ThreatFoundacademy
Malware Analysis
Malware Analysis

Building a safe analysis lab

Isolated VMs, snapshots and the rules that keep malware from escaping.

9 min read

Rule zero of malware analysis: never run it on a machine you care about, on a network you care about. Build a disposable, isolated lab first.

Isolation

  • A dedicated virtual machine (VirtualBox/VMware) — never your host OS.
  • Network set to host-only or a controlled fake-internet (INetSim/FakeNet) — never a bridge to your real LAN.
  • Snapshots before every detonation so you can revert instantly.

Capable malware detects VMs and can escape weak isolation. Keep the hypervisor patched, disable shared folders/clipboard, and treat the whole lab as hostile.

The toolkit

  • Static — strings, PEview/CFF Explorer, a disassembler (Ghidra, IDA).
  • Dynamic — Procmon, Wireshark, x64dbg, Process Hacker.
  • Automated sandboxes — Cuckoo, any.run, Joe Sandbox for a fast first pass.

The workflow

Snapshot → static triage (hashes, strings, imports, packing) → detonate and observe (files, registry, processes, network) → record findings → revert the snapshot. Repeat.