This hands-on training teaches concepts, techniques and tools to understand the behavior and characteristics of malware by combining two powerful techniques, malware analysis and memory forensics. This course will introduce attendees to basics of malware analysis,reverse engineering, Windows internals and memory forensics, it then gradually progresses deep into more advanced concepts of memory forensics.
$3,299.00
| Date | Day | Time | Duration |
| 21 Aug | Monday | 0900-17:00 ICT/GMT+7 | 8 Hours |
| 22 Aug | Tuesday | 0900-17:00 ICT/GMT+7 | 8 Hours |
| 23 Aug | Wednesday | 0900-17:00 ICT/GMT+7 | 8 Hours |
Malware analysis and memory forensics are powerful analysis and investigative techniques used in reverse engineering, digital forensics and incident response. Adversaries are becoming more sophisticated and carrying out advanced malware attacks on critical infrastructures, Data Centers, private and public organizations. This makes detecting, responding and investigating such intrusions increasingly critical for information security professionals. Malware analysis and memory forensics have become a must-have skill for fighting advanced malwares, targeted attacks and security breaches.
This course will introduce attendees to basics of malware analysis,reverse engineering, Windows internals and memory forensics. It will then gradually progress deeper into more advanced concepts of memory forensics.
This course uses hands-on labs using real world malware samples and infected memory images (Crimewares, APT malwares, Rootkits etc) to help attendees gain better understanding of the subject. The training also shows how these techniques can be incorporated in a sandbox to automate malware analysis. After taking this course attendees will be equipped with skill to analyze, investigate and respond to malware related incidents.
Introduction to Malware Analysis
Static Analysis
Dynamic Analysis/Behavioural analysis
Automating Malware Analysis(sandbox)
Malware Persistence Methods
Code Analysis
Introduction to Memory Forensics
Volatility Overview
Investigating Process
Investigating Process handles & Registry
Day 3
Investigating Network Activities
Investigation Process Memory
Investigating User-Mode Rootkits & Fileless Malwares
Memory Forensics in Sandbox technology
Investigating Kernel-Mode Rootkits
Memory Forensic Case Studies
- What is Malware - What they do - Why malware analysis - Types of malware analysis - Setting up an isolated lab environment
- Fingerprinting the malware - Extracting strings - Determining File obfuscation - Pattern matching using YARA - Fuzzing hashing & comparison - Understanding PE File characteristics - Disassembly - Demo - Static analysis of real malware sample - Hands-on lab exercise involves analzying real malware sample
- Dynamic Analysis Steps - Understanding Dynamic Analysis tools - Simulating services - Performing Dynamic Analysis - Monitoring process, filesystem, registry and network activity - Determining the Indicators of compromise (host and network indicators) - Demo - Showing the analysis of real malware sample - Hands-on lab exercise involves analzying real malware sample
- Custom Sandbox Overview - Working of Sandbox - Sandbox Features - Demo - Analyzing malware in the custom sandbox
- Code Analysis Overview - Disassmbler & Debuggers - Code Analysis Tools - Basics of IDA Pro - Basics of Ollydbg/Immunity Debugger - Understanding Windows API calls - Understanding Malware functionalities(Downloader, dropper, keylogger, code injection, http backdoor) - Demo - Dissecting the APT Malware - Hands-on lab exercise involves analzying real malware sample
- What is Memory Forensics - Why Memory Forensics - Steps in Memory Forensics - Memory acquistion and tools - Acquiring memory From physical machine - Acquiring memory from virtual machine - Hands-on excercise involves acquiring the memory
- Introduction to Volatility Advanced Memory Forensics Framework - Volatility Installation - Volatility basic commands - Determining the profile - Volatiltiy help options - Running the plugin
- Process(EPROCESS) Structure - Process organization - Process Enumeration by walking the double linked list - process relationship (parent child relationship) - Understanding DKOM attacks - Process Enumeration using pool tag scanning - Volatililty plugins to enumerate processes - Identifying malware process - Hands-on lab exercise(scenario based) involves investigating malware infected memory
- Objects and handles overview - Enumerating process handles using Volatility - Understanding Mutex - Detecting malware presence using mutex - Understanding the Registry - Investigating common registry keys using Volatility - Detecting malware persistence - Hands-on lab exercise(scenario based) involves investigating malware infected memory
- Understanding malware network activities - Volatiltiy Network Plugins - Investigating Network connections - Investigating Sockets - Hands-on lab exercise(scenario based) involves investigating malware infected memory
- Process memory Internals - Listing Dll's using Volatility - Identifying hidden Dll's - Dumping malicious executable from memory - Dumping Dll's from memory - Scanning the memory for patterns(yarascan) - Hands-on lab exercise(scenario based) involves investigating malware infected memory
- Code Injection - Types of Code injection - Remote DLL injection - Remote Code injection - Reflective DLL injection - Hollow process injection - Demo - Case Study - Hands-on lab exercise(scenario based) involves investigating malware infected memory
- Sandbox Overview - integrating Memory Forensics in sandbox - Demo - showing use of memory forensics in custom sandbox
- Understanding Rootkits - Understanding Functional call traversal in Windows - Level of Hooking/Modification on Windows - Kernel Volatility plugins - Hands-on lab exercise(scenario based) involves investigating malware infected memory - Demo - Rootkit Investigation
- Hunting an APT malware from Memory - Rouge process hunting (covers various samples)
Monnappa K A is a Security professional with over 15 years of experience in incident response and investigation. He previously worked for Microsoft & Cisco as a threat hunter mainly focusing on threat hunting, investigation, and research of advanced cyber attacks.
He is the author of the best-selling book “Learning Malware Analysis.”He is the review board member for Black Hat Asia, Black Hat USA, Black Hat Europe. He is the creator of Limon Linux sandbox and the winner of the Volatility plugin contest 2016. He is the co-founder of the cybersecurity research community “Cysinfo” (https://www.cysinfo.com).
He has conducted training sessions on malware analysis, reverse engineering, and memory forensics at Black Hat, BruCON, HITB, FIRST (Forum of Incident Response and Security Teams), SEC-T, OPCDE, and 4SICS-SCADA/ICS cybersecurity summit. He has presented at various security conferences, including Black Hat, FIRST, SEC-T, 4SICS-SCADA/ICS summit, DSCI, National Cyber Defence Summit, and Cysinfo meetings on various topics related to memory forensics, malware analysis, reverse engineering, and rootkit analysis. He has also authored various articles in eForensics and Hakin9 magazines. You can find some of his contributions to the community in his YouTube channel (http://www.youtube.com/c/MonnappaKA), and you can read his blog posts at https://cysinfo.com
What students say about this training:
“It is an excellent Malware introductory course which helps me to learn basic ideas and provide a guideline for further study in the future”
“Well organised & run”
“Particularly appreciative of how the course materials were well-prepared, and how informative [the] explanations were”
“Great course. Next time I would like to be on site.”
