The Role of Malware Analysis in Cybersecurity

Threat actors use malicious software to cause damage to individuals and organizations. Malware is the most common form of a cyberattack because of its versatility. It may involve a virus to a devastating ransomware attack. Security analysts use methods and tools to analyze suspicious files in search of malware. In this post, we’ll explore the most common use cases for malware analysis. 

What is Malware Analysis?

Why Malware Analysis is Critical for a Strong Cybersecurity Posture

Types of Malware Analysis

Malware Analysis Stages

Malware Analysis Use Cases

Threat Hunting

Malware Detection

Incident Response

Threat Alerts and Triage

What You Can Do with Automation

Intezer Analyze: Your All-In-One Malware Analysis Platform

What is Malware Analysis?

Malware analysis is the use of tools and procedures to understand the behavior and purpose of a suspicious file. The process aims to detect and mitigate any potential threat. This practical process enables analysts to understand the malware’s functions, purposes, and potential impact. To achieve this, security teams use malware analysis tools. They assess and evaluate specific malware samples, usually inside a contained environment called a sandbox.

Incident responders and security analysts use malware analysis to:

• Identify the source of an attack
• Categorize incidents by the level of severity
• Improve the efficiency of the incident response process
• Evaluate the potential damage from a security threat
• Enrich threat hunting processes

Why Malware Analysis is Critical for a Strong Cybersecurity Posture

Malware analysis is one of the key processes in cybersecurity. Security analysts are regularly asked to analyze a suspicious file to check whether it is legitimate or malicious. It is important for responders because it helps them reduce false positives and understand how extensive a malware incident is.

Malware analysis is useful both for pre-incident and post-incident activity. During an incident, malware analysis gives you actionable information by identifying and classifying the malware. By documenting and identifying the malware via malware analysis, you gain a wealth of information that helps prevent future incidents.

After the incident, the information you gained from malware analysis forms part of the lessons learned. Analysts learn about patterns, methods of attack, and behavior from the newly analyzed malware that helps them devise prevention methods for other similar incidents.

Types of Malware Analysis

There are three types of malware analysis: static, dynamic, and the combination of both.

Static analysis checks the code without running the code. The analysts use disassembling to reverse engineer the malware in static analysis.

Some other techniques used by static analysis involve virus scanning, fingerprinting, and memory dumping. Using static analysis may have limitations against unknown malware types.

On the other hand, dynamic malware analysis checks the file while running. The malware is executed inside a controlled environment called a sandbox to prevent spreading it. Then, the malware can be reverse engineered to understand its behavior and purpose.

Some techniques used in dynamic malware analysis include API calls, memory writes, and registry changes. Since it is typically behavior-based, it can help detect the maliciousness of unknown files.

Malware Analysis Stages

Malware analysis is a process that needs to be done methodically. It consists of four stages, each increasingly more complex than the previous.

1. 1. Automated Analysis

Automated malware analysis uses detection models created by previously analyzed malware samples. Automation allows you to analyze malware at scale and assess the impact of a sample on the infrastructure. Fully automated malware analysis includes tools like virus scanning, sandboxes, and other tools available on the market.

1. 1. Static Properties Analysis

The next stage of malware analysis is static analysis. This involves checking a file’s metadata without running the malware. Since this stage includes checking strings involved in the malware code and the headers, there is no need to run the program to assess it. During this stage, the insights you get can tell you if you require a deeper investigation.

1. 1. Dynamic Analysis

Once you check the code as is at rest, you can check the behavior of the malware file. Dynamic analysis involves executing the malware sample in an isolated environment while the analyst observes how it behaves, the interaction with the system, and any changes. By doing this, analysts try to identify negative behavior patterns in the malware sample.

Behavior analysis is not that simple, as attackers also know about sandboxes and often program the malware to detect them. As such, the malware may refuse to execute if it detects an automated environment. Some “red flag” behaviors are, for example, if the sample modifies files or registries, tries to “call home,” or execute processes.

1. 1. Manual Code Reversing

The last stage in the malware analysis process is reverse engineering the code. You can understand the logic behind the malware and its algorithms by doing this. You can also discover other capabilities that the malware may have.  

Reverse engineering is typically done manually. Analysts often use the help of debugging and disassembling tools. The goal is to decode the encrypted data and find its logic. This process can be time-consuming and requires great skills. That’s why some analysts skip this stage. However, it is not wise to do so, as manual reversing the code can help you understand the nature of the malware sample.

Malware Analysis Use Cases

Conducting malware analysis can be highly beneficial for several use cases.

Threat Hunting

Malware analysis is used in threat hunting because it sheds light on the behavior of the malware. These analysis techniques, particularly dynamic analysis, can expose artifacts and attack methods. Threat hunters then can use this information to find similar activity.

Malware analysis enables threat hunting teams to see the malware’s actions and build a profile. This profile then can be used to detect and block future intrusions. They run the malware in the sandbox to find indicators that can be used on other occasions when attackers want to use this malware again.

Once you conduct an analysis and know what is the purpose of the malware, you can look for similar threats. For instance, find other systems in your network that are similarly built and start hunting. Check system logs, for example, by using your SIEM. If you find non-standard user agents or ports, this can be an indicator of a similar threat.

For threat hunters, it pays off to be thorough in this search. Using this information combined with the results of the reversing process can let you know if the malware caused further damage or if there is some lurking in the network.

Malware Detection

To protect your organization, you need to be able to differentiate between good code and malicious code. Malware analysis as a group of techniques helps to identify vulnerabilities and threats. Analysts conducting malware analysis apply techniques such as behavioral analysis to detect functionality threats. Therefore, it helps detect indicators of compromise (IoCs).

Incident Response

Incident response teams must act quickly to be successful at remediation and recovery. They aim to find the root cause analysis and determine the impact of the malware. Malware analysis helps incident responders to achieve their goals by providing actionable information that they can use for current and future incidents.

Threat Alerts and Triage

Malware analysis helps you understand how malware threats work so security teams can react promptly to them. Malware analysis tools send and prioritize high-fidelity alerts. By alerting early in the attack timeline, it helps security teams to save the time of response, instead of wasting time with false positives.

What You Can Do With Automation

Leveraging automated solutions simplifies malware analysis greatly. By using automation, analysts can check files, suspicious URLs, endpoints and memory dumps at scale, instead of doing it manually. Not only do they save time and effort, but it helps overcome the skills shortage. Automated solutions often are simpler to use, so beginner analysts can use them too.

Besides automation, there are other practices you can implement for malware protection:

• Scanning your systems regularly
• Employ security best practices like firewalls and anti-phishing prevention
• Create regular backups
• Update systems and applications
• Employ measures to prevent social engineering attacks

Intezer Analyze: Your All-In-One Malware Analysis Platform

Intezer is an innovative offer in malware analysis that involves using genetic code sequencing in software analysis. Genetic code analysis helps to identify reused code, directing the teams to the original threat.  

This all-in-one malware analysis platform goes beyond sandboxing and redefines malware analysis. First, Intezer overcomes the limitations of traditional sandboxing, such as the lack of context. To completely understand the malware, security teams often have to leverage multiple solutions for each investigation, wasting time and effort.

Intezer enables security analysts to approach malware with a single complete solution, easy-to-use so beginner analysts can use it. Here is how Intezer Analyzer can help:

• Complete coverage of malware incidents
• Provides context to investigation questions. Tracks malware families, TTPs, IoCs
• Automation that enables processing malware at scale
• Analyzes binary and non-binary formats
• Produces easy-to-understand reports that security analysts of any level can use

Intezer aims to solve the challenges of malware analysis by redesigning the process by integrating all main functionalities into a single, comprehensive tool. Get started by analyzing 50 suspicious files per month for free at analyze.intezer.com

Related Resources

Learn more about Intezer’s malware analysis: 

ELF Malware Analysis 101

Teaching Capa New Tricks: Analyzing Capabilities in PE and ELF Files

How to Detect Cobalt Strike

Get Fast Insights for a Microsoft-signed Netfilter Rootkit

Covering the Infection Chain: Analyze Documents and Scripts with Intezer Analyze