threatfound
Malware Analysis
Malware Analysis · lesson 01

Building a safe analysis lab

Isolated VMs, snapshots and the rules that keep malware from escaping.

9 min read

Rule zero of malware analysis: never run it on a machine you care about, on a network you care about. Build a disposable, isolated lab first.

Isolation

  • A dedicated virtual machine (VirtualBox/VMware), never your host OS.
  • Network set to host-only or a controlled fake-internet (INetSim/FakeNet), never a bridge to your real LAN.
  • Snapshots before every detonation so you can revert instantly.
careful

Capable malware detects VMs and can escape weak isolation. Keep the hypervisor patched, disable shared folders/clipboard, and treat the whole lab as hostile.

The toolkit

  • Static, strings, PEview/CFF Explorer, a disassembler (Ghidra, IDA).
  • Dynamic, Procmon, Wireshark, x64dbg, Process Hacker.
  • Automated sandboxes, Cuckoo, any.run, Joe Sandbox for a fast first pass.

The workflow

Snapshot → static triage (hashes, strings, imports, packing) → detonate and observe (files, registry, processes, network) → record findings → revert the snapshot. Repeat.