vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
aecfc9365536c6f06d3590cf3c1321875c2426d3
reverse-skills-max/vendor-new/malware-analysis-claude-skills/malware-dynamic-analysis/references/sandbox_setup.md

13 KiB
Raw Blame History

Sandbox Setup Guide

Quick reference for building and maintaining isolated malware analysis environments.

REMnux - Linux Analysis VM

REMnux is a curated Ubuntu-based distro pre-loaded with reverse engineering and network simulation tools.

Installation

# Option 1: Download pre-built OVA (recommended)
# https://remnux.org/#distro
# Import via VirtualBox/VMware: File → Import Appliance → remnux-vX.X.ova

# Option 2: Add REMnux to existing Ubuntu 22.04 LTS
wget https://REMnux.org/remnux-cli
mv remnux-cli /usr/local/bin/remnux
chmod +x /usr/local/bin/remnux
sudo remnux install

Key Pre-Installed Tools

Category Tools
Network simulation INetSim, FakeNet-NG
Traffic analysis Wireshark, tshark, tcpdump, NetworkMiner
Static analysis FLOSS, strings, binwalk, file, ssdeep
PDF analysis pdf-parser, pdfid, peepdf
Office analysis olevba, mraptor, msodde
Disassembly Ghidra, Binary Ninja (trial)
Scripting Python 3, Ruby, Node.js
Memory forensics Volatility 3, bulk_extractor

Initial Configuration

# Update REMnux tools
sudo remnux upgrade

# Set timezone to UTC for consistent timestamps
sudo timedatectl set-timezone UTC

# Disable automatic updates (prevent unintended network activity)
sudo systemctl disable apt-daily.timer
sudo systemctl disable apt-daily-upgrade.timer

# Verify INetSim is ready
sudo systemctl status inetsim

INetSim Configuration on REMnux

sudo nano /etc/inetsim/inetsim.conf

Key settings to configure:

# Bind to interface facing Windows analysis VM
service_bind_address    192.168.56.1

# DNS: respond to all queries with INetSim's own IP
dns_default_ip          192.168.56.1
dns_version             "Microsoft DNS 6.1.7601"

# HTTP/HTTPS
http_bind_port          80
https_bind_port         443
http_fakemode           yes

# SMTP
smtp_bind_port          25
smtp_banner             "220 mail.example.com ESMTP"

# Start INetSim
sudo inetsim

# View INetSim logs
tail -f /var/log/inetsim/service.log

FlareVM - Windows Analysis VM

FlareVM is a Chocolatey-based installer that transforms Windows into a malware analysis workstation.

Prerequisites

  • Windows 10 (version 1903 or later) — fresh install strongly preferred
  • At minimum 60 GB disk, 4 GB RAM (8 GB recommended)
  • PowerShell 5+ with execution policy set to unrestricted
  • .NET 4+ installed
  • Disable Windows Defender and Windows Update before installing

Disable Defender Before Installation

# Run PowerShell as Administrator

# Disable real-time protection (temporary, for installation)
Set-MpPreference -DisableRealtimeMonitoring $true

# Disable all Defender components
Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
Set-MpPreference -DisableScriptScanning $true

# Disable Windows Update
sc.exe config wuauserv start=disabled
sc.exe stop wuauserv

Installation

# Run PowerShell as Administrator
Set-ExecutionPolicy Unrestricted -Force

# Download and run FlareVM installer
(New-Object net.webclient).DownloadFile(
    'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
    "$env:temp\install.ps1"
)
Unblock-File "$env:temp\install.ps1"
& "$env:temp\install.ps1"

The installer opens a GUI for package selection. Installation takes 1-2 hours.

Key Installed Tools

Category Tools
Debuggers x64dbg, WinDbg, OllyDbg
Disassemblers IDA Free, Ghidra, Binary Ninja (trial)
Process analysis System Informer (formerly Process Hacker), ProcDOT, Process Monitor
Network Wireshark, FakeNet-NG, TCPView
Static analysis PE-bear, CFF Explorer, PEiD, Detect-It-Easy
String extraction FLOSS, strings
.NET dnSpy, de4dot
Office olevba, oletools
Hex editors HxD, 010 Editor
Scripting Python 3, Ruby

Post-Installation Hardening

# Disable Windows Firewall (analysis VM only — never production)
netsh advfirewall set allprofiles state off

# Disable UAC prompts that interrupt malware execution
Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0

# Show hidden files and extensions
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name Hidden -Value 1
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt -Value 0

Network Isolation Configuration

VirtualBox Host-Only Network Setup

Host-only networking creates a private network between the host and VMs only — no internet access.

Create Host-Only Adapter (VirtualBox):

File → Host Network Manager → Create
  IPv4 Address: 192.168.56.1
  IPv4 Network Mask: 255.255.255.0
  DHCP Server: Disabled (assign static IPs manually)

Configure Windows Analysis VM:

VM Settings → Network
  Adapter 1: Host-Only Adapter → vboxnet0

Set static IP on Windows VM:

Network and Sharing Center → Change adapter settings
→ Right-click adapter → Properties → IPv4 → Manual:
  IP Address:   192.168.56.10
  Subnet Mask:  255.255.255.0
  Gateway:      192.168.56.1   (REMnux INetSim)
  DNS Server:   192.168.56.1   (REMnux INetSim)

Configure REMnux VM:

VM Settings → Network
  Adapter 1: Host-Only Adapter → vboxnet0
  (Static IP: 192.168.56.1 — set during OS install or via netplan)

VMware Host-Only Network Setup

Edit → Virtual Network Editor → Add Network → VMnet1 (Host-only)
  Subnet IP: 192.168.56.0
  Subnet mask: 255.255.255.0
  Disable: Use local DHCP service

Assign to analysis VM:

VM Settings → Network Adapter → Custom: VMnet1

Verifying Isolation

From the Windows analysis VM, confirm no external connectivity:

# Should resolve (INetSim responds)
nslookup google.com

# Should fail (no external routing)
ping 8.8.8.8

# Verify gateway is INetSim, not external router
tracert google.com

From REMnux, confirm INetSim is intercepting:

# Watch live connections from Windows VM
tail -f /var/log/inetsim/service.log

Snapshot Management

Snapshots are the single most important operational practice. A corrupted or infected baseline wastes hours.

Snapshot Strategy

Baseline snapshot — taken once after clean VM build, before any analysis:

  • OS fully patched (final time)
  • All analysis tools installed and tested
  • INetSim/FakeNet configured
  • Sysmon installed with SwiftOnSecurity config
  • Defender disabled
  • Named: BASELINE-CLEAN-YYYY-MM-DD

Pre-execution snapshot — taken at the start of each analysis session:

  • All monitoring tools open and ready (Procmon capturing, Wireshark running)
  • INetSim running on REMnux
  • Sample copied to VM but not yet executed
  • Named: PRE-EXEC-<sample-hash>-YYYY-MM-DD

Mid-analysis snapshots — optional, taken at significant milestones:

  • After installation phase completes
  • Before triggering a specific behavior
  • Named: MID-<phase>-<sample-hash>

VirtualBox Snapshot Commands

# List snapshots
VBoxManage snapshot "Windows10-Analysis" list

# Take snapshot
VBoxManage snapshot "Windows10-Analysis" take "PRE-EXEC-abc123-2024-01-15" \
  --description "Sample abc123 loaded, tools running"

# Restore snapshot
VBoxManage snapshot "Windows10-Analysis" restore "BASELINE-CLEAN-2024-01-01"

# Delete old snapshots (free disk space)
VBoxManage snapshot "Windows10-Analysis" delete "MID-install-abc123"

VMware Snapshot Commands

# Take snapshot (VMware CLI)
vmrun snapshot /path/to/vm.vmx "PRE-EXEC-abc123-2024-01-15"

# Revert to snapshot
vmrun revertToSnapshot /path/to/vm.vmx "BASELINE-CLEAN-2024-01-01"

# List snapshots
vmrun listSnapshots /path/to/vm.vmx

Discipline Rules

  • Always revert to baseline after each sample — never analyze two samples in the same session without reverting
  • Never take a snapshot while malware is running — the snapshot captures infected state
  • Store baseline OVA/OVF off the analysis machine — backup in case of host compromise
  • Label snapshots with dates — baselines age; tools need updates

VM Detection Countermeasures

Malware commonly fingerprints VMs to avoid analysis. See references/anti_analysis_bypass.md for full bypass techniques. Common baseline hardening steps:

Hardware Fingerprint Spoofing

VirtualBox — spoof BIOS/hardware strings:

# Run on host before starting VM
VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiBIOSVendor" "American Megatrends Inc."

VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemProduct" "MS-7B86"

VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiSystemVendor" "MSI"

VBoxManage setextradata "Windows10-Analysis" \
  "VBoxInternal/Devices/pcbios/0/Config/DmiChassisVendor" "MSI"

Spoof MAC address (remove VirtualBox OUI 08:00:27:xx:xx:xx):

VM Settings → Network → Advanced → MAC Address → Generate new

Or set manually to a real vendor OUI (e.g., Intel: 8C:8D:28):

VBoxManage modifyvm "Windows10-Analysis" --macaddress1 "8C8D28AABBCC"

Remove VM Artifacts on Windows Guest

# Remove VirtualBox Guest Additions (if installed)
# Control Panel → Programs → Uninstall VirtualBox Guest Additions

# Remove VMware Tools
# Control Panel → Programs → Uninstall VMware Tools

# Remove obvious registry keys
Remove-Item -Path "HKLM:\SOFTWARE\Oracle\VirtualBox Guest Additions" -Recurse -ErrorAction SilentlyContinue
Remove-Item -Path "HKLM:\SOFTWARE\VMware, Inc." -Recurse -ErrorAction SilentlyContinue

# Remove VBox/VMware processes from autostart
# Check: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Screen Resolution and User Activity

Set VM resolution to common values: 1920x1080 or 1366x768
Create desktop shortcuts, browser history, recent documents
Place realistic-looking files in Downloads, Documents, Desktop
Add a few installed applications (Chrome, 7-Zip, Notepad++)

Testing VM Hardening

Use pafish (Paranoid Fish) to verify detection resistance:

# Download: https://github.com/a0rtega/pafish
# Run pafish.exe in the VM
# Each red "FAIL" is a detectable artifact
# Aim for all green before analyzing evasive samples

CAPE Sandbox - Local Automated Sandbox

CAPE (Config And Payload Extraction) automates dynamic analysis at scale.

Quick Install (Docker)

# Clone CAPE
git clone https://github.com/kevoreilly/CAPEv2.git
cd CAPEv2

# Use Docker Compose (simplest setup)
sudo docker-compose up -d

# Web interface available at:
# http://localhost:8000

Submit Sample via CLI

# Submit file
python3 utils/submit.py --file /path/to/sample.exe

# Submit with options
python3 utils/submit.py \
  --file /path/to/sample.exe \
  --timeout 120 \
  --options "procmemdump=yes,extraction=yes"

Submit via Web UI

http://localhost:8000/submit
→ Upload file
→ Set timeout (60-300 seconds)
→ Select package (exe, dll, doc, pdf, etc.)
→ Submit

Retrieve Report

# List tasks
python3 utils/process.py -r <task_id>

# Reports stored at:
# /opt/CAPEv2/storage/analyses/<task_id>/reports/report.json

Troubleshooting

Windows VM has internet access (should not):

  • Verify adapter is Host-Only, not NAT or Bridged
  • Check default gateway points to INetSim IP, not router IP
  • Disable any secondary adapters

INetSim not responding to DNS queries:

  • Confirm service_bind_address matches REMnux's host-only IP
  • Check INetSim is running: sudo systemctl status inetsim
  • Verify no firewall blocking port 53 on REMnux: sudo ufw status

Snapshot restore fails (VirtualBox):

  • Ensure VM is fully powered off before restoring
  • Verify sufficient disk space on host
  • Try: VBoxManage snapshot <vm> restorecurrent

FlareVM installation fails partway through:

  • Re-run installer — Chocolatey packages are idempotent
  • Check Windows Update is fully disabled
  • Verify Defender exclusions cover C:\ProgramData\chocolatey

pafish detects VM even after hardening:

  • Check CPUID hypervisor bit: requires CPU passthrough or nested virt disabled
  • VMware: add hypervisor.cpuid.v0 = FALSE to .vmx file
  • VirtualBox: VBoxManage modifyvm <vm> --paravirtprovider none