We can see that for the specimen we see that a new file. Let’s launch the malware specimen and let’s observe the process monitor output. This will also generate a pcap which we can also analyze it with Wireshark. Take a 1 st shot of the system.Īlso, we are going to launch CaptureBAT to capture all transactions done from this malware sample. Tools we are going to use:īefore we are going to infect the system with malware, let’s capture the state using RegShot. Now with all that static analysis, we can start out behavioral analysis to see how the specimen is utilizing these IoCs. tells us lot of information about the nature of the specimen.

For example, again we can see CryptDecrypt, CreateFile, CreateProcessA, etc.

We can also use PEframe to find out suspicious IAT alerts which tell us all the DLLs it is importing and utilizing functions. Some interesting references here like CryptDecrypt which is an indicator that the specimen might deal with some encryption/decryption routines. We can also look at the embedded strings from PEstudio. It shows file is not signed by any certificate and modifies the registry. Let’s see the suspicious indicators from PEStudio. We can relate this to HTTP 1.1 in the embedded strings. InternetReadFile will read file referred by HttpOpenRequest. tmp file (may be a temporary file used by malware), Run registry settings, HTTP/1.1, InternetReadFile, sleep, etc. Straight away we can see important strings which referred to a. Below is an example for strings 2 in action

It can also get strings over running processes. Strings2 extracts both ASCII and UNICODE by default and is an enhancement over strings.

Pestudio indicators