SANS Digital Forensics and Incident Response Blog: Tag - malware

Using ProcDOT Plugins to Examine PCAP Files When Analyzing Malware

ProcDOT is a free tool for analyzing the actions taken by malware when infecting a laboratory system. ProcDOT supports plugins, which could extend the tool's built-in capabilities. This article looks at two plugins that help examine contents of the network capture file loaded into ProcDOT. Continue reading Using ProcDOT Plugins to Examine PCAP Files When Analyzing Malware


Using Sysinternals System Monitor (Sysmon) in a Malware Analysis Lab

System Monitor (Sysmon) is a new tool from Microsoft, designed to run in the Windows system's background, logging details related to process creation, network connections, and changes to file creation time. This information can assist in troubleshooting and forensic analysis of the host where the tool was installed prior to the incident that's being investigated. This article explores the role that System Monitor might play in a malware analysis lab, possibly supplementing tools such as Process Monitor. Continue reading Using Sysinternals System Monitor (Sysmon) in a Malware Analysis Lab


Dominando las 4 etapas del Análisis de Malware

(This is a Spanish translation of the article Mastering 4 Stages of Malware Analysis. Este artculo fue traducido del ingls.) El anlisis de software malicioso o malware involucra una variedad de tareas, algunas ms simples que otras. Estas tareas pueden ser agrupadas en etapas basadas en la naturaleza de las tcnicas de anlisis de software malicioso. Agrupadas como capas, una encima de otra, estas etapas forman una pirmide que va creciendo conforme complejidad. Continue reading Dominando las 4 etapas del Anlisis de Malware


SRP Streams in MS Office Documents Reveal Earlier Versions of Malicious Macros

SRP streams in Microsoft Office documents can reveal older versions of VBA macro code used by the adversary in earlier attacks. After the attacker modifies the malicious document for a new attack, Microsoft Office sometimes retains a cache of the earlier macro inside these streams, allowing analysts to expand their understanding of the incident and derive valuable threat intelligence. In other words, SRP streams can help investigators travel back in time. Continue reading SRP Streams in MS Office Documents Reveal Earlier Versions of Malicious Macros


Managing and Exploring Malware Samples with Viper

Keeping track of all the samples on your plate can become cumbersome and at times, next to impossible; that's where projects like Viper come in. Viper is "a framework to store, classify and investigate binary files." The following article, contributed by David Westcott, explains how to get started with this tool. Continue reading Managing and Exploring Malware Samples with Viper