Overview

Static, dynamic, and sandbox analysis of three real-world malware samples to identify malicious behaviour, extract indicators of compromise (IOCs), and document adversary techniques. Findings were compiled into a formal analysis report.

Tools Used

Tool	Purpose
Ghidra	Static analysis & reverse engineering
Process Monitor	Runtime process & file system monitoring
Process Hacker	Live process inspection & memory analysis
Regshot	Registry & filesystem snapshot comparison
Wireshark	Network traffic capture & analysis

Methodology

Sample 1 — Static Analysis

Reverse engineered a Windows PE sample using Ghidra to identify malicious functionality without executing the binary. Traced decompiled function calls across execution flow, uncovering behaviours including remote registry manipulation, hidden file/process operations, credential and keystroke capture routines, screen capture capability, and a range of anti-analysis and defence evasion techniques (VM/sandbox detection, delay-loaded imports, UI/taskbar hiding, COM object abuse). IOCs were extracted directly from API calls, string artifacts, and registry paths referenced in the decompiled code, and organised into categorised tables (network activity, system modifications, registry, credential harvesting, keylogging, screen capture, defence evasion, and fake UI initialization).

Indicators of Compromise (IoCs)

Static malware analysis identified the following categories of Indicators of Compromise (IoCs), each backed by specific API calls, registry paths, or string artifacts observed during binary analysis.

Note: Static analysis has inherent limitations — behaviours gated behind runtime-resolved values (e.g. pointer/flag fields filled in only at execution) may be hidden from static review, which can introduce false positives or false negatives.

---

Network Activity IoCs

Indicator of Compromise	Brief Justification
Terminates network connections	WNetCancelConnection2W, dwFlags
Remote registry connection	RegConnectRegistryW
Remote file operations	IFileOperation

System Modifications IoCs

Indicator of Compromise	Brief Justification
Targets system directories	CSIDL
Hidden file operations	SHFileOperationW
Hidden process execution	ShellExecuteW
Malicious shortcut execution	IShellLink
File information reconnaissance	GetFileVersionInfoW

Portable Device IoCs

Indicator of Compromise	Brief Justification
Enumerates portable devices	PortableDeviceManager
Accesses multiple portable devices	PortableDeviceFTM
File copying	SHCreateStreamOnFileEx
Queries file metadata	PortableDeviceDispatchFactory
Victim profiling	PortableDeviceValues

Registry IoCs

Indicator of Compromise	Brief Justification
Force registry modifications	RegFlushKey
Reading registry	\Software\PersonalBackup64\IniPath
Writing in registry	RegSetValueExW
Saving registry hives	RegSaveKeyW
Mounting hives as registry keys	RegLoadKeyW
Deleting registry keys	RegDeleteKeyW
Immediate replacing hives	RegRestoreKey
Scheduled replacing hives	RegReplaceKey
Remote registry access	RegConnectRegistryW

Credential Harvest IoCs

Indicator of Compromise	Brief Justification
Login credential spying	TLoginCredentialService
Input field spying	FindWindowExW
Password harvesting	%password%
Username harvesting	%username%
Target task	%taskname%
Exfiltration destination	%dest%
Data compression	%zipname%
Target system directory	%sysdir%
Program path	%progpath%
Activity logging	%logfile%
Exfiltration status	%status%

Keylogging IoCs

Indicator of Compromise	Brief Justification
Installation of hook	SetWindowsHookExW
Three hook types	WH_CBT, WH_GETMESSAGE, WH_MSGFILTER
Hook relay	CallNextHookEx
Captures keyboard state	GetKeyboardState, GetKeyState
Manipulates keyboard state	ActivateKeyboardLayout
Clipboard hijacking	GetClipboardData, EmptyClipboard
Mouse cursor logging	GetCursorPos

Screen Capture IoCs

Indicator of Compromise	Brief Justification
Screen grab	GetDC
Captures bitmap	CreateCompatibleBitmap
Session activity logging	WTSRegisterSessionNotification, WTSUnRegisterSessionNotification

Defence Evasion / Anti-Analysis IoCs

Indicator of Compromise	Brief Justification
VM/Sandbox detection	NetWkstaGetInfo
Delay loading	ImgDelayDescr
COM object abusing	CoCreateInstance
Window name hiding	SetWindowTextW
Taskbar / Alt-tab hiding	SetWindowLongPtrW
UI suppression	FOF_NOCONFIRMATION
Registry deletion	RegEnumKeyW, RegDeleteKeyW
CLSID obfuscation	CoCreateInstance pointers

Fake UI Initialization IoCs

Indicator of Compromise	Brief Justification
Creates a window	CreateWindowExW, CreateMenu, CreatePopupMenu, CreateIcon
OLE initialization	OleInitialize
Windows imaging	WICImagingFactory
File dialog	IFileOpenDialog, IFileSaveDialog

Sample 2 — Dynamic Analysis

Executed a confirmed SnakeKeylogger sample (verified via MalwareBazaar) in an isolated environment to observe live behaviour. Used Process Hacker, ProcMon, Regshot, and Wireshark to monitor process activity, file system and registry changes, and network traffic in real time. Documented process hollowing into RegSvcs.exe, ZoneMap registry manipulation, credential harvesting from Chrome and Edge, and C2 communication disguised as fake Windows Update traffic, including geolocation of the C2 infrastructure.

Malware Behaviour

Malware Behaviour	Evidence
Masquerades as a PDF document	Executable uses the filename Sales Order Sheet.pdf.exe to trick users into believing it is a legitimate PDF.
Installs persistence	Creates and modifies numerous registry keys and values (199 keys added, 386 values added, 115 values modified) to maintain execution after reboot.
Steals user credentials	Identified as a credential stealer (SnakeKeylogger) targeting stored usernames and passwords.
Logs keystrokes	Dynamic analysis classifies the sample as a keylogger capable of recording keyboard input.
Performs anti-analysis techniques	Uses execution delays (Sleep) and other evasion techniques to hinder sandbox analysis.
Modifies the Windows Registry	A total of 934 registry changes were observed during execution, indicating extensive system modification.
Injects or interacts with system processes	Behaviour indicates interaction with Windows processes to execute malicious functionality while reducing detection.
Attempts lateral movement	Sandbox behaviour indicates the malware attempts to spread or interact with other systems on the network.
Maintains long-running execution	Remained active for over 11 minutes during analysis, suggesting continuous background activity.
Attempts to evade detection	Behavioural analysis detected multiple evasion techniques commonly associated with information-stealing malware.

Sample 3 — Dynamic Analysis in Online Sandbox

The third sample was submitted to Cuckoo Sandbox for automated dynamic analysis. Identified as a 32-bit Windows GUI executable, the sample returned a maximum threat score (10/10) and could not be hashed via ssdeep — an early indicator of packing or obfuscation, later confirmed by YARA rule matches for UPX and Armadillo packing. Behavioural signatures and antivirus consensus (50/57 on VirusTotal) classified the sample as a banking trojan/spyware consistent with the Zusy and BlackMoon families, exhibiting keylogging, screen capture, registry modification, private profile data access, file operations, and hooking capabilities.

Further analysis revealed the malware allocates memory with full read/write/execute permissions (PAGE_EXECUTE_READWRITE), consistent with Armadillo unpacking and executing its real payload directly in memory at runtime to evade static and signature-based detection. Metadata embedded in the binary suggests a Simplified Chinese-speaking author, though this indicator was treated with appropriate scepticism given the ease of forging or copying version resource metadata. Despite confirmed HTTP communication capability, no network activity was observed during sandbox detonation — assessed as a likely anti-analysis technique (sandbox detection or delayed execution) rather than an absence of C2 functionality.