Malware Analysis Lab

A personal malware analysis and detection engineering lab built on Oracle VM VirtualBox, FLARE-VM, and REMnux.

The lab is designed around a repeatable workflow: perform static triage, detonate malware in an isolated environment, analyze memory artifacts, and convert observed behavior into practical detection content.

Why I Built This

I built this lab to strengthen the skills used in malware analysis, threat detection, and detection engineering.

Rather than stopping at identifying indicators of compromise, each analysis focuses on understanding how a sample behaves across the system:

• What capabilities can be identified before execution?
• What processes, files, registry keys, and network connections appear during execution?
• What artifacts remain in memory?
• Which behaviors can be translated into reliable detections?

Every sample follows the same structured methodology so findings remain reproducible and comparable across analyses.

Lab Architecture

Component	Details
Host OS	Windows 11 Pro
Hypervisor	Oracle VM VirtualBox
VM Management	VirtualBox Manager / VBoxManage
Windows Analysis VM	FLARE-VM on Windows 11
Linux Analysis VM	REMnux on Ubuntu 24.04
Malware Network	VirtualBox Host-Only Network
Network Simulation	INetSim on REMnux
Network Monitoring	Wireshark / tcpdump
SIEM / HIDS	Wazuh
Log Analysis	Elastic Stack / Kibana
Memory Forensics	Volatility 3

The malware analysis VMs communicate through a dedicated isolated subnet: 192.168.56.0/24

            Windows 11 Host
          Oracle VM VirtualBox
                   |
       Host-Only Virtual Network
            192.168.56.0/24
           /               \
          /                 \
 FLARE-VM                  REMnux

192.168.56.100 192.168.56.101 Windows Linux | INetSim

Network Configuration

FLARE-VM

• IP: 192.168.56.100/24
• Gateway: None
• DNS: 192.168.56.101

REMnux

• IP: 192.168.56.101/24
• Gateway: None

The analysis network has no external forwarding during malware detonation. REMnux runs INetSim to emulate common internet services and capture connection attempts made by analyzed samples.

Both virtual machines are reverted to known-clean baseline snapshots before each analysis session and again after the session is complete.

Repository Structure

malware-analysis-lab/
├── docs/                        # Architecture, methodology, safety practices
├── setup/                       # VirtualBox, FLARE-VM, and REMnux setup guides
├── static-analysis/             # Static findings and YARA rules
├── dynamic-analysis/            # Behavioral findings, IOCs, and network analysis
├── memory-forensics/            # Volatility workflows and memory reports
├── detection-engineering/       # Sigma, Wazuh, and MITRE ATT&CK mappings
├── tools-reference/             # Notes and cheat sheets for analysis tools
└── samples-index.md             # Index of analyzed malware samples

Analysis Methodology

Every sample moves through four phases.

Phase 1 — Static Analysis

The sample is inspected before execution to identify its structure, capabilities, and suspicious characteristics.

Typical analysis includes:

• Cryptographic hashing
• File type and architecture identification
• PE or ELF header inspection
• Section analysis and entropy review
• Import and export examination
• String extraction
• Capability identification
• YARA scanning
• CAPA analysis
• Initial IOC extraction

Common tools include: PEStudio, Detect It Easy, FLOSS, strings, CAPA, YARA, readelf, objdump

Windows binaries are primarily analyzed inside FLARE-VM, while Linux binaries and supporting analysis are handled through REMnux.

Phase 2 — Dynamic Analysis

The sample is executed inside the isolated malware network with monitoring tools running before execution begins.

The goal is to observe behavior such as:

• Process creation
• Parent-child process relationships
• File creation and modification
• Registry changes
• Persistence mechanisms
• Network connections
• DNS queries
• HTTP requests
• Command execution
• Dropped payloads
• Configuration changes

Windows monitoring commonly uses: ProcMon, Noriben, Wireshark, FakeNet-NG, x64dbg Linux monitoring commonly uses: tcpdump, Wireshark, inotifywait, strace

REMnux runs INetSim to simulate services such as DNS and HTTP without giving the malware access to the public internet. Indicators discovered during execution are documented for later correlation.

Phase 3 — Memory Forensics

After execution, a memory image is acquired and analyzed with Volatility 3.

Memory analysis focuses on identifying artifacts that may not be visible through normal system inspection, including:

• Hidden or terminated processes
• Process trees
• Suspicious command lines
• Injected code
• Process hollowing
• DLL injection
• Network connections
• Loaded modules
• Memory-resident payloads
• Credential-related artifacts
• Malware configuration data

Memory acquisition tools include: WinPmem, AVML Analysis is performed primarily with: Volatility 3

The goal is to correlate memory artifacts with evidence collected during static and dynamic analysis.

Phase 4 — Detection Engineering

Observed malware behavior is converted into detection content.

Detection work may include:

• Sigma rules
• Custom Wazuh rules
• Elastic queries
• IOC-based detections
• Behavioral detections
• MITRE ATT&CK mappings

Preference is given to behavioral detections when possible rather than detections based only on hashes, filenames, or other easily changed indicators. Each detection should be traceable back to evidence collected during the analysis.

Core Tooling

Category	Tools
Static Analysis	PEStudio, Detect It Easy, CAPA, FLOSS, YARA, strings, readelf, objdump
Dynamic Analysis	ProcMon, Noriben, Wireshark, FakeNet-NG, x64dbg, tcpdump, INetSim
Memory Acquisition	WinPmem, AVML
Memory Forensics	Volatility 3
Detection Engineering	Sigma, Wazuh, Elastic SIEM
Threat Intelligence	MalwareBazaar, VirusTotal, ANY.RUN, Malpedia, MITRE ATT&CK
Virtualization	Oracle VM VirtualBox

Sample Reports

See samples-index.md for an index of analyzed samples.

Each entry can include:

• Malware family
• File type
• Architecture
• SHA-256
• Sample source
• Static analysis report
• Dynamic analysis report
• Memory forensics report
• Detection rules
• MITRE ATT&CK techniques

The repository contains analysis documentation only. The following artifacts are intentionally excluded:

• Malware binaries
• Memory dumps
• Packet captures
• Extracted payloads
• Malicious scripts

Safety Model

Malware samples are handled exclusively inside disposable virtual machines connected to a dedicated isolated network.

The lab follows several basic safety controls:

• No external network access during malware execution
• No shared clipboard during detonation
• No shared folders with the host
• No host filesystem mounts inside analysis VMs
• No malware samples stored in the Git repository
• Clean VM baselines restored before analysis
• VMs reverted immediately after analysis
• Network activity redirected through controlled simulation services

The host machine is used only to provide virtualization infrastructure and is kept entirely outside the malware analysis network.

Goals

This repository is intended to document growth across several related disciplines:

Malware Analysis → Behavioral Analysis → Memory Forensics → Threat Detection → Detection Engineering

The goal is not simply to identify malware. The goal is to understand its behavior well enough to detect the same techniques when they appear again.

References

• MalwareBazaar — primary malware sample source
• FLARE-VM — Windows malware analysis environment
• REMnux — Linux malware analysis toolkit
• Volatility 3 — memory forensics framework
• MITRE ATT&CK — adversary behavior and technique mapping
• Malpedia — malware family reference
• ANY.RUN — sandbox comparison and behavioral reference

Disclaimer

This repository is maintained for cybersecurity research, education, and defensive analysis.

Malware samples are obtained from public threat intelligence repositories and analyzed exclusively inside isolated laboratory environments. No malware binaries, extracted payloads, memory images, or packet captures are distributed through this repository.