Complete workflow
- Default sandbox first: [[re-sandbox]] (capabilities:
sandbox-setup) — to determine malicious behavior / all dynamic execution must first set up a sandbox (VM snapshot > container > firejail), network isolation (INetSim / fake DNS / offline), and only after the snapshot is ready transfer the sample. Only static triage may skip the sandbox (see [[re-analyze/platform-tips]] highest principle) - Static triage: [[re-triage]] (capabilities:
triage) — file / hash / entropy / strings, confirm the real type and architecture; entropy >7.0 means first suspect packing/encryption - Behavioral analysis: [[re-behavior]] (capabilities:
malware-behavior) — run the sample in the sandbox: process tree and injection, persistence inventory, files/registry, network connections, ATT&CK mapping - C2/protocol: [[re-protocol]] (capabilities:
network-capture、protocol-recovery、crypto-identification、crypto-decryption、key-extraction、tls-analysis) — [[re-netcap]] (capabilities:network-capture) capture callback traffic, [[re-proto-rev]] (capabilities:protocol-recovery) reconstruct the protocol state machine, [[re-crypto-id]] (capabilities:crypto-identification) / [[re-crypto-keys]] (capabilities:key-extraction) / [[re-crypto-decrypt]] (capabilities:crypto-decryption) identify and decrypt communication encryption - For packed samples switch to [[re-anti-analysis]] (capabilities:
unpack、deobfuscation、evasion-analysis; packer-id → unpack-simple/advanced): return the unpacked artifact to step 1 sandbox rerun verification, then continue behavioral analysis - IOC/report: [[re-ioc]] (capabilities:
threat-intel) — extract IOCs (hash/domain/IP/path/mutex), write YARA rules, produce according to the report structure (summary/behavior/evidence/IOC/conclusion)
Archive each step's results (evidence path + sha256, see [[re-triage]] (capabilities:triage)), for reference by the step 6 report.
When to use which atomic skill (selection tree)
Branch by objective:
- Behavior determination("will it call back" "what is it doing") → [[re-sandbox]] (capabilities:
sandbox-setup) → [[re-behavior]] (capabilities:malware-behavior) → (C2 found) [[re-protocol]] (capabilities:network-capture、protocol-recovery、crypto-identification、crypto-decryption、key-extraction、tls-analysis) → [[re-ioc]] (capabilities:threat-intel） - Configuration extraction(C2 domain/key/decryption config) → static first [[re-triage]] (capabilities:
triage; sandbox may be skipped); if packed first switch to [[re-anti-analysis]] (capabilities:unpack、deobfuscation、evasion-analysis); if the config is in memory then [[re-memdump]] (capabilities:memory-dump); if runtime is needed enter [[re-sandbox]] (capabilities:sandbox-setup) + [[re-behavior]] (capabilities:malware-behavior） - Family identification("which family" "whether known malicious") → [[re-triage]] (capabilities:
triage) hash/string comparison against known libraries → [[re-ioc]] (capabilities:threat-intel) write YARA verification; behavioral corroboration goes through [[re-behavior]] (capabilities:malware-behavior） - Static logic deep dive (does not involve execution) → switch to [[re-binary-core]] (capabilities:
decompilation、debugging、memory-dump、elf-parser、pe-parser、macho-parser) domain ([[re-ghidra]] (capabilities:decompilation、debugging) / [[re-ida]] (capabilities:decompilation、debugging) / [[re-radare2]] (capabilities:decompilation）） - Ransomware sample(encrypted files/ransom note/decryption recovery) → [[re-ransomware]] (capabilities:
malware-behavior、crypto-identification; crypto identification goes through the crypto domain, C2 interaction goes through [[re-protocol]] (capabilities:network-capture、protocol-recovery、crypto-identification、crypto-decryption、key-extraction、tls-analysis）） - Loader/Dropper(multi-layer download/in-memory loading/module stitching) → [[re-loader]] (capabilities:
malware-behavior; sandbox + [[re-tracing]] (capabilities:tracing) + [[re-memdump]] (capabilities:memory-dump）） - Fileless sample(no disk writes/in-memory execution/PowerShell chain) → [[re-fileless]] (capabilities:
malware-behavior; [[re-sandbox]] (capabilities:sandbox-setup) + [[re-memdump]] (capabilities:memory-dump) + [[re-script-deob]] (capabilities:deobfuscation) combined) - Phishing attachment (PDF/Office/RTF document) → [[re-doc-malware]] (capabilities:
document-malware; document weaponization/macro chain/payload extraction) - Sample unobtainable / no disk writes / parasitic in another process(only symptoms, in-memory shell, requires on-site collection) → [[re-sample-acquire]] (capabilities:
sample-acquisition) → collection artifacts return to this gateway ([[re-fileless]] (capabilities:malware-behavior) / [[re-behavior]] (capabilities:malware-behavior））
Cross-domain joint
- Packed malware sample: [[re-malware]] → [[re-anti-analysis]] (packer-id / unpack-*), unpacked artifact returns to sandbox for re-run then behavior analysis
- C2 communication analysis: [[re-malware]] → [[re-protocol]] (netcap / proto-rev / crypto-*)
- Deep static logic → [[re-binary-core]] ([[re-ghidra]] decompilation etc.)
- Fileless/in-memory execution sample: [[re-malware]] → [[re-fileless]] (sandbox + memory dump + script decode chain reconstruction; connects with [[re-evasion]]'s AMSI/ETW countermeasures)
- This gateway is invoked by [[re-analyze]]'s triage.md "judge malicious behavior / will it call back" path (re-malware → re-sandbox → re-behavior → re-protocol → re-ioc)
Common pitfalls and traps
- Getting a sample and skipping the sandbox to run it directly → environment contamination and destruction of evidence —— sandbox by default for dynamic analysis is the highest principle (see [[re-analyze/platform-tips]])
- High entropy (>7.0) without confirming packing and forcing behavior analysis → everything observed is the packer's behavior —— first [[re-triage]] to judge, if packed switch to [[re-anti-analysis]]
- Behavior results leave no evidence (no logs/no hash) → report not reproducible —— archive each step's artifacts per the [[re-ioc]] report structure
- Running a sample without sandbox network isolation → real external connections —— first INetSim / fake DNS / disconnect network ([[re-sandbox]] network isolation step)