10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS

Quick Answer: SAL1 classifies malware by what it does—encrypt (ransomware), impersonate (trojan), self-spread (worm), remotely control (Remote Access Trojan (RAT)), destroy (wiper), steal data (infostealer)—not by brand names. Static analysis inspects a file without running it (hashes, strings, reputation). Dynamic analysis runs it in a controlled sandbox. Living Off the Land Binaries And Scripts (LOLBAS) are signed Windows tools such as powershell.exe and certutil.exe that attackers reuse so they do not need a custom malware binary.

This independent study material covers Malware and LOLBAS topics that appear in SAL1 training content. You learn to name behaviors, pick an analysis method a SOC analyst would actually use, and recognize living-off-the-land command lines. You do not need malware samples, unpackers, or a recipe for abusing Windows utilities.

Classify by behavior, not by brand

The SAL1 training content focuses on actions. A sample labeled with a crimeware family on a blog is less useful on the exam than "this binary steals browser cookies and waits for operator commands." Brands change; behaviors map to playbooks.

Ransomware

Ransomware encrypts (or otherwise denies access to) files and demands payment. Analyst-visible clues include mass file renames or new extensions, a ransom note, attempts to delete volume shadow copies, disabled backups, and sudden encryption across Server Message Block (SMB) shares. The business impact is availability plus extortion. Distinguish this from a wiper that destroys keys or overwrites disks with no credible recovery path.

Trojan

A trojan delivers or hides a payload inside something that looks legitimate: a cracked installer, a fake invoice "viewer," or a look-alike updater. The defining action is deception at delivery, not a specific payload. A trojan may drop ransomware, a RAT, or an infostealer. On an alert, "trojan" answers how it arrived pretending to be software; you still name the follow-on behavior.

Worm

A worm self-propagates across hosts using a vulnerability, stolen credentials, or removable media, with little or no extra user click per new victim. Worms create fan-out: many similar EDR alerts in minutes, internal scanning, bursts of SMB or Remote Desktop Protocol (RDP). Contrast with a trojan that sits until the next user is phished.

Remote Access Trojan (RAT)

A RAT provides interactive remote control: file system access, screen, command execution, sometimes additional sensors. This overlaps C2 from the previous section. Keep the labels straight: malware type is the implant's job (remote access); C2 is the channel. A RAT without a live channel is still a RAT in classification. An interactive reverse shell can be the channel under a RAT.

Wiper

A wiper destroys data or makes systems unbootable. Notes may imitate ransomware, but there is no working decryptor. Clues include rapid overwrite, boot-record tampering, destruction of backups, and an intel picture that looks like disruption rather than profit. Treat it as a destructive incident, not a billing event.

Infostealer

An infostealer harvests credentials, cookies, tokens, cryptocurrency wallets, or selected files. Clues include browser database access, reads of configuration and password stores, staging of a small archive, and often short dwell then quiet. Infostealers frequently precede business email compromise or later ransomware.

A single incident can chain types: a trojanized installer, then an infostealer, then later ransomware. Classify each observed action. Do not force one label onto the whole case if the evidence shows a sequence.

Malware indicators a Level 1 analyst actually uses

You will rarely open a debugger on the SOC floor. You will match indicators:

• File: hash, path (Temp, Downloads, alternate data streams), missing or invalid signature, double extension such as invoice.pdf.exe.
• Process: unusual parent (WinWord to cmd to PowerShell), encoded command lines, injection into a trusted process.
• Network: new domains, C2-like timing from the previous section, Domain Name System (DNS) lookups to newly registered names.
• Host change: new services, Run keys, scheduled tasks, disabled antivirus, deleted logs.

Those mix IoCs (hashes, names, IPs) and Indicators of Attack (IoAs) (behaviors such as mass encryption). SAL1 wants you to identify indicators and choose static versus dynamic next steps—not to author exploits.

Static versus dynamic analysis at L1

Static analysis means examining the artifact without executing it. Dynamic analysis means running it in a controlled environment and watching what it does. Both are in scope; the exam cares about which job uses which method.

Static analysis (SOC analyst toolkit)

Typical Level 1 static steps:

1. Hash the file (SHA-256) and search internal history plus a multi-engine reputation service such as VirusTotal (VT).
2. Confirm file type (a real Windows Portable Executable versus a renamed picture).
3. Pull strings and metadata: URLs, mutex names, debug paths, ransom-note fragments—without treating strings as proof by themselves.
4. Check digital signature: Microsoft-signed certutil.exe is a different story from an unsigned binary in %TEMP%.
5. Read whatever YARA or EDR static machine-learning verdict the platform already produced.

Static analysis is fast, safe for the enterprise network, and good for known-bad and obvious lure files. Limits: packed or encrypted samples look boring until they run; hash variants miss the next compile; VT hits can be generic or delayed.

Dynamic analysis (sandbox detonation)

Detonation runs the sample in a sandbox—an isolated virtual machine with instrumentation. Reports show process trees, file writes, registry changes, and outbound domains. Level 1 uses vendor or internal sandbox output, not a hobby virtual machine on the analyst laptop.

Dynamic analysis answers questions static review cannot: does it beacon, drop a second stage, encrypt documents, or steal browser files? Limits include sleep and jitter, sandbox-evasion checks (hostname, uptime, missing mouse movement), and lack of real domain context (no genuine file server to encrypt).

The diagram below is the L1 decision picture: inspect first, detonate only in an isolated pipeline when static results are inconclusive and policy allows it.

SOC analyst versus malware researcher

If the sandbox says the file contacted an uncategorized domain and wrote a script under Temp, your job is containment and ticket quality—not reconstructing the packer. Escalate packed samples that beat both VT and a short sandbox run; do not reverse them yourself on production time.

LOLBAS and living-off-the-land

LOLBAS stands for Living Off the Land Binaries And Scripts. The public LOLBAS project catalogs Windows binaries, scripts, and libraries that can be abused for purposes beyond their documented admin job. Related labels: LOLBins (the binaries) and living-off-the-land (LotL).

Attackers use signed Windows binaries because:

1. They are already on disk. There is no need to drop a custom implant that antivirus or EDR may hash-detect.
2. They are Microsoft-signed. Allowlisting that trusts publisher = Microsoft will execute powershell.exe, rundll32.exe, and certutil.exe.
3. They blend into admin noise. Information technology teams use PowerShell. The binary name is not malicious; arguments, parent, network, and user context are.
4. Defense evasion. LotL is a strategy to hide in legitimate tooling (MITRE ATT&CK tactic TA0005), not a single vulnerability.

SAL1 asks why threat actors use LotL and how to recognize command-line clues. It does not ask you to reproduce abuse.

Analyst-visible command-line clues

Never treat the presence of these processes as a conviction. Hunt rare argument patterns and wrong parents. The table lists clues you may see in EDR, Sysmon, or Security Information and Event Management (SIEM) command-line fields—not steps to run.

Process-tree clues that beat the binary name

LotL detections are relationship detections:

• Outlook spawning mshta.exe which then spawns powershell.exe
• WinWord spawning wscript.exe with a .js file in Temp
• cmd.exe spawning certutil.exe with -decode, then the decoded file executing
• bitsadmin launching outside patch windows from a non-admin user

A help-desk technician running signed PowerShell from an approved script store at 10:00 is a different ticket from a finance user whose Word process spawned encoded PowerShell at 22:00.

Why LotL frustrates signature-first antivirus

Traditional antivirus wanted malicious files. LotL may add zero new files: the "malware" is a command line and a Microsoft binary. EDR behavioral rules, PowerShell script-block logging (Event ID 4104), Sysmon command lines, and application allowlisting with publisher plus path plus hash constraints (not publisher-only) are how SOCs catch this. You still cannot delete powershell.exe. You constrain who may run it, from where, and you alert on how.

Putting analysis and LotL together on a ticket

A user reported a slow PC. EDR shows mshta.exe with an https:// argument, parent EXCEL.EXE, then powershell.exe with -nop -w hidden -enc. VirusTotal on a dropped dynamic-link library (DLL) in Temp is mixed. Static: hash the DLL, read the captured command line, note the URL. Dynamic: if policy allows, detonate the DLL or HTA in the sandbox, not on the analyst workstation. Classification: a trojanized document leading to LotL execution, possibly a RAT or infostealer depending on sandbox behaviors (C2 callbacks versus credential-file reads). Escalate with the URL, hash, encoded command, and parent tree. Do not paste live malware into chat, and do not try the command yourself.

Common traps

• Brand names as answers. Prefer "wiper behavior" over a marketing family if the question is about actions.
• Static-only comfort. A unique hash with zero VT hits can still encrypt files five minutes after detonation.
• Blocking LOLBins wholesale. You will break Windows administration. Detect abuse; restrict context.
• Sandbox on the analyst PC. Detonation belongs in an isolated pipeline.
• Trusting the signature alone. A Microsoft signature means publisher, not "this command line is safe."
• Calling every PowerShell alert a RAT. Encoded PowerShell is a technique. The malware type still depends on what it does after execution.