Malware Analysis and Reverse Engineering Questions

Immediate containment

• Isolate the endpoint (network quarantine, disable remote access) and collect live artifacts: memory dump, process list, open handles, autoruns, scheduled tasks, and associated files (hashes).
• Preserve chain-of-custody and note timestamps.

Static analysis

• Compute hashes (MD5/SHA256), identify packers (Detect It Easy), examine PE headers, imports/exports, strings, and resources.
• Use YARA rules and sigs (ClamAV, VirusTotal) to quickly flag known malware families.
• Decompile/inspect with Ghidra or IDA for indicators (C2 domains, hardcoded keys).

Sandboxing / dynamic analysis

• Execute in isolated VM with snapshotting and monitoring (Cuckoo, ThreatGrid).
• Observe process behavior, dropped files, registry changes, persistence mechanisms, command-line args, and privilege escalation attempts.
• Capture full process traces, API calls (Procmon), and screen/video.

Network analysis

• Monitor DNS, HTTP(S), and unusual outbound connections (Wireshark, Zeek).
• Extract and analyze C2 traffic, beacon timing, URIs, and payload exfil patterns; decrypt TLS if possible via proxy.

Intelligence enrichment

• Lookup hashes/domains/IPs in VT, AbuseIPDB, MISP, and vendor intel. Map to TTPs (ATT&CK) and assess IOC reuse and threat actor attribution.
• Score severity (impact + confidence).

Final remediation & recommendations

• Remove/purge indicators, reimage if persistence or credential theft confirmed.
• Reset credentials, rotate keys, and block IOCs at firewall/IDS and EDR.
• Apply patching, hardening, EDR rules, and user awareness; document timeline and lessons learned; recommend monitoring for recurrence.

Overview
I’ll describe each family from an analyst’s point of view: infection vectors, persistence, common IOCs (files, registry, network), and quick detection techniques you’d use in a corporate SOC.

Ransomware

• Infection vectors: Phishing with malicious attachments/links, RDP brute force, compromised update channels.
• Persistence: Scheduled tasks, services, modified startup directories, DLL side-loading.
• IOCs: Newly created encrypted extensions, ransom notes (TXT/HTML), renamed files, unusual processes (e.g., cmd/PowerShell spawning encryption), deletion of shadow copies.
• Quick detection: Monitor sudden rapid file rename/IOPS spikes, abnormal PowerShell/WMIC activity, alerts on mass deletion of VSS snapshots, SIEM rules for common ransom note filenames.

Trojans

• Infection vectors: Malicious attachments, bundled installers, drive-by downloads, social engineering.
• Persistence: Registry Run keys, services, dropped DLLs/executables in AppData/Temp.
• IOCs: Unknown executables in user folders, startup registry entries, suspicious parent-child process relationships.
• Quick detection: Endpoint scans for new binaries in writable locations, process ancestry analysis, YARA signatures, EDR behavioral rules for credential theft actions.

Rootkits

• Infection vectors: Privilege escalation exploit, malicious driver installation, supply-chain compromise.
• Persistence: Kernel-mode drivers, hooked APIs, firmware implants.
• IOCs: Mismatched kernel module lists vs. userland view, hidden files/processes, modified system binaries.
• Quick detection: Kernel integrity checks, signed driver validation, comparing raw disk listings to OS view, use of boot-time scanners and memory forensics for hidden process artifacts.

Worms

• Infection vectors: Network propagation exploiting SMB/SSH/RDP flaws, email propagation.
• Persistence: Service/cron installation, replication across networked hosts.
• IOCs: High lateral connection rates, repeated exploit patterns (SMB traffic), identical payload on multiple hosts.
• Quick detection: Network IDS signatures for worm exploit traffic, abnormal scanning/connection spikes, honeypots to detect spread.

Fileless malware

• Infection vectors: Malicious macros, phishing links that execute script, living-off-the-land binaries (LOLBAS).
• Persistence: Scheduled tasks, registry run keys that invoke PowerShell/WMIC, WMI persistence.
• IOCs: Malicious or obfuscated PowerShell commands, suspicious parent-child chains (e.g., Office -> PowerShell), in-memory-only payloads (no disk artifact).
• Quick detection: Monitor command-line telemetry (PowerShell logs, AMSI/ETW), EDR memory inspection, block/alert on encoded/Invoke-Expression commands, enforce script-block logging.

Closing: prioritize centralized telemetry (process cmdlines, network flows, file activity, registry changes), baseline behavior, and EDR+SIEM rules to quickly triage these families.