New Horizons
Project Management Academy
Six Sigma Online
TCM Security
TRACOM
Velopi
Watermark Learning
Login
Practical Malware Analysis & Triage
Arm yourself with knowledge and bring the fight to the bad guys. Learn the state of the art of malware analysis and reverse engineering.
Training for a team or organization? Contact us about group access.
Inside the Course
Scroll down to explore the skills you’ll build, the techniques you’ll master, and the requirements to get started.
-
Difficulty: Intermediate
-
Duration: 11h
-
Access: Included in Membership
Overview
Arm yourself with knowledge and bring the fight to the bad guys! Practical Malware Analysis & Triage (PMAT) brings the state of the art of malware analysis to you in engaging instructional videos and custom-made, practical labs.
Welcome to Practical Malware Analysis & Triage. I’m Matt, aka HuskyHacks, and I’m excited to be your instructor for this course. I had a blast putting it together and I hope that you will come along with me and learn the art of splicing, slicing, inspecting, and dissecting malware samples.
Featuring two malware analysis lab build options: local virtual machines and a rapid-deployable cloud malware analysis network! Learn how to spin up a malware analysis network on AWS from anywhere in the world!
Why take this Course?
This course is centered on practical labs that bring malware samples to bear in a safe, controlled environment.
First, you will learn to handle malware safely and construct an isolated lab environment. Then, you will learn the basics of malware analysis on samples designed to teach you the core analysis concepts. As the labs progress, the level of offensive tradecraft employed by these samples grows.
By the end of the course, you’ll be using automated workflows and advanced analysis to extract key facts about real-world specimens.
Finally, and most importantly, you’ll learn the keys to writing detection rules and triage reports to tell the world what you have learned.
What Will I Receive?
- Access to the student-only channel on Discord to receive support from the instructor and other students.
- Access to 9+ hours of engaging, instructional video content.
- Access to the PMAT Lab repository containing dozens of malware samples designed to teach you the fundamentals.
- Course completion certificate.
Objectives
Safely Handle Malware:
- Build good habits for handling malware safely and create an analysis lab.
Safe Malware Sourcing:
- Learn where to source malware samples safely (no need for the dark web!).
Basic Analysis :
- Learn basic analysis methodology, including interpreting strings, inspecting Windows API calls, identifying packed malware, and discovering host-based signatures. Then, detonate malware to collect network signatures and identify malicious domains and second-stage payloads!
Intro to the x86 Assembly Language:
- Learn the foundations of x86 Assembly and use it to perform advanced analysis.
Advanced Malware Analysis:
- Use sophisticated tools like Cutter and x32dbg to discover key insights about malware samples at the lowest possible level. Control the execution flow of a program and manipulate its low-level instructions in a debugger.
Binary Patching & Anti-Analysis:
- Learn the crafty practice of patching binaries at the ASM level to alter the flow of their programs. Then, learn to identify and defeat anti-analysis techniques.
What the Shell?:
- Learn to identify and carve out embedded shellcode.
Off Script:
- Identify scripted, obfuscated malware delivery techniques that use PowerShell and Visual Basic Script.
Reverse Engineering:
- Decompile and reverse engineer C# assemblies and learn about reverse engineering the .NET Framework! Then, reverse engineer an encrypted malware C2 dropper back to near-perfect original source code with DNSpy!
Go Time:
- Learn the analysis considerations of malware written in Go.
Get Mobile!:
- Use MobSF to reverse engineer malicious Android applications.
The Bossfight!:
- Use everything you have learned to do a full analysis of one of the most infamous malware samples in history.
Automating the Process:
- Use Jupyter Notebooks and malware sandboxes to automate the analysis process.
Tell the World!:
- Write YARA rules to aid in the detection of malware samples and learn how to write effective analysis reports to publish findings.
System Requirements
- For a local lab build, you need:
- A computer that:
- Has at least 6GB of available RAM.
- Has at least 40GB of available storage.
- Can run Oracle VirtualBox and host two lab virtual machines at the same time (with the option to host a third for additional development).
- Has an internet connection.
- For a cloud malware analysis lab, you need:
- An AWS account and a way to pay for AWS resource utilization.
- Knowledge of x86 Assembly and other low level computer programming concepts is not required.
Prerequisites
- Basic IT knowledge.
- Knowledge of the general classes of malware (virus, trojan, worm, etc). Knowledge of how these malware classes function on the technical level is not required.
- Comfort in the command line of Linux and Windows. All tools and techniques taught in the course are explained step-by-step but working knowledge of Bash and the Windows command prompt is recommended.
Recommended For
- IT professionals of all skill levels who are looking to gain foundational knowledge of malware analysis.
- Network defenders looking to deepen their knowledge of the state of the art of malware analysis.
- Penetration Testers/Red Teamers looking to pick up the skill of malware analysis to increase tradecraft/provide higher threat emulation fidelity.
- Anyone who wants to learn an in-demand skill set and bring the fight to the bad guys!
Course Curriculum
-
Course Introduction
- Hey, thanks!
- Whoami & Course Overview
- Course Discord Information
- Course FAQ
-
Safety Always! Building Your Malware Analysis Lab & Malware Safety
- Lab Network Options: Local VMs vs. AWS Cloud Lab
- Downloading VirtualBox
- Downloading Windows 10
- Setting Up the Windows 10 VM
- Downloading REMnux
- Installing REMnux
- Installing FLARE-VM
- Analysis Network Setup
- INetSim Setup
- Host-only Safety & Internal Networks
- Lab VM Repo Link
- Rapid-deployable Cloud Malware Analysis Lab Setup
- Course Lab Repo Link
- Course Lab Repo Download & Lab Orientation
- Taking a Snapshot Before First Detonation
- Detonating Our First Sample
- Tool Troubleshooting
- Course Tool List & Resources
- Basic Malware Handling
- Safe Malware Sourcing & Additional Resources
-
Basic Static Analysis
- Hashing Malware Samples
- Malware Repositories: VirusTotal
- Strings & FLOSS: Static String Analysis
- Analyzing the Import Address Table
- Introduction to the Windows API
- MalAPI.io
- To Pack Or Not To Pack: Packed Malware Analysis
- Combining Analysis Methods: PEStudio
- Identifying Malware Capabilities & Intro to MITRE ATT&CK
- Note Review
-
Basic Dynamic Analysis
- Basic Dynamic Analysis Intro: Host and Network Indicators
- Initial Detonation & Triage: Hunting for Network Signatures
- Host-Based Indicators: Procmon Part I
- Host-Based Indicators: Procmon Part II
- Dynamic Analysis of Unknown Binaries Part I: Analyzing Wireshark
- Dynamic Analysis of Unknown Binaries Part II: Host-Based Indicators
- Analyzing a Reverse Shell Part I: Correlating IOCs
- Analyzing a Reverse Shell Part II: Parent-Child Process Analysis
-
Challenge 1: SillyPutty
- Challenge 1: SillyPutty Intro
- Challenge 1: SillyPutty Walkthrough
-
Advanced Static Analysis: Assembly Language, Decompiling, & Disassembling Malware
- Intro to Advanced Analysis & Assembly Language
- Disassembling & Decompiling a Malware Dropper: Intro to Cutter
- x86 CPU Instructions, Memory Registers, & the Stack: A Closer Look
- Revisiting the Dropper: Assembly Instructions and the Windows API
- Hello, World! Under a Microscope Part I
- Advanced Analysis of a Process Injector
-
Advanced Dynamic Analysis: Debugging Malware
- Getting Comfortable in x32dbg: Flow Control & Breakpoints
- Debugging the Dropper: Dynamic Analysis of x86 Instructions & API Calls
- Hello, World! Under a Microscope Part II
- Unpacking by Debugging
-
Challenge 2: SikoMode
- Challenge 2: SikoMode Intro
- Challenge 2: SikoMode Walkthrough
- Bonus Lecture: Live Analysis of Challenge 2 SikoMode Twitch Stream with Taggart
-
Binary Patching & Anti-analysis
- Patch it out: Patching x86 Binaries
- Identifying & Defeating Anti-analysis Techniques
-
Specialty Malware Classes
- Specialty Malware Classes
-
Gone Phishing: Maldoc Analysis
- Analyzing Excel Maldocs: OLEdump
- Analyzing Word Maldocs: Remote Template Macro Injection
-
What The Shell? Shellcode Analysis
- Analyzing Shellcode: Carving Shellcode & scdbg
- Carving Shellcode from Memory
-
Off-Script: Scripted Malware Delivery Mechanisms
- PowerShell: Analyzing Obfuscated Scripts
- PowerShell Analysis with Script Block Logging & Module Logging
- VBScript: Analyzing a Multi-Stage MSBuild Dropper
- HTML Applications (HTA): Wrapped Payloads, Scripted Delivery, & WMI
-
Stay Sharp: Reversing C# Malware
- Intro to Reversing C# & the .NET Framework
- Reversing an Encrypted C2 Dropper DLL with dnSpy
-
Go Time: Analyzing Go Malware
- Programming Language Recognition & Analyzing a Go Service Backdoor
-
Get Mobile! Mobile Malware Analysis
- Lab Update: Installing MobSF
- Intro to MobSF
-
The Bossfight! Analyzing Real-World Malware Samples
- WannaCry.exe Introduction
- WannaCry.exe Walkthrough
-
Automation: Sandboxes & Pipelines
- BlueJupyter: Automating Triage with Jupyter Notebooks
- Any.Run: Malware Sandboxing
- Advanced Script Analysis with ChatGPT
-
Tell The World: Rule Writing & Report Publishing
- Writing YARA Rules
- Detecting Malware with YARA
- Writing & Publishing a Malware Analysis Report
-
Course Final
- Course Final
-
Course Conclusion
- Congrats! Course Outro
- Learning Objectives
- A new challenger approaches… PMRP!
- Feedback Form
This Course Is Included in Your All-Access Membership
One membership gives you ongoing access to Practical Malware Analysis & Triage, every other paid Academy course, and an active community of learners and mentors in Discord.
INSTRUCTORS
Meet Your Instructor
Learn from industry experts with real-world cybersecurity experience.
Matt Kiely
Matt Kiely (HuskyHacks) is a seasoned practitioner with 10 years of experience in IT and cybersecurity. Matt has worked as a Lead Cybersecurity Analyst at the Massachusetts Institute of Technology Lincoln Laboratory Space Research Division, Red Team Operator & Exploit Developer at a large financial institution, Principal Cybersecurity Content Architect & Instructor at SimSpace, and served as a United States Marine.
Matt holds a Bachelor of Science in Information Technology from Northeastern University and a Graduate Certificate in Cybersecurity from the Rochester Institute of Technology. Some of Matt’s professional certifications include OSCP, eCPPT, eCPTX, CRTO, and CRTP.
Prepare for the Practical Malware Research Professional (PMRP) Exam
The PMRP certification will put the student in the shoes of an enterprise-level malware researcher who must identify, report on, and remediate malware.
Pair the Practical Malware Analysis & Triage course with the PMRP exam to validate your skills with a recognized credential.
FAQS
Common Questions
Here are a couple of our most commonly asked questions, contact us if you don’t find an answer!
Can I get a refund if I'm unhappy with my purchase?
Yes. All courses come with a 24-hour money-back guarantee.
Will I receive a certificate of completion when I finish a course?
Yes. All courses come with a certificate of completion.
Do the courses count as Continuing Education Units (CEUs)?
Yes. Every certificate of completion comes with the total CEUs earned listed on the certificate.
What is the All-Access Membership?
As of July 1st, 2023 TCM Academy transitioned to a monthly subscription model, where you now receive full access to all of the courses on our platform for as long as your subscription remains active.
What if you already own courses on TCM Academy?
If you already own a course on our platform, you will continue to own that course. Previously owned courses will not be affected by this change.
I can see the course, but it won’t load or play. What should I do?
We use Cloudflare to protect our course platform and unfortunately, it does not play nice with VPNs. If you are experiencing issues, turn off your VPN and try again. If that does not solve the issue, please contact our support team at support@tcm-sec.com and we will help you out.
This course is included in our All-Access Membership, starting at $29.99/month.
Get full access to this course and our full course catalog when you enroll in our All-Access Membership.
RELATED COURSES
Continue Your Learning Path
Explore related courses that expand on the skills covered here.
Detection Engineering for Beginners
Practical Malware Analysis & Triage
Practical Security Fundamentals
Ready to level up your Cybersecurity Career?
Get unlimited access to every TCM Security Academy course, hands-on lab, and certification pathway with an All-Access Membership. Learn at your own pace, build real-world skills, and take the next step toward a career in cybersecurity.
