# Comprehensive Analysis Environment Setup Guide

## Overview

A properly configured malware analysis environment is critical for safe and effective analysis. This guide covers VM provisioning, tool installation, network isolation, and operational security for both Linux and Windows analysis platforms.

## VM Architecture

### Recommended Configuration

| Resource   | Minimum     | Recommended  |
|-----------|-------------|--------------|
| RAM       | 4 GB        | 8-16 GB      |
| CPU Cores | 2           | 4+           |
| Disk      | 60 GB       | 120 GB       |
| Network   | Host-only   | Host-only + NAT (switchable) |

### Hypervisor Options

- **VirtualBox**: Free, cross-platform, adequate for most analysis
- **VMware Workstation/Fusion**: Better performance, commercial license
- **Hyper-V**: Built into Windows Pro/Enterprise
- **KVM/QEMU**: Linux native, scriptable, excellent performance

### VM Topology

```
┌─────────────────────────────────┐
│         Host Machine            │
│  ┌───────────┐ ┌─────────────┐  │
│  │  Analysis  │ │  INetSim /  │  │
│  │    VM      │ │  Services   │  │
│  │ (isolated) │ │    VM       │  │
│  └─────┬─────┘ └──────┬──────┘  │
│        │    Host-Only   │        │
│        └───────┬────────┘        │
│                │                 │
│         Host-Only Network        │
│          (no internet)           │
└─────────────────────────────────┘
```

## Linux Environment (REMnux-based)

### Base Setup

1. Install Ubuntu 22.04 LTS Server or Desktop
2. Update: `sudo apt update && sudo apt upgrade -y`
3. Run: `sudo bash scripts/setup_remnux.sh`

### Key Tools Installed

- **Disassemblers**: Ghidra, radare2, Cutter (r2 GUI)
- **Debuggers**: GDB with GEF/PEDA, strace, ltrace
- **Capability Analysis**: capa, YARA
- **Binary Utilities**: binwalk, foremost, UPX, file, strings, objdump
- **Network**: Wireshark, tshark, tcpdump, ngrep, mitmproxy
- **Python Libraries**: pefile, LIEF, capstone, unicorn, angr, oletools

### Post-Install Configuration

```bash
# Configure radare2
r2pm init
r2pm install r2ghidra

# Configure GDB
git clone https://github.com/hugsy/gef.git ~/.gef
echo "source ~/.gef/gef.py" >> ~/.gdbinit

# Set up YARA rules directory
mkdir -p ~/yara-rules
git clone https://github.com/Yara-Rules/rules.git ~/yara-rules/community
```

## Windows Environment (FLARE VM-based)

### Base Setup

1. Install Windows 10/11 (evaluation or licensed)
2. Disable Windows Update (analysis VM only)
3. Disable Windows Defender (or add broad exclusions)
4. Run PowerShell as Admin: `.\scripts\setup_flarevm.ps1`

### Key Tools Installed

- **Debuggers**: x64dbg, WinDbg
- **Disassemblers**: Ghidra, IDA Free
- **PE Analysis**: PE-bear, PEStudio, CFF Explorer, DIE
- **.NET Analysis**: dnSpy, ILSpy, de4dot
- **Network**: Wireshark, Fiddler, Nmap
- **Process Analysis**: Sysinternals Suite, Process Hacker, API Monitor
- **Utilities**: HxD, 7-Zip, CyberChef

## Network Isolation

### Isolation Modes

#### Mode 1: Full Isolation
No internet access. All services simulated locally.

```bash
sudo bash scripts/network_isolation.sh --mode isolated --inetsim
```

- Blocks all outbound traffic via iptables
- Redirects DNS to local sinkhole (logs all queries)
- INetSim provides fake HTTP, HTTPS, FTP, SMTP, DNS

#### Mode 2: Monitored Pass-Through
Traffic is allowed but captured for analysis.

```bash
sudo bash scripts/network_isolation.sh --mode capture --output /tmp/analysis.pcap
```

#### Mode 3: Selective Pass-Through
Allow specific traffic (e.g., to a C2 tracker) while blocking everything else. Configure manually:

```bash
# Allow only specific destination
iptables -A OUTPUT -d 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -j DROP
```

### INetSim Configuration

INetSim (`/etc/inetsim/inetsim.conf`) key settings:

```
# Bind to all interfaces
service_bind_address 0.0.0.0

# Enable common services
start_service dns
start_service http
start_service https
start_service smtp
start_service ftp

# Custom DNS default IP
dns_default_ip 10.0.0.1

# HTTP fake files (serve a default for any request)
http_fakefile exe  sample_exe  "application/octet-stream"
http_fakefile dll  sample_dll  "application/octet-stream"
```

### DNS Sinkhole

The network isolation script configures dnsmasq as a sinkhole:
- All DNS queries resolve to 127.0.0.1 (or specified IP)
- All queries are logged to `/var/log/dns_sinkhole.log`
- Useful for identifying C2 domains the malware attempts to contact

## Snapshot Strategy

### Recommended Snapshots

1. **clean-os**: Fresh OS install, updates applied
2. **tools-installed**: All analysis tools installed
3. **analysis-ready**: Tools configured, network isolated, ready for samples
4. **per-sample**: One snapshot per analysis session (optional)

### Snapshot Workflow

```
clean-os → tools-installed → analysis-ready
                                    ↓
                              Load sample
                                    ↓
                              Analyze
                                    ↓
                              Save artifacts
                                    ↓
                              Revert to analysis-ready
```

## Operational Security

### DO

- Use dedicated hardware or isolated VMs for analysis
- Keep the host OS patched and secure
- Use host-only networking by default
- Verify VM escape mitigations are current
- Hash all samples before and after analysis
- Store samples in password-protected archives (password: `infected`)

### DO NOT

- Analyze malware on production systems
- Connect analysis VMs to corporate networks
- Copy malware to shared drives without encryption
- Ignore VM escape vulnerabilities in your hypervisor
- Trust that the malware cannot detect it is in a VM (see anti-analysis-bypass skill)

## Troubleshooting

### Common Issues

| Issue | Solution |
|-------|----------|
| VM has no network after isolation | Check DHCP rules in iptables; allow UDP 67-68 |
| Ghidra won't start | Verify Java 17+: `java --version` |
| capa fails on sample | Try `capa -f pe sample.exe` to force format |
| INetSim services not responding | Check bind address and port conflicts |
| DNS sinkhole not logging | Verify dnsmasq is running: `systemctl status dnsmasq` |