An EDR alert fires on a heuristic, not a known signature, on a machine nobody's fully sure needs to come off the network yet. Someone drops the binary in your lap and wants an answer before the incident call starts in twenty minutes: is this actually something, or is it noise. You've read about malware analysis. You've never had to produce an answer against a clock.
The instinct is to just run it and watch what happens. That's usually the wrong first move on a host you still care about, because you don't get to un-execute unknown code on a machine that might need to go back into production, and detonating it blind can burn the one chance you had to observe it under controlled conditions. Static analysis comes first. Hash it and check it against what's already known. Then look at what it imports and what strings it carries, because certain combinations are a signal before you've run a single instruction: something that imports memory-allocation and remote-write functions together is shaped like process injection whether or not you've confirmed it yet. Something that references the registry's Run keys, or creates a scheduled task, or installs itself as a service, is telling you how it plans to survive a reboot before you've asked it to.
Persistence is the easier of the two questions to answer. Command and control is the one that actually decides how the rest of the hour goes, because whether it's phoning home changes whether this is contain-and-wipe or contain-and-monitor. That part rarely shows up in static analysis. It's a pattern you look for once you get a controlled detonation running in an isolated environment: not one connection but a rhythm, callbacks that repeat at something close to a fixed interval with just enough randomness added that no two gaps look identical, reaching out to infrastructure that has no legitimate reason to be anywhere in this environment's normal traffic.
None of this is a specialty skill locked behind years on the job, it's a sequence: hash and static triage before you ever execute anything, persistence mechanisms as the first real signal, command-and-control behavior as the question that actually decides the response. Codelivly's free C2 Beacon lab lets you practice spotting exactly that traffic pattern against a target built to look almost normal. The Malware Analysis Book for Beginners walks through all three pieces, families, persistence and C2, from zero, which is the actual gap between having read about malware analysis and being the person in the room who can answer the question when the call starts.
Top comments (0)