Dynamic Analysis

Introduction

Dynamic analysis, also known as behavioral analysis, is the act of interpreting the behavior of the malware while it's running. The primary goal is to disect the real-world impact of the malware on it's host environment.

Here is what we need to be succesful:

1.) Environment setup: This VM should mimic a real-world system, it should include applications, office tools, communication platforms(teams, cisco jabber, discord), web browsers, documents, and more.

2.) Baseline Capture: After the VM is setup, we capture a snippet of of the systems clean state. Before the malware is executed.

3.) Tool Deployment (Pre-execution): We deploy tools to monitor the system before executing the malware.

4.) Malware Execution: With the tools runnning to observe the malware, we run execute the malware.

5.) Observation & Logging: During this time we are monitoring the changes, and behavior of the malware.

6.) Analysis & Data Collection: We stop the malware, run further analysis and create an image of the host post-execution.

Refer to tools for Sandbox Analysis platforms.