Malware Analysis and Attacker Tradecraft
What the domain tests
Malware analysis and attacker tradecraft: static versus dynamic analysis, POS and web skimming, persistence, lateral movement, credential theft, exfiltration, and anti-forensics. You must infer behavior from artifacts without contaminating evidence.
Core rules
- Static analysis: hashes, strings, PE headers, imports, packer signs, YARA, signatures. Do not execute on production.
- Dynamic analysis: isolated lab, sandbox, process monitor, registry diff, packet capture. Observe injection, persistence, and C2.
- POS malware often scrapes process memory for track data; look for process hollowing, DLL injection, and named-pipe or TCP exfiltration.
- Web skimming uses malicious JavaScript on checkout pages, often via supply-chain compromise; compare page integrity and script hashes.
- Tradecraft: phishing, RDP/VPN brute force, vulnerable services, credential dumping, PsExec/WMI/SMB lateral movement, Run keys/services/scheduled tasks/WMI persistence, FTP/HTTPS/DNS exfiltration, event log clearing and timestomping.
Worked example
A host shows svchost.exe with an unusual parent, no Microsoft signature, strings containing track2, and a scheduled task launching it at logon. It beacons to an IP on 443. Reasoning: the strings and memory access suggest a RAM scraper; the scheduled task is persistence; the beacon is C2. Preserve memory and the binary, hash it, and detonate only in a lab.
Traps
Treating a sandbox clean result as proof of benign; equating obfuscation with encryption; hunting only known families; assuming Mimikatz only targets domain controllers; assuming POS malware runs only on POS terminals.