malware-analysis-checklist's Introduction

Base checking

Initial access
    Initial foothold of the actor. Example :
        Web (Layer 7 : Application) 
        Software bugs/0-day 
        Hardware issue : Spectre Meltdown 
        Policy issues : Dropped malware, Rubber ducky
        User issues 
How it is downloads, starts or executes ? 
    Where it come from 
    How it has to be there (On the file path) 
    Which parent process / dropper for the executions ? 
    How it executes ? By user actions or by process triggers ? 
Anti Forensic detectection 
    Anti Debugging 
    Anti VM 
    Anti Dissassembly
    AV/EDR Evasion 
    Packer 
    Cyptor
    Sandbox Evasion 
Basic, automated, dynamic analysis result : 
    Basic analysis 
        strings
        MultiAV result
        ssdeep (comparing variant) 
        PE analysis (mismatch name , character encoding) 
    Dynamic analysis 
        Process
        File system 
        Network 
        Registry 
    Sandbox analysis result 
        Static analysis 
        Dynamic analysis 
What are things we looking for ? 
    IOCs 
    Commands 
    Dropped Files 
    Domains / IP
    Registry modify / add delete 
    Techniques , Tactics and procedures 
    Encryption/Decryption Routines 
    Folder, File access 
    Malware Features 
    Hardcoded values / strings 
    Common WinAPI used for malicious actions 
    Shellcode 
    Encrypted things 
What are the malware features ? 
    Downloader 
    Launcher 
    Backdoor 
        Reverse Sheel 
        RAT 
        Botnet 
    Credentials Stealer 
        Keylogger 
        Mimikatz 
        Hash / Ticket Stealer 
    Encrypt file 
    Command and Control 
    Propagation 
     Exploit 
    Process manipulating 
        Process injection 
    Bypass UAC 
    Evade AV 
    Anti Forensic 
What is the behavior meaning of the findings ? 
    Is the domain really does the command and control ? 
    Why is it encrypt a certain part 
Does it have persistent mechanism ? 
    Registry key 
    Scheduled tasks 
    Startup folder
    Winlogon Registry Entries 
    Image file executions options 
    Accessibility programs 
    WMIC Persistent 
    AppInit_DLLs 
    DLL Search Order Hijacking 
    Service 
Is the malware has privilege escalation ? 
    Lateral Movement 
    Process invoked

Recommend Projects