Malware Analysis & Reverse Engineering
Chapter 03: Malware Analysis in Virtual
Machines
Dr. Raed Saeed
Outline
• Introduction
• Creating Your Malware Analysis Machine
• Using Your Malware Analysis Machine
• Risks of Using VMware for Malware Analysis
• Best Practices
Chapter 03: Malware Analysis in Virtual Machines 2
Introduction
Introduction
• Before conducting dynamic analysis on malware, it’s essential to
prepare a safe environment.
• New or unknown malware can behave unpredictably.
• If you run it on a production machine, it can quickly spread to
other machines on the network and be very difficult to remove.
• A properly isolated environment enables safe examination of the
malware without putting your system or other networked devices
at unexpected and unnecessary risk.
Chapter 03: Malware Analysis in Virtual Machines 4
Introduction
• A Virtual Machine (VM) is a software emulation of a physical
computer.
• It provides a way to run an entire operating system (OS) and
applications in an isolated environment.
Chapter 03: Malware Analysis in Virtual Machines 5
Introduction
Key Components of VMs:
• Host OS: The operating system on the actual physical machine.
• Hypervisor: Software that creates and manages VMs (e.g.,
VMware, VirtualBox).
• Virtual Hardware: Emulated components like CPU, RAM, storage,
network interfaces.
• Guest OS: The operating system running inside the VM.
Chapter 03: Malware Analysis in Virtual Machines 6
Introduction
Advantages of VMs for Malware Analysis:
• Isolation: Malware cannot escape the VM (unless exploiting a
vulnerability).
• Reusability: VM snapshots allow analysts to return to a clean
state.
• Safety: Reduces risk to host OS and other machines on the
network.
Chapter 03: Malware Analysis in Virtual Machines 7
Creating Your Malware Analysis
Machine
Creating Your Malware Analysis Machine
Configuring VMware:
• Use VMware Workstation or VirtualBox to create a VM.
• Recommended OS: Windows 7 or Windows 10 for compatibility
with most malware samples.
• Allocate at least:
• 2 GB RAM
• 30 GB disk space
Chapter 03: Malware Analysis in Virtual Machines 9
Creating Your Malware Analysis Machine
Disconnecting the Network:
• Prevent real malware from reaching the Internet.
• Set Network Adapter to "Host-only" (isolated from the Internet).
Chapter 03: Malware Analysis in Virtual Machines 10
Using Your Malware Analysis Machine
Using Your Malware Analysis Machine
Taking Snapshots:
• Save VM state before executing malware.
• Can be reverted in case malware modifies system files or installs
persistence mechanisms.
Chapter 03: Malware Analysis in Virtual Machines 12
Using Your Malware Analysis Machine
Connecting Malware to the Internet:
• Typically disabled.
• If needed: use Fakenet-NG to simulate Internet access.
Chapter 03: Malware Analysis in Virtual Machines 13
Using Your Malware Analysis Machine
Connecting and Disconnecting Peripheral Devices:
• Avoid connecting USBs or shared folders when analyzing
malware.
• Temporarily enable USB to transfer files; disable immediately
after.
Chapter 03: Malware Analysis in Virtual Machines 14
Using Your Malware Analysis Machine
Steps:
1. Start with a clean snapshot with no malware running on it.
2. Transfer the malware to the virtual machine.
3. Conduct your analysis on the virtual machine.
4. Take your notes, screenshots, and data from the virtual machine
and transfer it to the physical machine.
5. Revert the virtual machine to the clean snapshot.
Chapter 03: Malware Analysis in Virtual Machines 15
Risks of Using VMware for Malware
Analysis
Risks of Using VMware for Malware Analysis
• Malware authors are aware of VM usage and implement anti-VM
techniques to evade detection.
Chapter 03: Malware Analysis in Virtual Machines 17
Risks of Using VMware for Malware Analysis
Anti-VM Techniques:
• Detecting Virtual Devices: check for VMware services or drivers
(e.g., [Link]).
• Checking Registry Keys:
HKLM\HARDWARE\DESCRIPTION\System often shows VMware
devices.
• Timing Attacks: detect slower performance in virtualized
environments.
• Using CPU Instructions: use specific CPU instructions to detect
VM presence (e.g., CPUID).
Chapter 03: Malware Analysis in Virtual Machines 18
Best Practices
Best Practices
• Never open malware on your host OS.
• Always isolate the VM from the Internet unless necessary.
• Start with a clean snapshot with no malware running on it.
• Use snapshots to return to known clean states.
• Regularly update tools inside the VM (e.g., Process Monitor,
Wireshark).
Chapter 03: Malware Analysis in Virtual Machines 20
Summary
• Introduction
• Creating Your Malware Analysis Machine
• Using Your Malware Analysis Machine
• Risks of Using VMware for Malware Analysis
• Best Practices
Chapter 03: Malware Analysis in Virtual Machines 21
Chapter 03: Malware Analysis in Virtual Machines 22