Malware Analysis Lab
Executive Summary
Problem
Students and analysts struggle to source real malware artifacts and safe, structured analysis material.
Approach
A curated lab of live and reverse-engineered malware samples with detailed analysis reports and extracted Indicators of Compromise for studying multi-stage attack chains.
Outcome
A structured learning resource: samples + reports + IoCs, YARA-ready for signature development and detection validation in an isolated lab.
Architecture
Components
Trust
- isolated-lab only
- defanged paths
- attribution-agnostic
Threat Model (STRIDE)
| S | Threat | Mitigation |
|---|---|---|
| T | Malware escapes sandbox | network-isolated detonation + snapshots |
| I | IOC leakage | defanged indicators |
| R | Unclear provenance | documented acquisition notes |
| S | Sample tampering | hashes recorded per artifact |
| E | Accidental detonation on host | FLARE VM/REMnux-only execution policy |
Environment
- Analysis
- FLARE VM / REMnux
- Monitoring
- Procmon / Wireshark
- Artifacts
- YARA rules + IoCs
- Safety
- isolated, non-production lab only
Implementation
- Phase 0 — acquisition & hashing
- Phase 1 — static triage
- Phase 2 — sandbox detonation
- Phase 3 — behavior documentation
- Phase 4 — IOC + signature export
sample.yar
rule Suspicious_Downloader {
strings:
$s1 = "powershell.exe -enc" nocase
$s2 = "http://" ascii
condition:
uint16(0) == 0x5A4D and any of them
}Detection & MITRE
YARA signatures + behavioral indicators extracted per sample.
Execution T1059 · Persistence T1547 · Collection T1113/T1115 · Exfil T1041
Lessons Learned
What worked
Hashing artifacts at acquisition made the lab auditable.
What backfired
Some live samples needed multiple detonation passes for full chains.
What I'd repeat
Document IOCs immediately after each analysis, not at the end.
Future Improvements
- YARA pack per family
- Automated report generation
- Detonation script collection