, less frequently updated)

View Logs

# Event Viewer
eventvwr.msc → Applications and Services Logs → Microsoft → Windows → Sysmon → Operational

# PowerShell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 100 | Format-List

# Export logs
wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx

Key Event IDs

• Event 1: Process creation (command line, hashes, parent process)
• Event 3: Network connection (source/dest IP, port, process)
• Event 5: Process terminated
• Event 7: Image loaded (DLL loading)
• Event 8: CreateRemoteThread (injection)
• Event 10: ProcessAccess (process manipulation)
• Event 11: FileCreate (file creation time)
• Event 12/13/14: Registry operations
• Event 22: DNS query

---

Regshot - Registry Comparison

Workflow

1. Download from: https://sourceforge.net/projects/regshot/
2. Run Regshot
3. Click "1st shot" (before malware execution)
4. Execute malware
5. Wait for all malware activity to complete
6. Click "2nd shot" (after malware execution)
7. Click "Compare"
8. Output saved as HTML (registry_changes.html)

Output Interpretation

• Keys added: New persistence mechanisms
• Keys deleted: Cleanup activities
• Values modified: Configuration changes
• Values added: New settings

Pro Tips

• Scan selected folders only for faster scans
• Use during specific malware phases (install vs. runtime)
• Export both shots for archival

---

TCPView - Real-Time Network Connections

Setup

1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
2. Run as Administrator
3. Shows all active TCP/UDP connections

Features

• Real-time connection monitoring
• Color-coded (green = new, red = closed)
• Right-click → Close Connection (for testing)
• Right-click → Whois (lookup IP)

Save Output

File → Save → CSV

---

Noriben - Automated Procmon Analysis

Setup

# Download from: https://github.com/Rurik/Noriben
git clone https://github.com/Rurik/Noriben.git
cd Noriben

Usage

# Automated execution with Procmon
python Noriben.py --cmd sample.exe --timeout 300

# Manual mode (execute malware yourself)
python Noriben.py --output noriben_report.txt

Output

• Filtered Procmon events
• Suspicious behaviors highlighted
• Timeline of activities
• File, registry, network artifacts

---

INetSim - Fake Internet Simulation

Installation (Linux VM)

sudo apt update
sudo apt install inetsim

# Configure
sudo nano /etc/inetsim/inetsim.conf

Configuration

service_bind_address    0.0.0.0
dns_default_ip          192.168.56.1  # INetSim host IP
https_bind_port         443
http_bind_port          80
smtp_bind_port          25

Start INetSim

sudo inetsim

Configure Windows VM

Set DNS server to INetSim IP (192.168.56.1)
Set gateway to INetSim IP (if using NAT)

Verify

# From Windows VM
ping google.com  # Should resolve to INetSim IP
nslookup microsoft.com  # Should resolve to INetSim IP

---

FakeNet-NG - Windows Internet Simulation

Installation

# Download from: https://github.com/mandiant/flare-fakenet-ng
pip install flare-fakenet-ng

Usage

# Run as Administrator
fakenet.exe

# Execute malware (FakeNet intercepts all network)

Features

• Simulates HTTP, HTTPS, DNS, FTP, SMTP
• Captures all network traffic
• No external VM needed
• Logs all requests/responses

---

Tool Startup Sequence

Recommended Order:

1. Take VM snapshot
2. Start INetSim (if using)
3. Start Sysmon (already installed)
4. Start Procmon (clear capture first)
5. Start Wireshark
6. Start System Informer
7. Start Regshot → 1st shot (if using)
8. Execute malware
9. Monitor for 15+ minutes
10. Regshot → 2nd shot (if using)
11. Stop all captures
12. Export all evidence
13. Revert to snapshot

---

Quick Reference Card

Tool	Purpose	When to Use
Procmon	File/Registry/Process activity	Always
Wireshark	Network traffic	Always
System Informer	Process/Memory analysis	Always
Sysmon	Windows event logging	Always (background)
Regshot	Registry comparison	When need before/after snapshot
TCPView	Real-time connections	Quick network checks
Noriben	Automated Procmon	Time-constrained analysis
INetSim	Fake internet	Always (network isolation)
FakeNet-NG	Windows fake internet	Alternative to INetSim

---

Troubleshooting

Procmon not capturing:

• Run as Administrator
• Clear filters (Ctrl+R)
• Check "Capture Events" is enabled

Wireshark shows no traffic:

• Verify correct network adapter selected
• Check malware actually made network requests
• Verify VM network settings

System Informer can't dump process:

• Run as Administrator
• Process may be protected
• Try x64dbg or WinDbg instead

Sysmon not logging:

• Verify installation: sc query sysmon64
• Check config file is valid XML
• View logs: Event Viewer → Sysmon/Operational