Environment Setup

VMWare everything in a VLAN Remnux linux box - has things like iptables rules which accept traffic from any ip that connects to it and a fake dns tool.

Process Monitor

Useful for seeing what processes are spawned with a given running program. Used to get real-time information. Process hacker is an open source alternative.

Process Explorer

Determine what files, DLLs, and registry keys are associated with open processes.

IDA Pro

Used for disassembling

WinDBG

Debugger for Windows (name is pretty self-explanatory)

Simulate an smb share

Put malware sample on box running IDA, run it on that box

Tools

  • lessmsi
    • Viewing && extraction of msi files content

Report Template Example

https://zeltser.com/malware-analysis-report/

MacOS

Getting exported functions in a binary

Use a tool like otool or nm on the binary.

Resource: https://stackoverflow.com/questions/5946756/how-to-use-otool