Analysing a Malware Sample on ANY.RUN
Last updated
Last updated
This guide provides step-by-step instructions on how to analyze a malware sample on ANY.RUN. By following these steps, users can navigate the platform, search for existing malware samples, view connections and network traffic, collect IOCs, and gather more information about the threat.
Go to ANY.RUN.
Click "Public tasks" to view the public directory and submissions from the community.
Click here to filter by tag, hash, or other IOCs. This method allows us to quickly analyze existing malware samples instead of setting up our own sandbox.
Search for any malware sample listed in the public directory. In this case, we are using the ransomware "lockbit".
Click on the sample references as malicious and matching the tag "lockbit". In this case, we are selecting the first sample in the list, referencing a .onion link.
The "Connections" tab allows you to view connections to and from this host during the sample analysis. This provides a holistic view of processes, ports, and traffic.
The "DNS Requests" tab provides a holistic view of connections to domains and their resolved IP(s).
The "Threats" tab provides a view of the specific processes and known threats associated with these.
The "IOC" tab provides a summary of the detected Indicators of Compromise.
You can drill down into individual processes in order of execution using the "Processes" tab on the right-hand side.
Alternatively, a graphical representation of the list of processes can be viewed using the "Graph" button.
More details can be viewed by clicking on the process.
Reverting back to the list view, you can also view child processes spawned in the list.
The third process spawned in this sample is chrome.exe with the tag "lockbit" indicating that this process may be the execution stage of the attack.
If we click "More Info", we can view the command line arguments performed by the system to launch this process and more details on the process executed.
Using the ChatGPT3.5 integration, we can view a summary of what is going on. While this may not be 100% accurate, it can help provide an initial understanding of the attack story.
Optionally, a JSON export of this ChatGPT summary report can be downloaded.
Finally, a detailed text report can be downloaded from the browser by clicking on the text report button.
Full analysis for this sample is located here: ANY.RUN Sample Analysis.
