SOC Analysts Guide to Malware Analysis: 5 Core Techniques

Malware analysis is essential for SOC analysts aiming to understand and mitigate threats. Here are five fundamental techniques that every SOC analyst should be familiar with:

1. Static Analysis
   This is the first step and involves examining a file without executing it. Analysts check file hashes, embedded URLs, and suspicious strings. Tools like Exeinfo or PEiD can help analyze Windows executables quickly. SOC analysts often use static analysis to classify malware before moving on to more complex techniques.
2. Dynamic Analysis (Sandboxing)
   Dynamic analysis involves executing the file in a controlled environment, like a sandbox. This allows analysts to observe its behavior, such as which registry keys it modifies or if it attempts network connections. Analysts often use tools like Cuckoo Sandbox, which provides detailed behavioral reports, showing everything from file modifications to process injections.
3. Behavioral Analysis
   This involves monitoring the behavior of suspicious files over time. Analysts look at its network connections, any new files it generates, or the processes it spawns. For example, if malware creates a backdoor, behavioral analysis will reveal IP addresses and ports, crucial for blocking and containing the threat.
4. Network Analysis
   Network analysis checks the traffic generated by malware, which often communicates with a command-and-control server. By observing these communications, analysts can create firewall rules or blocklists to prevent further infection. SOC analysts use Wireshark to capture and analyze packets, noting IP addresses that could help trace the attacker.
5. Memory Analysis
   Malware can inject itself into a system’s memory. Memory analysis tools like Volatility can inspect active processes and detect unusual memory usage. For instance, if a dormant process suddenly shows spikes in memory, it might be malware activity triggered by a remote command.

Malware analysis in a SOC environment requires mastering these techniques. From static analysis to memory examination, SOC analysts gain a better understanding of threats, enabling them to defend networks more effectively.