Malware Network Behavior

Due Date: 2026-05-18 23:59:59
Submission: via GitLab repo

• Malware Network Behavior
  • Introduction
  • Setup
  • Part 1: Lab11-01 — Downloader and Credential Stealer
  • Part 2: Lab14-01 — Beacon Analysis
  • Part 3: Lab14-03 — Improved Beacon
  • Part 4: Written Analysis
  • Submission

Introduction

This assignment requires completion of the Network Behavior Lab before you begin. Work through the lab page first — it covers the necessary background on downloaders, reverse shells, beacon analysis, and Snort rules, and introduces the samples used below.

Revert to your clean VM snapshot and start INetSim before running any sample.

Setup

Download and extract the lab binaries from the PracticalMalwareAnalysis-Labs repository. The repository contains a single password-protected 7-Zip archive — git clone alone is not enough.

$ git clone https://github.com/mikesiko/PracticalMalwareAnalysis-Labs.git
$ cd PracticalMalwareAnalysis-Labs
$ unrar x PracticalMalwareAnalysis-Labs.exe

Archive password: malware. Do this inside your analysis VM — the binaries are live malware and most antivirus products will quarantine them on extraction.

After extraction the samples for this assignment are under BinaryCollection/Chapter_11L/ and BinaryCollection/Chapter_14L/.

Part 1: Lab11-01 — Downloader and Credential Stealer

Analyze Lab11-01.exe. This sample has both a network component and a credential-stealing component.

Using static and dynamic analysis, answer the following:

1. What does the malware drop to disk, and where?
2. How does the malware achieve persistence?
3. How does the malware steal user credentials? Identify the technique by name and show the relevant imports or disassembly that confirms it.
4. What does it do with the stolen credentials — where does it send or store them?

Part 2: Lab14-01 — Beacon Analysis

Analyze Lab14-01.exe. This is a C2 implant that sends a periodic beacon.

Answer all eight questions from the lab page:

1. Which networking libraries does the malware use, and what are their advantages?
2. What source elements construct the beacon, and what conditions change it?
3. Why might the beacon’s embedded information interest the attacker?
4. Does the malware use standard Base64? If not, how is the encoding unusual?
5. What is the overall purpose of this malware?
6. Which communication elements can be effectively detected by a network signature?
7. What mistakes might analysts make developing a signature for this malware?
8. What set of signatures would detect this malware and future variants?

For question 8, include the actual Snort rule text.

Run the sample for at least three separate sessions under INetSim and compare the captures to distinguish static from ephemeral content before writing your rule.

Part 3: Lab14-03 — Improved Beacon

Analyze Lab14-03.exe. This sample is an improved version of Lab14-01 — the attacker has made changes specifically to harden it against signatures.

1. What hard-coded elements are in the initial beacon? Which make good signature targets, and which do not?
2. How does the malware receive commands? How does the attacker hide the command list?
3. What encoding is used for command arguments, and how does it differ from standard Base64?
4. What commands does the malware accept?
5. What is the overall purpose of this malware?
6. Write a set of independent Snort rules targeting different areas of the code so that a partial update by the attacker does not defeat all detection at once. Explain what each rule targets and why it is independently valuable.

Test your rules against a capture file:

$ suricata -r capture.pcap -S hw4.rules -l /tmp/output/

Include the rules file and the alert output in your submission.

Part 4: Written Analysis

Write a 1–2 page reflection covering:

• Compare Lab14-01 and Lab14-03. What specific changes did the attacker make, and did those changes defeat your Lab14-01 signatures?
• What is the difference between a signature that catches one sample and one that catches a malware family? How do you write the latter?
• What are the limits of network signatures as a detection strategy? What would you use in addition to them?

Submission

Commit and push to hw4/ in your GitLab repo: