SANS: Introduction to Malware Analysis: Hands-on and Technical
Supercharge your incident response and forensics skills by learning key malware analysis tools and techniques. These skills have become critical to an organization's ability to derive threat intelligence, investigate suspected breaches and fortify defenses. This practical, hands-on course will build upon your existing network, system and infosec skills and teach you to turn Windows and browser malware inside out.
Section one lays the groundwork for malware analysis by presenting the key tools and techniques useful for examining malicious programs. You will learn how to save time by exploring Windows malware in two phases. Behavioral analysis focuses on the program's interactions with its environment, such as the registry, network, and file system. Code analysis focuses on the specimen's code and makes use of a disassembler and debugger tools such as IDA Pro and OllyDbg. You will learn how to set up a flexible laboratory to perform such an analysis in a controlled manner, as well as how to set up such a lab on your laptop using the supplied windows and Linux (REMnux) virtual machines. You will then learn how to use the key analysis tools by examining a malware sample in your lab - with guidance and explanations from the instructor - to reinforce the concepts discussed throughout the day.
Day two builds upon the approaches to behavioral and code analysis introduced in day one, exploring techniques for uncovering additional aspects of the functionality of malicious programs. You will learn about packers and the techniques that may help analysts bypass their defenses. Additionally, you will understand how to redirect network traffic in the lab to better interact with malware to understand its capabilities. You will also learn how to examine malicious websites and deobfuscate browser scripts, which often play a pivotal role in malware attacks.
Important! Bring your own system configured according to these instructions!
A properly configured laptop is required to participate in this course. Prior to the start of class, you must install virtualization software and meet minimum hardware requirements as described below. If you do not carefully read and follow these instructions, you will leave the class unsatisfied, because you will not be able to participate in hands on-exercises that are essential to this course.
The following are minimal requirements for your laptop:
-Intel-compatible 2 GHz dual-core CPU (a faster processor is recommended)
- 8 GB RAM (more memory is recommended)
- 60 GB of available disk space (more space is recommended)
- USB port 2.0 or higher (USB port 3.0 is recommended)
- Ethernet network interface card (NIC) or built-in Ethernet network port
- Wi-Fi network adapter or built-in Wi-Fi network card
*Note that your laptop needs to have both wireless and wired network capabilities. You also should have the ability to have local administrative rights on the system you will be using during class.
In addition, you will need to have the ability to extract large compressed files. Unzipping utilities built into the operating system might struggle with this. For this reason, please download and install the free 7zip tool.
The Need for VMware Virtualization
Please download and install VMware Workstation 10 or higher or VMware Fusion 6 or higher prior to class. If you do not own a licensed copy of VMware Workstation or Fusion, you can obtain a free 30-day trial copy from VMware. VMware will e-mail you a time-limited serial number when you register for the trial at their web site. Please note that VMware Player is not sufficient for the class because it does not support snapshot functionality, which we will want to use. Also, VirtualBox is not appropriate because of compatibility and troubleshooting problems you might encounter during class.
You will be asked to take multiple snapshots of virtual machines during the course. Experience has shown that students with limited free disk space are more likely to experience snapshot and other VMware performance problems. Please test your ability to run a virtual machine, create snapshot, and restore a snapshot in a timely manner (creating a snapshot should take less than 2 minutes). Some disk encryption software interferes with VMware's ability to create snapshots in a timely fashion.
Using Your System for Malware Analysis
Hands-on exercises will involve operating with malicious code. Although VMware will provide you with reasonable isolation, we do not recommend using your day-to-day production system as your laboratory machine. We expect you to exercise due caution when handling malicious code.
Additional Tools You Will Receive
We will provide you with additional tools for completing hands-on exercises, including a pre-built Linux virtual machine (a version of REMnux). You will also receive a pre-built Windows virtual machine (REM Workstation) along with a corresponding license. Hardware requirements outlined above are meant to ensure that you have sufficient memory and disk space available to simultaneously run the virtual machines.
Review the following checklist to make sure that your laptop is prepared for the course:
- Your laptop meets hardware requirements outlined in this note, including an Ethernet card and sufficient processor, memory, and disk space.
- VMware Workstation 10 or higher or VMware Fusion or higher is installed and operational with a valid license.
- The VMware license will not expire before the class (if using a trial copy).
If you have additional questions about the laptop specifications, please contact firstname.lastname@example.org.
Course toolkit included