动态分析可观察恶意代码的真实行为
1 沙箱
缺点：沙箱只能简单的运行恶意程序 ，当程序有命令参数，或后门程序需要接收指令才能运行，在沙箱中无法启动的。
- 恶意代码会检测沙箱环境
- 有些恶意代码在沙箱环境中找不到依赖的环境，无法运行
- 恶意代码运行的操作系统不相符
- 沙箱只能报告恶意代码的功能，不能给出最终结论
2 运行恶意代码
启动dll
rundll32.exe DLLname, Export arguments
Export arguments中DLL文件导出表中的函数或者序号
如
rundll32.exe rip.dll, Install
rundll32.exe rip.dll, #5
windows启动服务
net start service_name
3 进程监视器
ProcessMonitor
过滤器的使用
4 进程浏览器
可查看进程的使用的dll和使用handle(文件句柄，互斥量、事件等等)
可使用验证选项来验证磁盘上的文件是否有微软的签名，可通过内存替换技术绕过
分析恶意文件 如恶意pdf和office文件 来查看创新的新进程和网络行为
5 Regshot比较注册表快照
可以对系统注册表进行快照，对比差异。能够了解 恶意代码的对注册表的操作
下载地址 https://jaist.dl.sourceforge.net/project/regshot/regshot/1.9.0/Regshot-1.9.0.7z
6 模拟网络
- ApateDNS 用来查看恶意程序请求的DNS 域名https://download.csdn.net/download/unlovingset/8228159
- fakenet 一个windows平台下的网络模拟器，用于恶意代码分析
https://sourceforge.net/projects/fakenet/ - netcat https://eternallybored.org/misc/netcat/ 用于TCP/IP连接、代理、隧道，非常强大的工具
nc -l -p 8888
nc www.baidu.com 80
7 抓包
使用wireshark进行抓包
http://down1.jyrd.com:8001/2010/wiresharkportable_3987.com.rar
8 inetsim
inetsim 在linux平台上可以模拟常见的网络服务
root@kali:~# inetsim
INetSim 1.2.8 (2018-06-12) by Matthias Eckert & Thomas Hungenberg
Main logfile '/var/log/inetsim/main.log' does not exist. Trying to create it...
Main logfile '/var/log/inetsim/main.log' successfully created.
Sub logfile '/var/log/inetsim/service.log' does not exist. Trying to create it...
Sub logfile '/var/log/inetsim/service.log' successfully created.
Debug logfile '/var/log/inetsim/debug.log' does not exist. Trying to create it...
Debug logfile '/var/log/inetsim/debug.log' successfully created.
Using log directory: /var/log/inetsim/
Using data directory: /var/lib/inetsim/
Using report directory: /var/log/inetsim/report/
Using configuration file: /etc/inetsim/inetsim.conf
Parsing configuration file.
Configuration file parsed successfully.
=== INetSim main process started (PID 1233) ===
Session ID: 1233
Listening on: 127.0.0.1
Real Date/Time: 2020-02-08 10:13:04
Fake Date/Time: 2020-02-08 10:13:04 (Delta: 0 seconds)
Forking services...
* dns_53_tcp_udp - started (PID 1321)
* irc_6667_tcp - started (PID 1331)
* daytime_13_tcp - started (PID 1338)
* tftp_69_udp - started (PID 1330)
* echo_7_tcp - started (PID 1340)
* finger_79_tcp - started (PID 1333)
* daytime_13_udp - started (PID 1339)
* echo_7_udp - started (PID 1341)
* ntp_123_udp - started (PID 1332)
* time_37_udp - started (PID 1337)
* syslog_514_udp - started (PID 1335)
* ftp_21_tcp - started (PID 1328)
* ident_113_tcp - started (PID 1334)
* discard_9_tcp - started (PID 1345)
* discard_9_udp - started (PID 1346)
* smtps_465_tcp - started (PID 1325)
* time_37_tcp - started (PID 1336)
* smtp_25_tcp - started (PID 1324)
* pop3_110_tcp - started (PID 1326)
* https_443_tcp - started (PID 1323)
* http_80_tcp - started (PID 1322)
* quotd_17_tcp - started (PID 1347)
* chargen_19_udp - started (PID 1351)
* quotd_17_udp - started (PID 1348)
* chargen_19_tcp - started (PID 1349)
* ftps_990_tcp - started (PID 1329)
* dummy_1_udp - started (PID 1353)
* dummy_1_tcp - started (PID 1352)
* pop3s_995_tcp - started (PID 1327)
done.
Simulation running.
