Assembling the Analysis Toolkit

Overview

A malware analyst needs two things before touching a suspicious binary: a safe environment and the right tools. Every tool mentioned in this topic is either open-source or has a free tier sufficient for all labs in this course.

The Analysis Virtual Machine

All analysis happens inside a virtual machine (VM). The host operating system never directly interacts with malware. The VM runs on a hypervisor such as VMware Workstation, VirtualBox, or Proxmox.

Configuration	Recommended Setting
Guest OS	Windows 10 (64-bit). Most malware targets Windows. Use an unactivated evaluation ISO from Microsoft.
RAM	4 GB minimum. 8 GB if running IDA Pro alongside a debugger.
Disk	60 GB dynamically allocated.
Network adapter	Host-Only for isolated analysis. Use NAT only when you need to simulate internet access via INetSim or FakeNet-NG. Never use Bridged mode.
Shared folders	Disabled. Clipboard sharing disabled. Drag-and-drop disabled. These are escape vectors.
Snapshots	Take a clean snapshot after installing all tools but before analysing any sample. Revert between samples.

Refer to REMA eBook 2026, Figure 2.4 for the lab isolation architecture diagram.

VM Detection

Sophisticated malware checks for virtualisation artefacts: VMware Tools processes, VirtualBox guest additions DLLs, specific MAC address prefixes (00:0C:29 for VMware), and the CPUID instruction's hypervisor bit. Defeating these checks is covered in Unit 6. For now, a standard VM is sufficient for the samples in this course.

Pre-Built Analysis Distributions

Rather than installing dozens of tools individually, analysts start from a pre-configured distribution.

Distribution	Base OS	Focus
FlareVM	Windows	Mandiant-maintained. 140+ tools installed via Chocolatey/PowerShell: debuggers, disassemblers, PE tools, network utilities. Recommended for this course.
REMnux	Linux	Malicious document analysis (pdfid, olevba), network forensics, memory analysis. Complements a Windows VM.

Tool Categories at a Glance

Category	Tools	Purpose
PE inspection	PEStudio, PE-Bear, CFF Explorer, DIE	Headers, sections, imports, exports, entropy, timestamps, signatures
String extraction	strings, FLOSS	ASCII/Unicode strings. FLOSS decodes stack strings and tight XOR loops.
Capability detection	Capa	Identifies what a binary can do based on code patterns
Hashing	md5sum, sha256sum, ssdeep	Cryptographic and fuzzy hashes for identification
Disassemblers	IDA Pro/Free, Ghidra	Static code analysis, CFGs, decompilation
Debuggers	x64dbg, WinDbg	Dynamic analysis, breakpoints, memory inspection
Process monitoring	Process Hacker, Procmon	DLL loads, file/registry activity
Network monitoring	Wireshark, FakeNet-NG	Packet capture, service simulation
Memory forensics	Volatility 3	RAM dump analysis for injected code, hidden processes
Sandboxes	Cuckoo/CAPE, Any.Run	Automated detonation and behavioural reports

Network Simulation

Many samples attempt DNS resolution and HTTP connections during execution. If these fail, the malware may refuse to proceed, hiding secondary behaviours.

INetSim (Linux, included in REMnux): emulates DNS, HTTP, HTTPS, SMTP, FTP, and IRC. When malware queries a domain, INetSim responds with a configurable IP.

FakeNet-NG (Windows, included in FlareVM): intercepts all outbound connections, responds with simulated services, and logs every DNS query, HTTP request, and raw TCP/UDP connection.

Tool	Platform	Protocols
INetSim	Linux	DNS, HTTP, HTTPS, SMTP, FTP, IRC
FakeNet-NG	Windows	DNS, HTTP, TCP, UDP, SMTP
ApateDNS	Windows	DNS only

The Recommended Free Stack

Static:    Ghidra + PEStudio + Detect-It-Easy + FLOSS + Capa
Dynamic:   x32dbg + ScyllaHide plugin
Process:   Process Hacker + Procmon (Sysinternals)
Network:   Wireshark + FakeNet-NG
Memory:    Volatility 3
Sandbox:   Any.Run (free tier) + Hybrid Analysis

Install everything via FlareVM on a Windows 10 VM. Takes approximately 2 hours for a clean setup.