Malware › Module 6 › Lesson 4
Lab — Dynamic
Full dynamic pass in $MAL_LAB — hygiene, detonation, proc monitor export, behavior summary for IOC candidates.
Visual · t22_dynamic_lab
Lab: end-to-end dynamic on $MAL_LAB. Original Cyberlium.
Opening
Close one dynamic loop — hygiene to revert — with behavior rows blue can use, not a malware remix project.
On YOUR $MAL_LAB with intentional sample from legal source per brief: (1) complete hygiene card; (2) detonate with logging; (3) export filtered proc monitor summary — ≥8 behavior rows with UTC, operation, detail redacted; (4) note network callbacks at literacy level (DNS name or IP category, no live C2 interaction beyond isolated sink); (5) revert snapshot and write dynamic summary: entry vector, persistence attempt Y/N, C2 attempt Y/N, file drop paths redacted; (6) chmod 600 all artifacts. No host OS execution, no ransomware deployment, no modifying sample to improve evasion, no sharing live binaries casually.
1. Lab pipeline
Hygiene → detonate → capture → filter → summarize → revert — same order every time builds analyst habit.
Cross-link static hashes and strings from prior modules in summary header.
Command guide
Try these commands — Lab pipeline
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Dynamic analysis ethics — https://www.eicar.org/ (benign samples in lab) ANY.RUN docs — https://any.run/malware-trends/ (safe dynamic path) Microsoft Defender sandbox — https://learn.microsoft.com/en-us/defender-endpoint/ (enterprise isolation)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || true ss -tulpn 2>/dev/null | tee "$HOME/cyberlium-lab/t22-mal/notes/capstone-baseline-ss.txt" | head -12 journalctl --no-pager -n 15 2>/dev/null | tail -8 grep never "$HOME/cyberlium-lab/t22-mal/roe.txt"
═══ WINDOWS ═══
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort -First 10 Write-Output 'REFUSE: detonation on host OS — use isolated VM'
Primary tools to practice this lesson: ss, journalctl. Reference sites: Dynamic analysis ethics (https://www.eicar.org/); ANY.RUN docs (https://any.run/malware-trends/); Microsoft Defender sandbox (https://learn.microsoft.com/en-us/defender-endpoint/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Behavior summary rows
Each row: UTC time, category (process/file/registry/net), detail redacted, IOC candidate Y/N.
Distinguish observed vs inferred — honesty for report module later.
3. Stop conditions
Stop if sample source undocumented, VM containment fails, or brief forbids file class — document blocker.
Never continue on host OS or home LAN after containment breach.
4. What you ship: dynamic lab pack
Behavior summary ≥8 rows + proc export note + revert proof + hash header — chmod 600.
5. What you record before the next lesson
Dynamic lab pack path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip revert to 'capture more C2 traffic' on bridged home network.
Right
Dynamic lab pack complete on $MAL_LAB. Next: quiz.
Mission: dynamic lab
1) Run full hygiene-to-revert pipeline. 2) Write ≥8 behavior rows. 3) Link static hash from prior modules. 4) Revert and chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “IOC candidate vs noise — filter rule?”
Knowledge Check
APPLY: Dynamic lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Modify sample to test evasion in capstone.
True or False
Knowledge Check
APPLY: Dynamic lab pack includes:
Multiple choice