malware-dynamic-analysis

Name: malware-dynamic-analysis
Author: gl0bal01

43stars3forks

How to install malware-dynamic-analysis?

gl0bal01/malware-analysis-claude-skills/malware-dynamic-analysis

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-dynamic-analysis

Installs into the current project.

Summary

Execute and monitor malware in controlled sandbox environments. Use when you need to observe runtime behavior, capture network traffic, monitor process activity, analyze file/registry changes, or understand actual malware functionality beyond static analysis. Guides safe executio

Files · 1

View on GitHub

SKILL.md

1	# Malware Dynamic Analysis
2
3	Safely execute and comprehensively monitor malware behavior in isolated environments for professional malware research and enterprise security operations.
4
5	## When to Use This Skill
6
7	Use this skill when you need to:
8	- Execute malware safely in an isolated environment
9	- Monitor runtime behavior (processes, files, registry, network)
10	- Capture and analyze network traffic and C2 communications
11	- Validate hypotheses from static analysis
12	- Extract runtime-decrypted strings or configurations
13	- Document actual malware functionality for reports
14	- Create behavioral IOCs and detection signatures
15	- Analyze process injection and code execution techniques
16
17	## ⚠️ Safety First - Pre-Execution Checklist
18
19	CRITICAL: Never execute malware outside a properly isolated environment.
20
21	Before ANY execution:
22	- [ ] Snapshot taken of clean VM state
23	- [ ] Network isolated (host-only or INetSim simulation)
24	- [ ] No shared folders enabled
25	- [ ] No clipboard sharing
26	- [ ] Time sync disabled
27	- [ ] Monitoring tools ready and running
28	- [ ] Analysis persona active (no personal info)
29	- [ ] Emergency shutdown plan ready
30
31	If ANY checkbox fails - DO NOT EXECUTE
32
33	## Dynamic Analysis Workflow
34
35	### Phase 1: Environment Preparation (10 minutes)
36
37	1. Verify VM Isolation:
38	```bash
39	# Check network adapter settings
40	# Should be: Host-only or NAT with INetSim
41
42	# Test internet connectivity (should fail or hit INetSim)
43	ping 8.8.8.8
44	nslookup google.com
45
46	# Verify no shared folders
47	net use # Windows
48	df -h # Linux
49
50	# Check time sync (should be disabled)
51	w32tm /query /status # Windows
52	```
53
54	2. Start Monitoring Tools:
55
56	Launch in this order:
57	1. Procmon (Process Monitor) - File/Registry/Process activity
58	2. Wireshark - Network traffic capture
59	3. System Informer - Process/memory monitoring
60	4. Regshot - Take "before" snapshot (optional)
61
62	See `references/tool_setup.md` for detailed configuration.
63
64	3. Establish Baseline:
65	- Take note of running processes
66	- Document open network connections
67	- Record current registry state (if using Regshot)
68
69	### Phase 2: Malware Execution (Variable Duration)
70
71	Execute the Sample:
72
73	```powershell
74	# For PE executables
75	.\sample.exe
76
77	# With arguments (if required)
78	.\sample.exe /install /silent
79
80	# For DLLs
81	rundll32.exe sample.dll,DllMain
82	rundll32.exe sample.dll,ExportedFunction
83
84	# For scripts
85	powershell.exe -ExecutionPolicy Bypass -File sample.ps1
86	cscript.exe //NoLogo sample.vbs
87	wscript.exe sample.js
88	```
89
90	Observation Duration:
91	- Minimum: 5 minutes (most malware acts quickly)
92	- Standard: 15 minutes (catch delayed execution)
93	- Extended: 60+ minutes (for time-based evasion)
94
95	What to Watch:
96	- New processes spawned
97	- Network connections initiated
98	- Files created/modified/deleted
99	- Registry keys modified
100	- CPU/Memory usage spikes
101	- Pop-ups or UI changes
102	- Error messages
103
104	### Phase 3: Process Monitoring
105
106	Using System Informer:
107
108	Track New Processes:
109	1. Watch for new entries in process list
110	2. Note parent-child relationships
111	3. Document command-line arguments
112	4. Check process integrity levels
113	5. Monitor memory allocations
114
115	Identify Process Injection:
116	- Look for RWX (Read-Write-Execute) memory regions
117	- Check for threads in unexpected processes
118	- Monitor for process hollowing indicators
119	- Watch for CreateRemoteThread calls
120
121	Memory Analysis:
122	```
123	Right-click process → Memory → Inspect
124	Look for:
125	- Suspicious memory regions (RWX permissions)
126	- Injected DLLs (not in system path)
127	- Decoded strings in memory
128	- Configuration data
129
130	Right-click process → Create Dump File
131	→ Save for later Volatility analysis
132	```
133
134	Handles Analysis:
135	```
136	Double-click process → Handles tab
137
138	Look for:
139	- Mutexes (process synchronization objects)
140	- Named pipes (inter-process communication)
141	- File handles (what files are open)
142	- Registry key handles
143	```
144
145	### Phase 4: File System Monitoring
146
147	Using Procmon (Process Monitor):
148
149	Configure Filters:
150	```
151	Filter → Add:
152	- Process Name → is → sample.exe → Include
153	- Operation → contains → File → Include
154	- Operation → contains → Reg → Include
155	- Process Name → is → explorer.exe → Exclude
156	- Process Name → is → svchost.exe → Exclude (unless suspicious)
157	```
158
159	Monitor File Operations:
160
161	Look for:
162	- CreateFile - Files being created
163	- WriteFile - Files being modified
164	- DeleteFile - Files being deleted
165	- SetRenameInformationFile - Files being renamed
166
167	Key Locations to Watch:
168	```
169	C:\Users\<user>\AppData\Local\Temp\
170	C:\Users\<user>\AppData\Roaming\
171	C:\ProgramData\
172	C:\Windows\Temp\
173	C:\Users\<user>\AppData\

People who liked this also viewed

6 picks

Type

malware-dynamic-analysis

43stars3forks

View on GitHub

How to install malware-dynamic-analysis?

gl0bal01/malware-analysis-claude-skills/malware-dynamic-analysis

$npx -y skills add gl0bal01/malware-analysis-claude-skills --skill malware-dynamic-analysis

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Malware Dynamic Analysis
2
3	Safely execute and comprehensively monitor malware behavior in isolated environments for professional malware research and enterprise security operations.
4
5	## When to Use This Skill
6
7	Use this skill when you need to:
8	- Execute malware safely in an isolated environment
9	- Monitor runtime behavior (processes, files, registry, network)
10	- Capture and analyze network traffic and C2 communications
11	- Validate hypotheses from static analysis
12	- Extract runtime-decrypted strings or configurations
13	- Document actual malware functionality for reports
14	- Create behavioral IOCs and detection signatures
15	- Analyze process injection and code execution techniques
16
17	## ⚠️ Safety First - Pre-Execution Checklist
18
19	CRITICAL: Never execute malware outside a properly isolated environment.
20
21	Before ANY execution:
22	- [ ] Snapshot taken of clean VM state
23	- [ ] Network isolated (host-only or INetSim simulation)
24	- [ ] No shared folders enabled
25	- [ ] No clipboard sharing
26	- [ ] Time sync disabled
27	- [ ] Monitoring tools ready and running
28	- [ ] Analysis persona active (no personal info)
29	- [ ] Emergency shutdown plan ready
30
31	If ANY checkbox fails - DO NOT EXECUTE
32
33	## Dynamic Analysis Workflow
34
35	### Phase 1: Environment Preparation (10 minutes)
36
37	1. Verify VM Isolation:
38	```bash
39	# Check network adapter settings
40	# Should be: Host-only or NAT with INetSim
41
42	# Test internet connectivity (should fail or hit INetSim)
43	ping 8.8.8.8
44	nslookup google.com
45
46	# Verify no shared folders
47	net use # Windows
48	df -h # Linux
49
50	# Check time sync (should be disabled)
51	w32tm /query /status # Windows
52	```
53
54	2. Start Monitoring Tools:
55
56	Launch in this order:
57	1. Procmon (Process Monitor) - File/Registry/Process activity
58	2. Wireshark - Network traffic capture
59	3. System Informer - Process/memory monitoring
60	4. Regshot - Take "before" snapshot (optional)
61
62	See `references/tool_setup.md` for detailed configuration.
63
64	3. Establish Baseline:
65	- Take note of running processes
66	- Document open network connections
67	- Record current registry state (if using Regshot)
68
69	### Phase 2: Malware Execution (Variable Duration)
70
71	Execute the Sample:
72
73	```powershell
74	# For PE executables
75	.\sample.exe
76
77	# With arguments (if required)
78	.\sample.exe /install /silent
79
80	# For DLLs
81	rundll32.exe sample.dll,DllMain
82	rundll32.exe sample.dll,ExportedFunction
83
84	# For scripts
85	powershell.exe -ExecutionPolicy Bypass -File sample.ps1
86	cscript.exe //NoLogo sample.vbs
87	wscript.exe sample.js
88	```
89
90	Observation Duration:
91	- Minimum: 5 minutes (most malware acts quickly)
92	- Standard: 15 minutes (catch delayed execution)
93	- Extended: 60+ minutes (for time-based evasion)
94
95	What to Watch:
96	- New processes spawned
97	- Network connections initiated
98	- Files created/modified/deleted
99	- Registry keys modified
100	- CPU/Memory usage spikes
101	- Pop-ups or UI changes
102	- Error messages
103
104	### Phase 3: Process Monitoring
105
106	Using System Informer:
107
108	Track New Processes:
109	1. Watch for new entries in process list
110	2. Note parent-child relationships
111	3. Document command-line arguments
112	4. Check process integrity levels
113	5. Monitor memory allocations
114
115	Identify Process Injection:
116	- Look for RWX (Read-Write-Execute) memory regions
117	- Check for threads in unexpected processes
118	- Monitor for process hollowing indicators
119	- Watch for CreateRemoteThread calls
120
121	Memory Analysis:
122	```
123	Right-click process → Memory → Inspect
124	Look for:
125	- Suspicious memory regions (RWX permissions)
126	- Injected DLLs (not in system path)
127	- Decoded strings in memory
128	- Configuration data
129
130	Right-click process → Create Dump File
131	→ Save for later Volatility analysis
132	```
133
134	Handles Analysis:
135	```
136	Double-click process → Handles tab
137
138	Look for:
139	- Mutexes (process synchronization objects)
140	- Named pipes (inter-process communication)
141	- File handles (what files are open)
142	- Registry key handles
143	```
144
145	### Phase 4: File System Monitoring
146
147	Using Procmon (Process Monitor):
148
149	Configure Filters:
150	```
151	Filter → Add:
152	- Process Name → is → sample.exe → Include
153	- Operation → contains → File → Include
154	- Operation → contains → Reg → Include
155	- Process Name → is → explorer.exe → Exclude
156	- Process Name → is → svchost.exe → Exclude (unless suspicious)
157	```
158
159	Monitor File Operations:
160
161	Look for:
162	- CreateFile - Files being created
163	- WriteFile - Files being modified
164	- DeleteFile - Files being deleted
165	- SetRenameInformationFile - Files being renamed
166
167	Key Locations to Watch:
168	```
169	C:\Users\<user>\AppData\Local\Temp\
170	C:\Users\<user>\AppData\Roaming\
171	C:\ProgramData\
172	C:\Windows\Temp\
173	C:\Users\<user>\AppData\

People who liked this also viewed

6 picks

Type