12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts

12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts

Quick Answer: Dynamic malware analysis detonates a suspect binary inside an isolated, non-persistent sandbox to monitor runtime behavior. Investigators capture live system alterations using Sysinternals Process Monitor (Procmon)—applying filters for Process Name is, Operation is RegSetValue, and Operation is CreateFile—while Process Explorer (Procexp) inspects active process trees, image signatures, and memory-versus-disk string discrepancies (uncovering Process Hollowing). Registry modifications and persistence mechanisms are captured via Regshot by comparing pre-execution ("1st shot") and post-execution ("2nd shot") snapshots. Outbound network callouts and C2 beacons are safely stimulated and captured using network simulators like FakeNet-NG or INetSim coupled with Wireshark.

---

The Dynamic Behavioral Analysis Environment

While static analysis reveals what a binary contains, dynamic analysis reveals what the binary does. Dynamic analysis is critical for analyzing heavily packed, crypter-protected, or multi-stage modular malware families whose code cannot be unpacked through static means alone.

+-------------------------------------------------------------------------+
|                 DYNAMIC MALWARE SANDBOX ARCHITECTURE                    |
+-------------------------------------------------------------------------+
|  +-------------------------------------------------------------------+  |
|  | HOST WORKSTATION (Physical Hypervisor / Bare-Metal)               |  |
|  | • Isolated Virtual Switch (Host-Only / Internal Network)          |  |
|  +-------------------------------------------------------------------+  |
|                                    ▲                                    |
|                                    | Host-Only Network (No Internet)    |
|                                    ▼                                    |
|  +-------------------------------+   +-------------------------------+  |
|  | TARGET GUEST VM (Sandbox)     |   | NETWORK SIMULATOR VM          |  |
|  | • Windows 10/11 x64 Specimen  |   | • FakeNet-NG / INetSim Server |  |
|  | • Procmon / Procexp / Regshot |<->| • Intercepts DNS, HTTP, SMTP  |  |
|  | • Reverts to Clean Snapshot   |   | • Full Wireshark PCAP Capture |  |
|  +-------------------------------+   +-------------------------------+  |
+-------------------------------------------------------------------------+

Core Sandbox Engineering Principles

1. Hypervisor Isolation: Malware detonation must occur inside isolated virtual machines (Type 1 or Type 2 hypervisors) or dedicated bare-metal systems equipped with hardware reboot-to-restore controllers.
2. Host-Only / Air-Gapped Networking: Guest virtual machines must never bridge to the host's physical network adapter or route to the public internet. All network adapters are connected to an isolated host-only virtual switch (vSwitch).
3. Non-Persistent Snapshot Management: Before introducing any malware specimen, the examiner creates a Golden Clean Snapshot of the guest OS in a fully configured state (monitoring tools installed, security defenses disabled). Following execution and evidence capture, the VM is instantly reverted to the clean snapshot to eliminate residual cross-contamination.

---

Anti-Analysis & Anti-VM Evasion Countermeasures

Sophisticated malware incorporates extensive anti-analysis checks to detect whether it is executing inside a virtual machine, sandbox, or debugger. If evasion checks return positive, the malware terminates silently, displays a fake error message, or executes benign behavior.

+-------------------------------------------------------------------------+
|                    COMMON ANTI-VM EVASION TECHNIQUES                    |
+-------------------------------------------------------------------------+
| Evasion Category    | Check Mechanism        | Forensic Countermeasure  |
|---------------------|------------------------|--------------------------|
| **MAC Address**     | Checks network adapter | Spoof MAC address to a   |
| **OUI Inspection**  | OUI prefix for known   | standard physical vendor |
|                     | virtualization vendors | (e.g., Intel, Realtek)   |
|---------------------|------------------------|--------------------------|
| **Hardware**        | Checks CPU cores (<2), | Allocate 4+ CPU cores,    |
| **Resource Checks** | RAM (<4GB), or hard    | 8GB+ RAM, and 100GB+     |
|                     | drive capacity (<60GB) | virtual disk space       |
|---------------------|------------------------|--------------------------|
| **Registry & Device**| Queries registry for  | Sanitize hypervisor keys;|
| **Artifacts**       | "VMware", "VBOX", or   | rename virtual guest     |
|                     | loaded driver names    | driver services          |
|---------------------|------------------------|--------------------------|
| **Instruction**     | Executes CPUID or      | Patch hypervisor XML to  |
| **Fingerprinting**  | RDTSC (measures CPU    | mask hypervisor flags;   |
|                     | execution cycle delta) | disable timing traps     |
|---------------------|------------------------|--------------------------|
| **Human Interaction**| Monitors mouse cursor  | Run automated UI actions;|
| **& Sleep Delays**  | movement, clicks, or   | hook and accelerate      |
|                     | executes 10-min Sleep  | kernel32!Sleep calls     |
+-------------------------------------------------------------------------+

1. Virtualization Hardware Artifacts

• MAC Address OUIs: Virtualization hypervisors assign standardized Organizationally Unique Identifiers (OUIs) to virtual network adapters:
  • VMware: 00:05:69, 00:0C:29, 00:50:56
  • VirtualBox: 08:00:27
  • QEMU / KVM: 52:54:00
• Device Names & Drivers: Malware queries the registry under HKLM\\HARDWARE\\Description\\System for strings like VBOX, VMware Virtual Platform, or QEMU. It checks for virtual guest drivers such as VBoxMouse.sys, VBoxGuest.sys, or vmmouse.sys.

2. Instruction & Timing Evasion (RDTSC)

The RDTSC (Read Time-Stamp Counter) x86 assembly instruction reads the current CPU cycle counter. Malware executes RDTSC, calls a routine, and executes RDTSC a second time to calculate the elapsed cycle delta:

• If an interactive human examiner is stepping through the code inside a debugger (e.g., x64dbg), or if a hypervisor intercepts instruction execution via VM-exits, the elapsed cycle count is millions of cycles higher than expected on bare-metal hardware. Detecting this latency, the binary aborts.

3. Extended Sleep & Sandbox Starvation

Automated analysis sandboxes enforce rigid timeout limits (typically 2 to 5 minutes) per sample. Malware routinely calls Sleep(600000) (10 minutes) before initiating malicious activity. Advanced sandboxes defeat this by hooking kernel32.dll!Sleep and accelerating time, though sophisticated malware detects sleep acceleration by querying real-time hardware timers via GetSystemTime or GetTickCount.

---

Real-Time System Monitoring with Sysinternals Procmon & Procexp

The Microsoft Sysinternals suite provides the foundational telemetry required to track real-time dynamic behavior on Windows endpoints.

+-------------------------------------------------------------+
|               PROCMON EVENT CAPTURE ENGINE                  |
+-------------------------------------------------------------+
| Event Classes:                                              |
| [Registry]      RegOpenKey, RegSetValue, RegDeleteValue     |
| [File System]   CreateFile, WriteFile, SetDispositionInfo   |
| [Process/Thread]Process Create, Thread Create, Load Image   |
| [Network]       TCP Connect, TCP Send, UDP Send             |
+-------------------------------------------------------------+
       | Filter Engine: [Process Name is malware.exe] Include
       ▼
+-------------------------------------------------------------+
| Isolated Event Stream: Direct Malicious Action Telemetry    |
+-------------------------------------------------------------+

1. Process Monitor (Procmon) Filtering Architecture

Procmon captures millions of operating system events per minute. Without precise filters, legitimate background system noise (svchost.exe, SearchIndexer.exe, TiWorker.exe) will overwhelm the analysis.

Essential Filter Configurations for Malware Triage

• Target Isolation: Process Name is [malware_sample.exe] -> Include
• Detecting Registry Persistence: Operation is RegSetValue -> Include
  • Flags attempts to write to CurrentVersion\\Run, RunOnce, StartupApproved, or Services keys.
• Detecting Dropped Payloads: Operation is CreateFile -> Include AND Detail contains OpenResult: Created -> Include
  • Filters out routine read/query file operations, isolating exactly where the binary dropped secondary scripts, .dll modules, or encrypted files.
• Detecting Process Spawning: Operation is Process Create -> Include
  • Reveals attempts to invoke cmd.exe, powershell.exe, certutil.exe, or wmic.exe.
• Boot Logging: If malware requires a system restart to execute persistence routines, the examiner navigates to Options -> Enable Boot Logging. Procmon configures a kernel driver to capture all boot-time activity during the subsequent reboot before user logon.

2. Process Explorer (Procexp) Inspection

Process Explorer serves as an advanced task manager, exposing deep process properties:

• Process Hierarchy & Color Coding: Running processes are organized in a parent-child tree. Newly spawned processes flash green, terminating processes flash red, services appear in pink, and suspended or packed processes display in dark grey.
• Image Signature Verification: Navigating to Options -> Verify Image Signatures causes Procexp to validate Authenticode digital signatures across all running binaries. Unsigned binaries running from user directories (e.g., C:\\Users\\<user>\\AppData\\Local\\Temp\\) are immediately highlighted.
• Uncovering Process Hollowing (Memory vs. Disk Strings):
  • Process Hollowing occurs when an attacker launches a legitimate binary (e.g., svchost.exe) in a suspended state, hollows out its virtual memory, and writes malicious code in its place.
  • In Procexp, double-click the suspect process, select the Strings tab, and toggle between the Image radio button (strings residing in the physical binary on disk) and the Memory radio button (strings residing in active virtual memory).
  • The Indicator: If the Image strings show legitimate Microsoft print spooler strings, while the Memory strings reveal C2 IP addresses, IRC commands, or ReflectiveLoader text, the process has been hollowed.

---

Registry Differential Auditing with Regshot

While Procmon captures transient registry operations in real-time, Regshot provides a macro-level, differential baseline comparison of the Windows Registry before and after malware detonation.

+-------------------------------------------------------------+
|                  REGSHOT TWO-SHOT WORKFLOW                  |
+-------------------------------------------------------------+
| Step 1: Snapshot 1 (Clean System Baseline State)            |
|         • Scans HKLM, HKU, HKCU, and target directories     |
+-------------------------------------------------------------+
                               | Detonate Malware Specimen
                               | Wait for Behavioral Execution
                               ▼
+-------------------------------------------------------------+
| Step 2: Snapshot 2 (Post-Infection Compromised State)       |
|         • Scans modified hives and file paths               |
+-------------------------------------------------------------+
                               | Compute Differential
                               ▼
+-------------------------------------------------------------+
| Differential Output Report:                                 |
| • Keys Added / Deleted                                      |
| • Values Added / Modified                                   |
| • Files Added / Modified in System Directories              |
+-------------------------------------------------------------+

Regshot Operational Sequence

1. Take 1st Shot: In a freshly restored clean sandbox, launch Regshot and click 1st shot -> Shot. Regshot walks the registry hives (HKLM\\SYSTEM, HKLM\\SOFTWARE, HKU, HKCU) and records all keys, values, and data types into a temporary memory map.
2. Detonate Specimen: Execute the malware sample with administrative privileges. Interact with any dialog boxes if required, allowing the malware sufficient time (3 to 5 minutes) to unpack, inject, and establish persistence.
3. Take 2nd Shot: Click 2nd shot -> Shot.
4. Generate Comparison Report: Click Compare. Regshot generates a clean, formatted text or HTML report detailing exact changes.

Typical Regshot Persistence Indicators

----------------------------------
Values Added: 3
----------------------------------
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSecurity: "C:\Users\victim\AppData\Roaming\winupdate.exe"
HKLM\SYSTEM\CurrentControlSet\Services\NetDriverSvc\ImagePath: "C:\Windows\System32\drivers\netdriver.sys"
HKU\S-1-5-21-...\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: "explorer.exe, C:\Users\victim\AppData\Local\Temp\beacon.exe"

----------------------------------
Files Added: 2
----------------------------------
C:\Users\victim\AppData\Roaming\winupdate.exe
C:\Windows\System32\drivers\netdriver.sys

---

Network Simulation & C2 Callout Capture

Multi-stage droppers require an active internet connection to download secondary payloads, verify outbound connectivity, and register with Command and Control (C2) servers. Because the sandbox is air-gapped, outbound requests will fail unless intercepted and simulated.

Target Sandbox VM                               Network Simulator VM
+-----------------------+                       +-----------------------+
| Malware executes:     |  1. DNS Query         | FakeNet-NG / INetSim  |
| GET /payload2.exe     |---------------------->| Resolves ALL queries  |
| to c2.attacker.com    |                       | to 192.168.10.1       |
|                       |  2. Spoofed Response  |                       |
|                       |<----------------------| IP: 192.168.10.1      |
|                       |                       |                       |
| Establishes HTTP GET  |  3. HTTP Request      | Web Server Engine     |
| request over port 80  |---------------------->| Intercepts HTTP GET   |
|                       |                       |                       |
| Receives 200 OK +     |  4. Synthetic Payload | Returns valid 200 OK  |
| Fake PE Executable    |<----------------------| + Dummy .exe binary   |
|                       |                       |                       |
| Executes Stage 2!     |                       | (Traffic Logged to    |
+-----------------------+                       |  Wireshark PCAP)      |
                                                +-----------------------+

1. FakeNet-NG & INetSim

• INetSim: A Linux-based software suite that simulates common internet protocols including DNS, HTTP, HTTPS, SMTP, FTP, NTP, and IRC. When configured as the default gateway and DNS server for the malware sandbox, INetSim returns realistic server banners and synthetic responses.
• FakeNet-NG: A next-generation dynamic network simulation tool developed by Mandiant. FakeNet-NG runs directly on Windows or Linux, redirecting all outbound network traffic to localhost or a simulated interface:
  • DNS Spoofing: When malware issues a DNS request for any domain (e.g., evil-malware-c2[.]org), FakeNet intercepts the query at the network driver level and replies with a spoofed IP pointing to its own listening adapter.
  • HTTP/HTTPS Service Simulation: When the malware attempts an HTTP GET request for a second-stage dropper, FakeNet returns a valid HTTP 200 OK header accompanied by a synthetic, dynamically generated PE binary. Receiving a valid executable, the malware proceeds to its next execution phase, exposing secondary behaviors that would otherwise remain hidden.
  • SSL/TLS Interception: FakeNet dynamically generates SSL certificates to intercept encrypted HTTPS traffic, allowing examiners to read plaintext C2 commands.

2. Traffic Analysis with Wireshark

Running Wireshark on the network simulator captures the full network exchange to a .pcap file for extraction:

• Domain Generation Algorithms (DGAs): High volumes of NXDOMAIN DNS queries for random character strings (e.g., xzklaqwebnm[.]biz, qowieurytz[.]info).
• Beaconing Jitter & Intervals: Calculating the time deltas between successive HTTP POST requests. If requests occur every exactly 60 seconds (or within 10% randomized jitter), automated beaconing is established.
• Exfiltration Headers: Inspecting HTTP headers for base64-encoded user credentials or machine reconnaissance data stored inside Cookie:, Authorization:, or custom HTTP headers (X-Session-ID:).

---

Practical Forensic Case Scenario: Detonating a Banking Trojan

The Incident

A suspect .vbs (Visual Basic Script) is recovered from an employee's downloads directory following a phishing campaign. Static analysis shows heavy obfuscation with Chr() functions.

Dynamic Analysis Execution

1. Environment Setup: The analyst reverts the Windows 10 sandbox to its clean snapshot. INetSim is started on an adjacent VM (192.168.10.1), configured as the sandbox's DNS server and gateway. Wireshark is launched on the INetSim host.
2. Tool Baselining: The analyst launches Regshot and takes the 1st shot. Procmon is launched with an active capture filter for Process Name is wscript.exe.
3. Detonation: The analyst executes wscript.exe Invoice.vbs.
4. Procmon Telemetry: Procmon records wscript.exe spawning powershell.exe with a hidden window argument. powershell.exe initiates a CreateFile operation writing an executable named svchost_update.exe into C:\\Users\\victim\\AppData\\Local\\Temp\\.
5. Network Simulation: Wireshark captures a DNS request for api.crypto-vault-update[.]com. INetSim resolves the domain to its local IP. The malware issues an HTTP GET /drop/payload.bin request. INetSim returns a dummy binary response.
6. Regshot Delta: The analyst takes the 2nd shot and generates the comparison report. Regshot identifies a new value added under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SecurityService pointing directly to the dropped svchost_update.exe binary.
7. Reporting: The analyst compiles the dropped file hash, the registry persistence path, and the C2 domain into a structured IoC advisory for the incident response team.