Knowledge
Behavioural malware analysis
Observing what malware does when it runs (process, file, registry, and network behaviour) to complement static indicators.
Packing, encryption, and polymorphism can make two copies of the same malware look entirely different on disk. What they do when they run changes far less: they still drop files, persist, contact command servers, and encrypt or steal data. Behaviour is therefore a more stable signal of intent.
- Process activity: child processes, injection into other processes, privilege changes.
- File system: files created, modified, deleted, or encrypted.
- Persistence: registry run keys, scheduled tasks, services, startup items.
- Network: DNS lookups, contacted addresses and ports, protocol patterns.
- System calls: ordered sequences that can be modelled like language.
Behaviour is recorded by running the specimen in an isolated sandbox with networking disabled or simulated. The sandbox must be disposable, resource-limited, and hardened so the specimen cannot escape, and it is reset after every run.
Malware checks for virtual machines, debuggers, and analysis tools, waits out short timeouts, or needs user interaction or a live command server before acting. Behavioural coverage is therefore always partial, which is one reason THREATBYTES™ combines behaviour with static features and reasoning over incomplete signals.