Incident Response and Digital Forensics
Malware Analysis
We determine what the malware found in an incident does, where it communicates, and what traces it leaves. We provide indicators to help you search for it across your other systems.
What it is
Malware analysis reveals a sample's capabilities and behavior. In static analysis, the code is examined without execution. In dynamic analysis, the sample runs in an isolated environment and its behavior is recorded. The result is a set of indicators for detection rules and behaviors mapped to MITRE ATT&CK techniques.
Scope
- Identifying the sample's capabilities and persistence method
- Extracting command and control (C2) addresses and communication method
- Decoding the sample's embedded configuration
- Listing file, registry, and network indicators of compromise (IOCs)
- YARA and Sigma rules for searching other systems
- Assessing the sample's relation to known malware families
The need
When organizations need it
- When EDR blocks a file but its intent is unknown.
- When you need to know what happened on systems of employees who opened a phishing attachment.
- When a file appears that security products do not recognize and seems tailored for your organization.
Method
How we work
-
Safe handling
We securely collect the sample with its hash and source system details.
-
Static examination
We examine the structure, embedded strings, and configuration without running the code.
-
Dynamic examination
We run the sample in an isolated environment and record its file, process, and network behavior.
-
Detection output
We deliver indicators and rules in a format your SOC can use directly.
Outcome
What you have at the end
You know what the sample does and where else it may be in your environment. Indicators and detection rules are ready for use in your SOC and EDR.
Frequently asked questions
Should we upload the sample to public analysis services?
Be careful. The sample may contain server names or addresses unique to your organization. Public uploads can alert the attacker they have been detected. Searching by hash only is safer.
How deep does the analysis go?
As deep as the incident requires. Behavioral analysis is usually sufficient for detection and remediation. If encryption or the communication protocol needs to be decoded, the analysis deepens with reverse engineering.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting