Windows Malware Analysis And Memory Forensics Course

• What is Malware
•  What they do
•  Why malware analysis
•  Types of malware analysis
•  Setting up an isolated lab environment

• Fingerprinting the malware
•   Extracting strings
•   Determining File obfuscation
•   Pattern matching using YARA
•   Fuzzing hashing & comparison
•   Understanding PE File characteristics
•   Disassembly
•   Handson lab exercise involves analyzing a real malware sample

• Dynamic Analysis Steps
•   Understanding Dynamic Analysis tools 
•   Simulating services
•   Performing Dynamic Analysis
•   Monitoring process, filesystem, registry, and network activity
•   Determining the Indicators of compromise (host and network indicators)
•   Handson lab exercise involves analyzing a real malware sample
•  Automating Malware Analysis(sandbox)
•   Custom Sandbox Overview
•   Working of Sandbox
•   Sandbox Features
•   Demo  Analyzing malware in the custom sandbox

• Run registry key
•  Scheduled Tasks
•  Startup Folder
•  Service
•  Winlogon registry entries
•  Image File Execution Options (IFEO)
•  Accessibility programs
•  AppInit_DLLs
•  DLL Search order hijacking
•  COM Hijacking
•  Handson lab exercise involves analyzing a real malware sample

• Code Analysis Overview
•   Disassembler & Debuggers
•   Code Analysis Tools
•   Basics of IDA Pro
•   Basics of Ollydbg/x64dbg
•   Understanding the API calls
•   Reversing Malware functionalities(Downloader, dropper, keylogger, code injection, HTTP  backdoor)
•   Handson lab exercise involves analyzing a real malware sample

• What is Memory Forensics
•   Why Memory Forensics
•   Steps in Memory Forensics
•   Memory acquisition and tools
•   Acquiring memory From a physical machine
•   Acquiring memory from the virtual machine
•   The handson exercise involves acquiring the memory

• Introduction to Volatility Advanced Memory Forensics Framework
•  Volatility Installation
•  Volatility basic commands
•  Determining the profile
•  Volatility help options
•  Running the plugin

• Understanding Process Internals
•  Process(EPROCESS) Structure
•  Process organization
•  Process Enumeration by walking the double linked list
•  Process relationship (parentchild relationship)
•  Understanding DKOM attacks
•  Process Enumeration using pool tag scanning
•  Volatility plugins to enumerate processes
•  Identifying malware process
•  Handson lab exercise(scenariobased) involves investigating malware infected memory 

• Objects and handles overview
•   Enumerating process handles using Volatility
•   Understanding Mutex
•   Detecting malware presence using a mutex 
•   Understanding the Registry
•   Investigating common registry keys using Volatility
•   Detecting malware persistence 
•   Handson lab exercise(scenariobased) involves investigating malware infected memory 

• Understanding malware network activities
•  Volatility Network Plugins
•  Investigating Network connections
•  Investigating Sockets
•  Handson lab exercise(scenariobased) involves investigating malware infected memory

•  Process memory Internals
•  Listing DLLs using Volatility
•  Identifying hidden DLLs
•  Dumping malicious executable from memory
• Dumping Dll’s from memory
• Scanning the memory for patterns(yarascan)
• Handson lab exercise(scenariobased) involves investigating malware infected memory
•   Scanning the memory for patterns(yarascan)

  Handson lab exercise(scenariobased) involves investigating malware infected memory

• Code Injection
•   Types of Code injection
•   Remote DLL injection
•   Remote Code injection
•   Reflective DLL injection
•   Hollow process injection
•   Demo  Case Study
•   Handson lab exercise(scenariobased) involves investigating malware infected memory

• Sandbox Overview
• Integrating Memory Forensics into a sandbox
• Demo  showing the use of memory forensics in a custom sandbox

• Understanding Rootkits
• Understanding Functional call traversal in Windows
• Level of Hooking/Modification on Windows
• Kernel Volatility plugins
• Handson lab exercise(scenariobased) involves investigating malware infected memory
• Demo  Rootkit Investigation

Demo –  Hunting an APT malware from Memory