Reversing Notes

Environment Setup

VMWare everything in a VLAN
Remnux linux box - has things like iptables rules which accept traffic from any ip that connects to it and a fake dns tool.

Process Monitor

Useful for seeing what processes are spawned with a given running program. Used to get real-time information. Process hacker is an open source alternative.

Process Explorer

Determine what files, DLLs, and registry keys are associated with open processes.

IDA Pro

Used for disassembling

WinDBG

Debugger for Windows (name is pretty self-explanatory)

Simulate an smb share

Put malware sample on box running IDA, run it on that box

Tools

lessmsi - Viewing && extraction of msi files content

Report

https://zeltser.com/malware-analysis-report/