Home > Digital Forensics

Dynamic Malware Analysis

Dynamic malware analysis is the process of executing malware in a controlled, isolated environment to observe its real behavior. Unlike static analysis, which examines code without running it, dynamic analysis reveals exactly what the malware does when active—its processes, changes to the file system, network communication, persistence creation, and interaction with the operating system.

Dynamic analysis is critical for understanding modern malware, especially heavily packed, encrypted, or obfuscated samples that only reveal their payloads at runtime.

What Is Dynamic Malware Analysis?

Dynamic analysis involves:

  • Running the malware in a sandbox or virtual machine

  • Monitoring its system modifications

  • Capturing network traffic

  • Observing process behavior

  • Recording persistence methods

  • Dumping unpacked payloads from memory

It provides visibility into the malware’s actual actions, not just its potential.

Why Dynamic Analysis Is Important

  • Packed or obfuscated malware reveals true code only during execution

  • Fileless malware loads payloads in memory

  • Malware may download additional stages from the internet

  • Behavioral indicators are the strongest detection signals

  • Many modern threats bypass static scans but expose behavior dynamically

Dynamic analysis often uncovers details static analysis cannot.

Safe Environment for Dynamic Analysis

Dynamic analysis must be performed securely to avoid infecting real systems.

1. Virtual Machines (Most Common)

Tools:

  • VMware

  • VirtualBox

  • Hyper-V

Recommended setup:

  • No shared clipboard

  • No shared folders

  • Network isolated (NAT or host-only)

  • Snapshots enabled

  • 2 separate VMs (attacker + victim for network monitoring)

2. Sandboxes

Automated analysis environments:

  • Cuckoo Sandbox

  • CAPE Sandbox

  • Any.Run

  • Hybrid Analysis

  • Joe Sandbox

These platforms execute malware and generate detailed reports.

3. Bare-Metal Labs (For Advanced Cases)

Used for:

  • Kernel rootkits

  • Hypervisor-aware malware

  • VM-aware malware

Requires strong containment and physical isolation.

Key Components Monitored in Dynamic Analysis

Dynamic analysis focuses on observing:

1. Process Behavior

Monitor:

  • New processes created

  • Suspicious parent-child chains

  • Process hollowing

  • Injection into trusted processes

Tools:

  • Process Monitor (ProcMon)

  • Process Explorer

  • Volatility (post-capture)

2. File System Changes

Malware may:

  • Create new files

  • Drop additional payloads

  • Modify system directories

  • Manipulate startup folders

ProcMon and SysInternals tools track these changes.

3. Registry Changes (Windows)

Malware often modifies the registry to establish persistence.

Common keys:

  • Run / RunOnce

  • Services

  • Shell modifications

  • IFEO hijacking

  • AppInit DLL

Tools:

  • Regshot (before & after snapshots)

4. Network Activity

Dynamic analysis reveals:

  • C2 communication

  • Foreign IP addresses

  • DNS queries

  • Downloaded payloads

  • Exfiltration channels

Tools:

  • Wireshark

  • TCPView

  • FakeDNS

  • INetSim (simulate internet services)

5. Persistence Creation

Track whether malware installs:

  • Services

  • Scheduled tasks

  • Registry autostarts

  • Browser extensions

  • WMI persistence

Tools:

  • Autoruns

  • ProcMon

6. Memory Activity

Dynamic execution exposes unpacked payloads stored in RAM.

This allows investigators to:

  • Dump decrypted malware

  • Extract in-memory DLLs

  • Identify shellcode

  • Recover C2 info

Tools:

  • ProcDump

  • Volatility

  • x64dbg (during execution)

7. API Calls (Behavioral Indicators)

Monitoring API calls reveals:

  • Keylogging

  • Injection

  • Credential access

  • File encryption

  • Network beacons

Tools:

  • API Monitor

  • Sysmon logs

Behavioral Indicators of Malware

Common behaviors observed during dynamic analysis:

  • Creating or modifying system executables

  • Suspicious network communication

  • Persistence attempts

  • Crypto routines (ransomware)

  • Injecting threads into explorer.exe or lsass.exe

  • Capturing keystrokes

  • Command-and-control polling

  • File deletion or tampering

  • Disabling security tools

Dynamic behavior often exposes the malware’s true purpose.

Malware That Requires Dynamic Analysis

Packed or encrypted malware

Payloads unpack only at runtime.

Fileless malware

Uses:

  • PowerShell

  • WMI

  • .NET

  • Reflective DLL loading

Multi-stage malware

Downloads second-stage payloads.

Stealthy RATs and backdoors

Hide functionality until executed.

Example Dynamic Analysis Workflow

1. Prepare clean VM

Snapshot → isolate → install tools.

2. Generate baseline

Regshot, ProcMon, and Wireshark in idle state.

3. Execute malware

Run program → observe changes.

4. Capture run-time behavior

  • ProcMon → file/registry

  • TCPView/Wireshark → network

  • Process Explorer → processes

  • Memdump → volatile data

5. Compare before vs after

Regshot for registry and file changes.

6. Extract IOCs

  • IPs, URLs, domains

  • Registry paths

  • File hashes

  • Persistence indicators

7. Dump RAM for deeper analysis

Use Volatility to extract in-memory payloads.

Tools Commonly Used for Dynamic Analysis

Windows

  • Process Monitor

  • Process Explorer

  • Regshot

  • Autoruns

  • ProcDump

  • x64dbg

  • Wireshark

  • TCPView

Automated Systems

  • Cuckoo Sandbox

  • CAPE

  • Any.Run

  • Hybrid Analysis

  • Joe Sandbox

Network Simulation

  • FakeDNS

  • INetSim

What Dynamic Analysis Reveals

Dynamic analysis exposes:

  • Real behavior

  • Persistence mechanisms

  • Network communication

  • Encryption routines

  • Process injection

  • Second-stage payloads

  • Malware capabilities not visible statically

This is essential to fully understand sophisticated or obfuscated malware.

Intel Dump

  • Dynamic malware analysis runs malware in a controlled environment to observe real behavior such as process creation, injection, persistence, and network communication.

  • It reveals indicators hidden by packing, encryption, or obfuscation that static analysis cannot detect.

  • Key evidence includes file system modifications, registry changes, C2 traffic, API calls, decrypted payloads in memory, and runtime anomalies.

  • Tools like ProcMon, Wireshark, TCPView, Regshot, sandbox environments, and Volatility capture malware behavior and extract IOCs.

  • Dynamic analysis is crucial for understanding multi-stage malware, RATs, ransomware, fileless attacks, and in-memory payloads.

HOME COMMUNITY CAREERS DASHBOARD