恶意程序动态行为分析

---
name: dynamic-analysis
description: Sandbox execution and runtime monitoring of malware samples - capturing API calls, filesystem changes, registry modifications, network activity, and process creation for behavioral profiling.
---

# Dynamic Analysis

Execute malware samples in controlled sandbox environments and monitor runtime behavior to understand capabilities, communication patterns, and system impact.

## Prerequisites

- Isolated analysis VM (see `references/sandbox-setup.md`)
- Network capture tools (tcpdump, Wireshark)
- Process monitoring tools (Procmon, API Monitor, or psutil-based scripts)
- CAPE or Cuckoo sandbox (optional, for automated analysis)

## Steps

### 1. Prepare the Sandbox Environment

Set up an isolated virtual machine with snapshot capability. Ensure network isolation to prevent malware from reaching real infrastructure.

Run the capture setup script to initialize monitoring:

```bash
bash scripts/capture_setup.sh --interface eth0 --output /analysis/captures
```

This creates filesystem snapshots and starts network capture before sample execution.

### 2. Configure Monitoring

Review and customize the sandbox configuration template:

```bash
cat assets/sandbox-config.json
```

Key monitoring targets:
- **Process creation**: Track child processes, injection attempts
- **Filesystem**: File creation, modification, deletion, encryption
- **Registry** (Windows): Persistence keys, configuration changes
- **Network**: DNS queries, HTTP/HTTPS connections, C2 beaconing
- **API calls**: Key Windows API invocations (see `references/api-monitoring.md`)

### 3. Execute with Monitoring

Start the process and filesystem monitor before executing the sample:

```bash
python scripts/sandbox_monitor.py --pid <PID> --output /analysis/results --duration 300
```

Or monitor all new processes:

```bash
python scripts/sandbox_monitor.py --watch-new --output /analysis/results --duration 300
```

### 4. Capture Runtime Behavior

During execution, the monitor captures:
- Process creation and termination events with timestamps
- File system changes (created, modified, deleted files)
- Network connections (source, destination, port, protocol)
- CPU and memory usage patterns over time

### 5. Generate Timeline

After execution completes, generate a consolidated timeline:

```bash
python scripts/sandbox_monitor.py --timeline /analysis/results --format json
```

The timeline merges all event sources into a chronological view for behavioral analysis.

### 6. Analyze Results

Review the generated timeline and logs:
1. Identify **persistence mechanisms** - scheduled tasks, startup entries, services
2. Map **network indicators** - C2 domains/IPs, exfiltration channels
3. Document **evasion techniques** - sandbox detection, timing checks, environment checks
4. Catalog **payload delivery** - dropped files, downloaded stages

### 7. Correlate with Static Analysis

Compare dynamic findings with static analysis results:
- Do observed network connections match embedded strings/URLs?
- Are identified API imports consistent with observed behavior?
- Were all code paths exercised, or does the sample have dormant capabilities?

## Tips

- Take VM snapshots before each execution for reproducible analysis
- Run samples for at least 5 minutes; some malware has delayed execution
- Use FakeDNS or INetSim to simulate network services
- Monitor for anti-sandbox checks (CPUID, MAC address checks, mouse movement)
- Compare behavior across multiple runs for consistency
- Use CAPE sandbox for automated unpacking and config extraction

## References

- `references/sandbox-setup.md` - VM and sandbox environment setup guide
- `references/api-monitoring.md` - Windows API monitoring reference