(Aaron) We're going to get into actually detonating the
TrickBot malware and see what's going on,
but first, let's set the scene.
So, you have a malware sample.
Where'd you get it from?
(Tyler) There are a lot of places where you can get malware from online,
and one of the places that I found out is one of the best places to get it,
especially for new malware samples, is malware-traffic- analysis.net.
This is a website run by a man named Brad Duncan,
and he will go through,
he will get new samples of malware and just kind of analyze it.
And the best part about it is anything that he analyzes, he releases.
Any of the network traffic that he captures, he'll release as well.
So you can just go to the site, see how he analyzed it,
and then download new samples and see if your
analysis matches up to what he found, to see if the sample acts differently,
and so on.
(Aaron) Just for reference,
I've looked around using Google and trying to identify
different places you can get malware.
And first, that's kind of a weird Google to do.
Where can I get malware?
And it's like, uh, your email, sites you shouldn't be visiting,
things like that.
(Tyler) Your parents.
(Aaron) Your parents.
So it was really difficult to find a good source,
so I'm really glad that you gave this to me,
and I hope this helps the people watching this as well.
So, awesome.
So that's, we're getting that sample.
This is the sample you're using, correct, is the sample from this site?
(Tyler) Yes, I believe so, yeah.
(Aaron) And then what else are we doing?
Because we talked about different options when we set
up our malware analysis sandbox, different snapshots we might use.
We know we're using Windows 7 OS.
What's the rest of the setup?
(Tyler) So,
the way that I've set up my sandbox that we're going to analyze this in is
normally I would just have it set up networking-wise in host-only networking
mode so that the malware can't get out onto the internet.
And what I would do is I would kind of run it once,
have something like FakeNet running in the background to kind
of capture the malware's network traffic,
and then kind of see where it went and see if I wanted to open it up from there.
However,
because TrickBot is the way that it is and it goes out and it
downloads modules and it could take a little bit to run,
I just went ahead and set up my sandbox in NAT mode.
So it is going to be going out to the internet.
I'm connected to an anonymous internet connection through my cell phone company,
so that if something happens I can immediately shut that off and
then my computer's no longer on the internet.
But this is going to allow TrickBot to go out,
grab all the information that it needs to,
grab all the files that it needs to.
(Aaron) Got it.
And you talked about being modularized and it takes some
time to go and decide to download those modules and encrypt
them and that kind of thing,
so you needed to have time on the internet to be able to do that.
And it allows us to monitor it as well, right?
(Tyler) Right, right.
(Aaron) And then network address translations happen internal to your machine,
right?
(Tyler) Right.
(Aaron) So it's internal host to VM network address translation.
(Tyler) Yes, yeah.
And so the way that we would go through and capture the
network traffic in this case is have some type of network
sniffer running either on our VM here, our guest right here,
or even in the host OS.
Just to understand that if you're in NAT mode and you're in the host
OS and you're capturing network traffic there,
you're going to be seeing traffic not only from your guest,
but also your host, so you're going to have to differentiate between the two,
and they're both going to be looking like they're
coming from the same IP address, so you definitely want to be careful there.