Arcana IR documentation · offline copy Nederlands

RB-ANALYSIS-015: Malware Analysis

Document Control

Attribute	Value	Date
Document Name	Malware Analysis
Version	[Enter version number]	[Enter date]
Owner	[Enter owner/team]	[Enter date]
Status	[Draft/Approved/Retired]	[Enter date]
Next Review Date	[Enter next review date]	[Enter date]
Approvals	[Enter approver(s)]	[Enter date]
Change Summary	Initial creation	[Enter date]

1. Prerequisites

Malware samples
File hashes
EDR telemetry
Sandbox results
Process execution telemetry
Network telemetry
Access to sandbox environment
Access to reverse engineering tools
Access to threat intelligence platforms
Access to EDR platform
Access to memory analysis tools

2. Step-by-Step Instructions

Common Failure Modes

Focusing only on static hashes

Ignoring network behaviour

Missing secondary payloads

Identify Malware Family
- Determine:
  - Malware family
  - Variant/version
  - Known threat actor associations
  - Public reporting references
Analyse Payload Behaviour
- Review:
  - Process execution behaviour
  - File system modifications
  - Registry modifications
  - Service creation
  - Persistence mechanisms
Assess Credential Theft Capability
- Identify:
  - Browser credential theft
  - Token theft
  - LSASS access
  - Keylogging behaviour
  - Session theft activity
Analyse Network Behaviour
- Review:
  - C2 communications
  - DNS activity
  - Beaconing intervals
  - Data transfer activity
  - External infrastructure usage
Identify Lateral Movement Capability
- Look for:
  - SMB propagation
  - PsExec usage
  - WMI activity
  - RDP usage
  - Remote command execution
Collect Indicators
- Document:
  - Hashes
  - Domains/IPs
  - Registry keys
  - Mutexes
  - File paths
  - User agents
  - Services

3. Post-Action

Document findings within the incident ticket

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.