reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/tool_setup.md

# Dynamic Analysis Tool Setup Guide

Quick reference for configuring essential dynamic analysis tools.

## Process Monitor (Procmon) - Sysinternals

### Initial Setup
1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
2. Run as Administrator
3. Procmon starts capturing immediately

### Essential Filters (Reduce Noise)

**Filter by Process:**
```
Process Name → is → sample.exe → Include
Process Name → is → rundll32.exe → Include (if DLL execution)
Process Name → is → explorer.exe → Exclude
Process Name → is → svchost.exe → Exclude
```

**Filter by Operation Type:**
```
Operation → contains → Reg → Include (registry operations)
Operation → contains → File → Include (file operations)
Operation → begins with → Process → Include (process operations)
```

**Filter by Result:**
```
Result → is → SUCCESS → Include (focus on successful operations)
```

### Columns to Enable
- Time
- Process Name
- PID
- Operation
- Path
- Result
- Detail

### Export Options
```
File → Save → All Events → CSV
File → Save → Filtered Events → CSV (recommended)
```

### Pro Tips
- Clear capture (Ctrl+X) before malware execution for clean logs
- Use bookmarks (Ctrl+B) to mark important events
- Stack duplicate events: Tools → Count Occurrences
- Enable boot logging for persistence analysis: Options → Enable Boot Logging

---

## Wireshark - Network Analysis

### Capture Setup
1. Download from: https://www.wireshark.org
2. Start → Options → Select adapter connected to INetSim
3. Start capture before executing malware

### Display Filters (During Analysis)

**DNS Traffic:**
```
dns
dns.qry.name contains "malicious"
```

**HTTP Traffic:**
```
http
http.request.method == "POST"
http.request.uri contains "/api"
```

**HTTPS/TLS:**
```
tls
tls.handshake.type == 1
```

**Specific IP:**
```
ip.addr == 192.168.1.100
ip.dst == 192.168.1.100
```

**Specific Port:**
```
tcp.port == 443
udp.port == 53
```

### Export Options
```
File → Export Specified Packets → Save as PCAPNG
File → Export Objects → HTTP (extract downloaded files)
```

### Command-Line Analysis (tshark)
```bash
# Extract DNS queries
tshark -r capture.pcapng -Y dns.qry.name -T fields -e dns.qry.name | sort -u

# Extract HTTP hosts
tshark -r capture.pcapng -Y http.request -T fields -e http.host -e http.request.uri

# Extract all contacted IPs
tshark -r capture.pcapng -T fields -e ip.dst | sort -u
```

---

## System Informer (formerly Process Hacker) - Process/Memory Analysis

### Setup
1. Download from: https://systeminformer.sourceforge.io
2. Run as Administrator
3. Enable: View → Update Speed → Fast

### Key Features

**Process Tree View:**
```
View → Tree View
Expand malware process to see child processes
```

**Memory Inspection:**
```
Double-click process → Memory tab
Look for RWX regions (suspicious)
Right-click memory region → Read/Write → String scan
```

**Handles:**
```
Double-click process → Handles tab
Filter: Type → Mutant (mutexes)
Filter: Type → File (open files)
```

**Network Connections:**
```
Double-click process → Network tab
Shows all connections made by process
```

**Memory Dump:**
```
Right-click process → Create dump file
Save full memory for Volatility analysis
```

### Highlighting Rules
```
Options → Highlight → New
Condition: Process Name → contains → sample.exe
Color: Red
```

---

## Sysmon - Advanced Windows Logging

### Installation
```powershell
# Download Sysmon
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

# Install with a community config
sysmon64.exe -accepteula -i sysmonconfig.xml

# Config sources (pick one):
# https://github.com/olafhartong/sysmon-modular   (actively maintained, MITRE-mapped; use sysmonconfig.xml)
# https://github.com/SwiftOnSecurity/sysmon-config (classic, less frequently updated)
```

### View Logs
```powershell
# Event Viewer
eventvwr.msc → Applications and Services Logs → Microsoft → Windows → Sysmon → Operational

# PowerShell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 100 | Format-List

# Export logs
wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx
```

### Key Event IDs
- **Event 1**: Process creation (command line, hashes, parent process)
- **Event 3**: Network connection (source/dest IP, port, process)
- **Event 5**: Process terminated
- **Event 7**: Image loaded (DLL loading)
- **Event 8**: CreateRemoteThread (injection)
- **Event 10**: ProcessAccess (process manipulation)
- **Event 11**: FileCreate (file creation time)
- **Event 12/13/14**: Registry operations
- **Event 22**: DNS query

---

## Regshot - Registry Comparison

### Workflow
1. Download from: https://sourceforge.net/projects/regshot/
2. Run Regshot
3. Click "1st shot" (before malware execution)
4. Execute malware
5. Wait for all malware activity to complete
6. Click "2nd shot" (after malware execution)
7. Click "Compare"
8. Output saved as HTML (registry_changes.html)

### Output Interpretation
- **Keys added**: New persistence mechanisms
- **Keys deleted**: Cleanup activities
- **Values modified**: Configuration changes
- **Values added**: New settings

### Pro Tips
- Scan selected folders only for faster scans
- Use during specific malware phases (install vs. runtime)
- Export both shots for archival

---

## TCPView - Real-Time Network Connections

### Setup
1. Download from: https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
2. Run as Administrator
3. Shows all active TCP/UDP connections

### Features
- Real-time connection monitoring
- Color-coded (green = new, red = closed)
- Right-click → Close Connection (for testing)
- Right-click → Whois (lookup IP)

### Save Output
```
File → Save → CSV
```

---

## Noriben - Automated Procmon Analysis

### Setup
```bash
# Download from: https://github.com/Rurik/Noriben
git clone https://github.com/Rurik/Noriben.git
cd Noriben
```

### Usage
```bash
# Automated execution with Procmon
python Noriben.py --cmd sample.exe --timeout 300

# Manual mode (execute malware yourself)
python Noriben.py --output noriben_report.txt
```

### Output
- Filtered Procmon events
- Suspicious behaviors highlighted
- Timeline of activities
- File, registry, network artifacts

---

## INetSim - Fake Internet Simulation

### Installation (Linux VM)
```bash
sudo apt update
sudo apt install inetsim

# Configure
sudo nano /etc/inetsim/inetsim.conf
```

### Configuration
```
service_bind_address    0.0.0.0
dns_default_ip          192.168.56.1  # INetSim host IP
https_bind_port         443
http_bind_port          80
smtp_bind_port          25
```

### Start INetSim
```bash
sudo inetsim
```

### Configure Windows VM
```
Set DNS server to INetSim IP (192.168.56.1)
Set gateway to INetSim IP (if using NAT)
```

### Verify
```cmd
# From Windows VM
ping google.com  # Should resolve to INetSim IP
nslookup microsoft.com  # Should resolve to INetSim IP
```

---

## FakeNet-NG - Windows Internet Simulation

### Installation
```bash
# Download from: https://github.com/mandiant/flare-fakenet-ng
pip install flare-fakenet-ng
```

### Usage
```cmd
# Run as Administrator
fakenet.exe

# Execute malware (FakeNet intercepts all network)
```

### Features
- Simulates HTTP, HTTPS, DNS, FTP, SMTP
- Captures all network traffic
- No external VM needed
- Logs all requests/responses

---

## Tool Startup Sequence

**Recommended Order:**
1. Take VM snapshot
2. Start INetSim (if using)
3. Start Sysmon (already installed)
4. Start Procmon (clear capture first)
5. Start Wireshark
6. Start System Informer
7. Start Regshot → 1st shot (if using)
8. Execute malware
9. Monitor for 15+ minutes
10. Regshot → 2nd shot (if using)
11. Stop all captures
12. Export all evidence
13. Revert to snapshot

---

## Quick Reference Card

| Tool | Purpose | When to Use |
|------|---------|-------------|
| **Procmon** | File/Registry/Process activity | Always |
| **Wireshark** | Network traffic | Always |
| **System Informer** | Process/Memory analysis | Always |
| **Sysmon** | Windows event logging | Always (background) |
| **Regshot** | Registry comparison | When need before/after snapshot |
| **TCPView** | Real-time connections | Quick network checks |
| **Noriben** | Automated Procmon | Time-constrained analysis |
| **INetSim** | Fake internet | Always (network isolation) |
| **FakeNet-NG** | Windows fake internet | Alternative to INetSim |

---

## Troubleshooting

**Procmon not capturing:**
- Run as Administrator
- Clear filters (Ctrl+R)
- Check "Capture Events" is enabled

**Wireshark shows no traffic:**
- Verify correct network adapter selected
- Check malware actually made network requests
- Verify VM network settings

**System Informer can't dump process:**
- Run as Administrator
- Process may be protected
- Try x64dbg or WinDbg instead

**Sysmon not logging:**
- Verify installation: `sc query sysmon64`
- Check config file is valid XML
- View logs: Event Viewer → Sysmon/Operational