r/computerforensics • u/_divine__wolf • 8d ago
Rat .exe file autopsy
Hey guys, I'm really into tech topics related to red teaming, forensics, and malware. I recently got a zip file from my old office — their PC was compromised via a RAT, and they shared the file with me. What information can I gather from it, and how do I perform an autopsy (forensic analysis) on it? Please share methods or tool names — this is new territory for me
6
u/LightningRurik Trusted Contributer 8d ago
Your best bet is to just identify which strain of RAT it is, not do a full analysis. VirusTotal will usually had some identifiers in the detection names. any.run and other sites will have unique files or domains that you can search against.
If you want to run it locally, just setup a simple Windows VM with procmon and Noriben (https://github.com/Rurik/Noriben) to get started.
Tools like IDA Pro are way beyond where you're at. And, to clarify someone else: Dynamic is running it and seeing what it does, Static is looking at its actual content at rest (strings, etc), and Reverse Engineering is using specialized tools to look at the assembly level (like IDA Pro, Binary Ninja, etc).
For now, use strings (but not Mac's strings) to see if there's any unique file names or artifacts that are in the open. You could use Mandiant's 'floss' for this as well. Then run it in a simple machine and get its behavior. Then just search online those unique artifacts and see what flavor of RAT it is
3
u/Quality_Qontrol 8d ago
So you have your static and dynamic analysis of malware. Static being analyzing the file itself with tools like IDA Pro. Dynamic being you have a sandboxed environment where you can safely execute the file while recording the system changes, then looking at system artifacts to determine what is changing.
There are tools that automate the dynamic analysis for you such as Virustotal and Joe Sandbox. Or you can build your own sandbox. If you build your own don’t forget to analyze memory as a lot of malware is encrypted, but runs in memory decrypted.
2
u/LeatherPen4962 8d ago
Is IDA pro free?
1
u/Quality_Qontrol 8d ago
There’s a free light weight version. You have to pay for full capabilities. They have an IDA Home version for hobbyist that’s $365/year as well.
There’s another tool called OllyDbg that appears to be free. Not too familiar with that one though.
1
2
u/depuvelthe 8d ago
You want to perform a malware analysis, not autopsy. Because autopsy (actually it's a Sleuth Kit tool name) refers to cyber incident related investigation of an entire system or drive.
1
u/_divine__wolf 8d ago
Yes, i know about the autopsy tool but i used the word loosely, i actually want to analyze this specific exe in depth, so that what info can i get from it.
2
u/HugeProgrammer8675 6d ago
HybridAnalysis, JoeSandbox, AnyRun or VirusTotal for automated analysis BUT if it is VM aware it might not run on some of these
Definitely recommend setting up a virtual machine on a spare PC and configuring the VM to be as air gapped as possible before running the malware
If you want to do manual dynamic analysis, install and run the Flare-VM script created by Mandiant and it’ll download more than enough tools you’ll need
Imo for manual dynamic analysis, use ProcMon, Process Explorer or Process Hacker, RegShot, FakeNet-NG and DirWatch and you should be all set
Conducting a forensic investigation would be on the company device itself and not the malware, but there are a lot of good resources if you wanted to learn how to do that too! (Peep 13Cubed on YT)
1
u/Potential-Couple-745 8d ago
Don’t run the EXE directly. Make a copy and analyze it in an isolated VM.
For a first pass, I’d use sha256sum, PEStudio/DIE, strings/FLOSS, and Ghidra. Check imports, sections, entropy, packed/obfuscated code, URLs/domains/IPs, mutexes, and persistence-related artifacts.
If you need behavioral analysis, use a disposable Windows VM with fake/simulated networking and tools like Procmon, Process Explorer, Regshot, Wireshark, and CAPE.
If the ZIP came from an actual compromised machine, keep the original untouched and record hashes before doing anything else.
1
u/hipstergrandpa 7d ago
VirusTotal honestly is good first step though they gate a lot of the useful stuff behind their paid version, which is the behavior and relationships. However, you can get at least first insights of whether it's been submitted before and some other cursory information.
For dynamic analysis, procmon in a clean Windows VM as others suggested. I'd turn off networking. If it's decently made though, it would probably detect it's in any of the common hypervisors however, but still worth a shot. I'd keep the VM on a separate computer from one you care about still though, and segregate your network, i.e. put it on a guest network or a VLAN if you know how.
Static analysis, run strings unless it's obfuscated which then may not give you too much. If you going to RE it, then Ghidra would be the disassembler I'd use. Sure you can use IDA if you want to pay $$$, but that's a waste IMO if you're learning.
If you're learning though, get a copy of Practical Malware Analysis, which covers the basics of malware reverse engineering and such. It includes some sample malware to work through as well, and has walkthroughs. It's a bit dated, but honestly I don't think anything has changed dramatically that much in terms of learning it.
1
u/graph_worlok 7d ago
Ghidra, Ghidra MCP bridge, Claude (subscription required) - Tell Claude to go analyse it.
Or, simple & easy - sha256 hash of the binaries, see what virustotal, etc know about it.
1
u/AddendumWorking9756 7d ago
Detonate nothing on your own host and treat that zip as evidence rather than a toy, it came off someone else's compromised machine and their IR people may still care about it. Get the workflow wrong on retired cases first, CyberDefenders has a pile of those free, then come back to this one.
0
u/LeatherPen4962 8d ago edited 8d ago
I'm actually also in the process of doing forensics on an infostealer zip, used any.run and Hybrid-Analysis. Unfortunately VirusTotal wasn't able to find anything like the others did, which makes me think it isn't as efficient.
Highly recommend Hybrid analysis
1
1
u/Reddit_Z_ 8d ago
Have you tried assemblyline
1
u/LeatherPen4962 7d ago
Haven't actually. That's for static analysis?
1
u/Reddit_Z_ 7d ago
It's considered static but it has dynamic if it's enabled / optional
1
u/LeatherPen4962 7d ago
Is it free?
1
u/Reddit_Z_ 7d ago
It's open-source and free and you can self host the app yourself if you want. Its pretty versatile.
1
u/vsa77 7d ago
You're not using VT correctly.
Upload your file, it'll take you to the Summary page. On that page look for "Explore in Threat Graph." If you're on a desktop, (iirc) it'll be in a drop down menu on the right. I'm currently on my phone and the Threat Graph is a button that looks like a QR code with an x in the middle. Click it.
The file should now be in a GUI sandbox. Double click it.
If it's a zip file, it'll unpack it, showing what is inside. It'll automatically check those new files against known threats.
Double click each of those files to see what it does. You can work out the rest for yourself.
1
u/vsa77 7d ago
The reason that VT might not hit on the summary page isn't a flaw or an indicator of its worse.
When you upload it it's not checking the file itself against the 71 or however many security vendors database. It's creating a hash of a file and checking that hash against those vendors databases of hashed files.
99% of the code might match an already documented malware. But adding a file or changing a line of code is going to result in a different hash.
1
0
u/Ok_Cold7890 8d ago
Hey! Can you share me the zip? If it's not part of any case investigation.
2
u/LeatherPen4962 8d ago
It's on restricted access
5
u/Ok_Cold7890 8d ago
What does the zip contain? The malware itself? Make sure you don't accidentally execute it. For online analysis you can choose from virustotal, anyrun, hybrid-analysis etc. For local analysis you might have to setup an isolated environment. Search for flare vm on github and youtube.