Dynamic Analysis: Process & File Monitoring

Crossing the Line: From Reading to Running

In Lessons 11.1 and 11.2, you examined malware without letting it execute — dissecting PE structure, extracting strings, computing hashes, analyzing imports, and detecting packers. Static analysis answered "what is this file made of?" Now you need to answer a different question: "What does this file do when it runs?"

Dynamic analysis means executing malware in a controlled environment and observing its behavior in real time. You watch what processes it creates, what files it drops, what registry keys it modifies, what network connections it makes, and what persistence mechanisms it installs.

The Analysis Environment

Before executing anything, your environment must be properly configured. The goal is maximum observability with zero escape risk.

Click to enlarge

Isolation Requirements

Network Simulation

Malware that cannot reach its C2 server often behaves differently — it may crash, sleep indefinitely, or skip payload delivery. Network simulation tools respond to malware's network requests with fake responses:

# INetSim — simulates HTTP, HTTPS, DNS, SMTP, FTP, and more
sudo inetsim

# FakeNet-NG (Windows) — intercepts and responds to all network traffic
FakeNet.exe

Process Monitor (Procmon): Seeing Everything

Process Monitor from Sysinternals is the single most powerful dynamic analysis tool for Windows malware. It captures every file system operation, registry access, network connection, process creation, and thread activity in real time — with microsecond precision.

Setting Up Procmon for Malware Analysis

The challenge with Procmon is volume: a typical Windows system generates thousands of events per second. Without filtering, you drown in noise. The key is setting up filters before executing the malware.

Essential Procmon filters for malware analysis:

Click to enlarge

Procmon Analysis Workflow

Step 1: Configure filters — Add the malware's process name as a primary filter. Include child process names as you discover them.

Step 2: Start capture — Press Ctrl+E to begin capturing. Minimize Procmon (some malware detects monitoring tools by window title).

Step 3: Execute the malware — Run the sample and wait 2-5 minutes for initial behavior. Some malware has delayed execution (sleeps before acting).

Step 4: Analyze by category:

File System Activity:
  - Look for: WriteFile operations to Temp, AppData, ProgramData, System32
  - Significance: Dropped payloads, configuration files, log files

Registry Activity:
  - Look for: RegSetValue to Run keys, Services, Scheduled Tasks
  - Significance: Persistence mechanisms

Process Activity:
  - Look for: Process Create events, especially spawning cmd.exe, powershell.exe, or system utilities
  - Significance: Lateral execution, living-off-the-land techniques

Network Activity:
  - Look for: TCP Connect, UDP Send operations
  - Significance: C2 communication, data exfiltration

Step 5: Save the log — File → Save to PML format for later reference and team sharing.

Procmon on Linux: Alternative Tools

Linux does not have a direct Procmon equivalent, but you can achieve similar observability with multiple tools:

# strace — trace system calls (file, network, process operations)
strace -f -e trace=file,network,process -o trace.log ./suspicious_binary

# sysdig — system-level visibility (modern alternative)
sudo sysdig proc.name=suspicious_binary

# inotifywait — monitor file system changes in real time
inotifywait -r -m /tmp /var/tmp /home --format '%T %w%f %e' --timefmt '%H:%M:%S'

Process Explorer: Deep Process Inspection

While Procmon captures events over time, Process Explorer gives you a live view of the current system state — process trees, loaded DLLs, open handles, network connections, and thread details.

What to Look For

Process Tree Anomalies:

DLL Inspection:

Process Explorer's lower pane (View → Lower Pane View → DLLs) shows every DLL loaded by the selected process:

• Unsigned DLLs in system processes = potential DLL injection or side-loading
• DLLs loaded from unusual paths (Temp, Downloads, AppData) = suspicious
• DLLs without version information = non-standard, possibly malicious

Handle Analysis:

Handles reveal what resources a process has open:

• Open file handles to other executables = possible file manipulation or payload staging
• Mutexes with specific names = malware often creates named mutexes to prevent multiple instances
• Registry key handles to Run keys or Services = active persistence installation

Verify Image Signatures

Process Explorer can verify digital signatures for every running process (Options → Verify Image Signatures). Legitimate Windows processes and signed applications show "Verified" — unsigned processes or those with invalid signatures warrant investigation.

Autoruns: Persistence Detection

Autoruns from Sysinternals is the definitive tool for enumerating all persistence mechanisms on a Windows system. It checks over 40 locations where programs can configure themselves to run during startup or login.

Autoruns Analysis for Malware

Before execution baseline:

1. Run Autoruns
2. File → Save (autorunsc.exe -a * -c > baseline.csv for CLI)
3. This captures legitimate autorun entries before malware modifies anything

After execution comparison:

1. Run Autoruns again
2. File → Compare → select baseline
3. New entries highlighted in green = installed by the malware

File System Monitoring

Beyond Procmon's file system filters, you can monitor file system changes using dedicated tools:

Windows:

# Capture a baseline directory listing before execution
Get-ChildItem -Recurse C:\Users\analyst\ | Select FullName, Length, LastWriteTime > baseline.txt

# After execution, compare
$before = Import-Csv baseline.txt
$after = Get-ChildItem -Recurse C:\Users\analyst\ | Select FullName, Length, LastWriteTime
Compare-Object $before $after -Property FullName

Linux:

# Before execution
find /tmp /var/tmp /home -type f > baseline_files.txt

# After execution
find /tmp /var/tmp /home -type f > after_files.txt
diff baseline_files.txt after_files.txt

Common drop locations to monitor:

Process Injection Indicators

Process injection is one of the most important behaviors to detect during dynamic analysis. Malware injects code into legitimate processes to evade detection — the malicious activity appears to come from a trusted process.

Red Flags During Dynamic Observation

Common Injection Techniques to Watch For

Building a Behavioral Profile

The goal of dynamic analysis is not just to list observations — it is to build a structured behavioral profile that describes what the malware does, step by step. This profile becomes the foundation for detection rules, incident response playbooks, and threat intelligence reports.

Behavioral Profile Template

SAMPLE: [filename] | SHA256: [hash]
EXECUTION ENVIRONMENT: [OS, tools, network config]

1. INITIAL EXECUTION
   - Parent process: [what launched it]
   - Immediate actions: [first 30 seconds]
   - Anti-analysis checks: [debugger detection, VM detection, sleep calls]

2. FILE SYSTEM ACTIVITY
   - Files created: [path, purpose]
   - Files modified: [path, what changed]
   - Files deleted: [self-deletion, log wiping]

3. REGISTRY MODIFICATIONS
   - Persistence: [Run keys, services, scheduled tasks]
   - Configuration: [stored C2 addresses, encryption keys]

4. PROCESS ACTIVITY
   - Child processes spawned: [cmd, powershell, other tools]
   - Process injection targets: [explorer.exe, svchost.exe, etc.]
   - Living-off-the-land binaries (LOLBins): [certutil, bitsadmin, mshta]

5. NETWORK ACTIVITY
   - DNS queries: [domains resolved]
   - HTTP/HTTPS connections: [C2 servers, download URLs]
   - Beaconing pattern: [interval, jitter]

6. PERSISTENCE MECHANISMS
   - Method: [registry, service, scheduled task, startup folder]
   - Location: [specific key/path]
   - Survives reboot: [yes/no, tested]

7. DEFENSE EVASION
   - Anti-analysis: [techniques detected]
   - Timestomping: [file timestamp manipulation]
   - Log clearing: [event log deletion]

Safe Analysis Practices

Key Takeaways

• Dynamic analysis executes malware in a controlled environment to observe runtime behavior — it answers questions static analysis cannot
• Isolation is non-negotiable: VM-based, snapshot-capable, network-simulated, no shared folders or clipboard
• Process Monitor (Procmon) captures every file, registry, network, and process operation with microsecond precision — filter before executing to manage volume
• Process Explorer provides real-time inspection of process trees, DLLs, handles, and memory — essential for detecting injection and anomalous parent-child relationships
• Autoruns enumerates all persistence locations — compare before/after snapshots to identify exactly what the malware installed
• Process injection manifests as unusual parent-child relationships, RWX memory regions, threads from non-image addresses, and hollow processes
• Build a structured behavioral profile covering execution, file system, registry, process, network, persistence, and evasion — this profile drives detection rules and incident response
• Safe practices include clean snapshots, isolated networking, dedicated hardware, session time limits, and real-time documentation

What's Next

You have now observed what malware does to the local system — processes spawned, files dropped, registry modified, persistence installed. But malware does not operate in isolation. In Lesson 11.4, you will turn to the network side of dynamic analysis: capturing and analyzing C2 traffic, DNS beaconing patterns, data exfiltration channels, and registry manipulation in depth — completing the full behavioral picture that drives your detection engineering and incident response.