Each phase maps to a module in this course. Scroll to see how the curriculum builds, module by module.
1Introduction to Malware & Analysis Environments
- •Malware taxonomy by capability: ransomware, stealers, RATs, loaders, bots
- •Anatomy of a modern infection chain: dropper → loader → payload → persistence → C2
- •Professional analysis workflow: static triage → dynamic execution → correlation → documentation
- •Lab setup: FLARE-VM + REMnux, safe sample handling, snapshots, and evidence traceability
- •Core tools overview: Sysinternals, Procmon, Process Explorer, FakeNet-NG, Wireshark, CAPA, VirusTotal
- •Module theory exam
Initial Static Analysis
- •Analyzing samples without execution: PE structure, sections, entropy, imports, resources, and strings
- •Early detection of packing and obfuscation with DIE, PEStudio, and PEview
- •Extracting stable IOCs: hashes, domains, file paths, mutexes, configuration artifacts
- •Triage with strings, FLOSS, and CAPA for behavioral capability mapping
- •Prioritizing findings: separating noise from actionable indicators
- •Building initial YARA-based detection rules for hunting
- •Module exam
Basic Dynamic Analysis
- •Controlled execution workflow: snapshot → monitors → execute → filter → export → rollback
- •Process and thread observation with Procmon and Process Explorer
- •Filesystem, registry, and network monitoring (DNS, HTTP, beaconing, C2 patterns)
- •Correlating static vs. dynamic findings to confirm or discard hypotheses
- •Detecting Run keys, suspicious child processes, and anomalous Load Image events
- •Generating a brief technical timeline with exportable evidence
- •Module exam
C2 Communication & Basic Persistence
- •Command and Control fundamentals: protocols, beaconing patterns, periodicity, and telemetry
- •Reading HTTP/HTTPS and DNS traffic in malware context with Wireshark and FakeNet-NG
- •Windows persistence mechanisms: Run keys, Startup folder, ASEPs, scheduled tasks, services
- •Detecting persistence with Autoruns + validation in Regedit and Procmon events
- •Mapping findings to MITRE ATT&CK tactics: C2 and Boot/Logon Autostart Execution
- •Module exam
End-to-End Lab Case + MITRE ATT&CK Mapping
- •MITRE ATT&CK for analysts: behavior language, not ID memorization
- •Guided end-to-end case: static triage → dynamic analysis → IOC extraction → ATT&CK mapping
- •Mapping 2–4 real techniques with concrete evidence
- •Writing a reproducible mini-report: executive summary, technical findings, IOCs, ATT&CK map, defensive actions
- •HTK final certification exam
