Environment Setup

VMWare everything in a VLAN Remnux linux box - has things like iptables rules which accept traffic from any ip that connects to it and a fake dns tool.

Process Monitor

Useful for seeing what processes are spawned with a given running program. Used to get real-time information. Process hacker is an open source alternative.

Process Explorer

Determine what files, DLLs, and registry keys are associated with open processes.


Used for disassembling


Debugger for Windows (name is pretty self-explanatory)

Simulate an smb share

Put malware sample on box running IDA, run it on that box


  • lessmsi
    • Viewing && extraction of msi files content

Report Template Example



Getting exported functions in a binary

Use a tool like otool or nm on the binary.

Resource: https://stackoverflow.com/questions/5946756/how-to-use-otool