Analyzing Malware Behavior with Cuckoo Sandbox

使用Cuckoo Sandbox分析恶意软件行为

When to Use

适用场景

A suspicious sample passed static analysis triage and requires behavioral observation in a controlled environment
You need to capture network traffic, file drops, registry modifications, and API calls from a malware execution
Determining the full infection chain including second-stage payload downloads and persistence mechanisms
Generating behavioral signatures and YARA rules based on observed runtime activity
Automated analysis of bulk malware samples requiring consistent reporting

Do not use when the sample is a known ransomware variant that may spread via network shares in a misconfigured sandbox; verify network isolation first.

可疑样本通过静态分析筛选后，需要在受控环境中观察其行为
需要捕获恶意软件执行过程中的网络流量、文件释放、注册表修改以及API调用
梳理完整感染链，包括第二阶段载荷下载和持久化机制
根据观测到的运行时行为生成行为特征规则和YARA规则
对批量恶意软件样本进行自动化分析并生成一致性报告

请勿使用场景：样本为已知勒索软件变种，且在配置不当的沙箱中可能通过网络共享传播；使用前需先验证网络隔离性。

Prerequisites

前置条件

Cuckoo Sandbox 3.x installed on a dedicated analysis server (Ubuntu 22.04 recommended)
Guest VMs configured with Windows 10/11 snapshots (Cuckoo agent installed, snapshots taken at clean state)
VirtualBox, KVM, or VMware configured as the Cuckoo virtualization backend
Isolated network with InetSim or FakeNet-NG for simulating internet services
Suricata or Snort integrated for network-level signature matching during analysis
Sufficient disk space for PCAP captures and memory dumps (minimum 500 GB recommended)

在专用分析服务器上安装Cuckoo Sandbox 3.x（推荐使用Ubuntu 22.04）
配置带有Windows 10/11快照的客户虚拟机（已安装Cuckoo agent，快照处于干净状态）
配置VirtualBox、KVM或VMware作为Cuckoo虚拟化后端
配备隔离网络，使用InetSim或FakeNet-NG模拟互联网服务
集成Suricata或Snort，用于分析过程中的网络级特征匹配
具备足够磁盘空间用于PCAP捕获和内存转储（推荐至少500 GB）

Workflow

工作流程

Step 1: Submit Sample to Cuckoo

步骤1：向Cuckoo提交样本

Submit the malware sample for automated analysis:

bash

undefined

提交恶意软件样本进行自动化分析：

bash

undefined

Submit via command line

cuckoo submit /path/to/suspect.exe

Submit with specific analysis timeout (300 seconds)

cuckoo submit --timeout 300 /path/to/suspect.exe

Submit with specific VM and analysis package

cuckoo submit --machine win10_x64 --package exe --timeout 300 /path/to/suspect.exe

Submit via REST API

curl -F "file=@suspect.exe" -F "timeout=300" -F "machine=win10_x64"
http://localhost:8090/tasks/create/file

Submit URL for analysis

curl -F "url=http://malicious-site.com/payload" -F "timeout=300"
http://localhost:8090/tasks/create/url

Check task status

curl http://localhost:8090/tasks/view/1 | jq '.task.status'

undefined

curl http://localhost:8090/tasks/view/1 | jq '.task.status'

undefined

Step 2: Monitor Execution in Real-Time

步骤2：实时监控执行过程

Track the analysis progress and observe live behavior:

bash

undefined

跟踪分析进度并观测实时行为：

bash

undefined

Watch Cuckoo analysis log

tail -f /opt/cuckoo/log/cuckoo.log

Monitor analysis task status

cuckoo status

Access Cuckoo web interface for live screenshots and process tree

Navigate to http://localhost:8080/analysis/<task_id>/


Key behavioral events to watch during execution:
- Process creation chain (parent-child relationships)
- Network connection attempts to external IPs
- File drops in temporary directories or system folders
- Registry modifications to Run keys or service entries
- API calls related to encryption (CryptEncrypt), injection (WriteProcessMemory), or evasion


执行过程中需关注的关键行为事件：
- 进程创建链（父子进程关系）
- 对外部IP的网络连接尝试
- 在临时目录或系统文件夹中释放的文件
- 对Run键或服务项的注册表修改
- 与加密（CryptEncrypt）、注入（WriteProcessMemory）或规避相关的API调用

Step 3: Analyze Process Activity

步骤3：分析进程活动

Review the process tree and API call trace from the Cuckoo report:

python

undefined

从Cuckoo报告中查看进程树和API调用轨迹：

python

undefined

Parse Cuckoo JSON report programmatically

import json

with open("/opt/cuckoo/storage/analyses/1/reports/report.json") as f: report = json.load(f)

import json

with open("/opt/cuckoo/storage/analyses/1/reports/report.json") as f: report = json.load(f)

Process tree analysis

for process in report["behavior"]["processes"]: pid = process["pid"] ppid = process["ppid"] name = process["process_name"] print(f"PID: {pid} PPID: {ppid} Name: {name}")

# Extract suspicious API calls
for call in process["calls"]:
    api = call["api"]
    if api in ["CreateRemoteThread", "VirtualAllocEx", "WriteProcessMemory",
                "NtCreateThreadEx", "RegSetValueExA", "URLDownloadToFileA"]:
        args = {arg["name"]: arg["value"] for arg in call["arguments"]}
        print(f"  [!] {api}({args})")

undefined

for process in report["behavior"]["processes"]: pid = process["pid"] ppid = process["ppid"] name = process["process_name"] print(f"PID: {pid} PPID: {ppid} Name: {name}")

# Extract suspicious API calls
for call in process["calls"]:
    api = call["api"]
    if api in ["CreateRemoteThread", "VirtualAllocEx", "WriteProcessMemory",
                "NtCreateThreadEx", "RegSetValueExA", "URLDownloadToFileA"]:
        args = {arg["name"]: arg["value"] for arg in call["arguments"]}
        print(f"  [!] {api}({args})")

undefined

Step 4: Review Network Activity

步骤4：审查网络活动

Examine network connections, DNS queries, and HTTP requests:

python

undefined

检查网络连接、DNS查询和HTTP请求：

python

undefined

Network analysis from Cuckoo report

network = report["network"]

DNS resolutions

print("DNS Queries:") for dns in network.get("dns", []): print(f" {dns['request']} -> {dns.get('answers', [])}")

HTTP requests

print("\nHTTP Requests:") for http in network.get("http", []): print(f" {http['method']} {http['uri']} (Host: {http['host']})") if http.get("body"): print(f" Body: {http['body'][:200]}")

TCP connections

print("\nTCP Connections:") for tcp in network.get("tcp", []): print(f" {tcp['src']}:{tcp['sport']} -> {tcp['dst']}:{tcp['dport']}")

Extract PCAP for deeper Wireshark analysis

PCAP location: /opt/cuckoo/storage/analyses/1/dump.pcap

undefined

undefined

Step 5: Examine File System and Registry Changes

步骤5：检查文件系统与注册表变更

Document persistence mechanisms and dropped files:

python

undefined

记录持久化机制和释放的文件：

python

undefined

File operations

print("Files Created/Modified:") for f in report["behavior"].get("summary", {}).get("files", []): print(f" {f}")

Dropped files with hashes

print("\nDropped Files:") for dropped in report.get("dropped", []): print(f" Path: {dropped['filepath']}") print(f" SHA-256: {dropped['sha256']}") print(f" Size: {dropped['size']} bytes") print(f" Type: {dropped['type']}")

Registry modifications

print("\nRegistry Keys Modified:") for key in report["behavior"].get("summary", {}).get("keys", []): print(f" {key}")

undefined

print("\nRegistry Keys Modified:") for key in report["behavior"].get("summary", {}).get("keys", []): print(f" {key}")

undefined

Step 6: Review Signatures and Scoring

步骤6：查看特征规则与评分

Check Cuckoo's behavioral signatures and threat scoring:

python

undefined

检查Cuckoo的行为特征规则和威胁评分：

python

undefined

Behavioral signatures triggered

print("Triggered Signatures:") for sig in report.get("signatures", []): severity = sig["severity"] name = sig["name"] description = sig["description"] marker = "[!]" if severity >= 3 else "[*]" print(f" {marker} [{severity}/5] {name}: {description}") for mark in sig.get("marks", []): if mark.get("call"): print(f" API: {mark['call']['api']}") if mark.get("ioc"): print(f" IOC: {mark['ioc']}")

Overall score

score = report.get("info", {}).get("score", 0) print(f"\nOverall Threat Score: {score}/10")

undefined

score = report.get("info", {}).get("score", 0) print(f"\nOverall Threat Score: {score}/10")

undefined

Step 7: Extract Memory Dump Artifacts

步骤7：提取内存转储 artifacts

Analyze the full memory dump captured during execution:

bash

undefined

分析执行过程中捕获的完整内存转储：

bash

undefined

Memory dump is saved at:

/opt/cuckoo/storage/analyses/1/memory.dmp

Use Volatility to analyze the memory dump

vol3 -f /opt/cuckoo/storage/analyses/1/memory.dmp windows.pslist vol3 -f /opt/cuckoo/storage/analyses/1/memory.dmp windows.malfind vol3 -f /opt/cuckoo/storage/analyses/1/memory.dmp windows.netscan

undefined

vol3 -f /opt/cuckoo/storage/analyses/1/memory.dmp windows.pslist vol3 -f /opt/cuckoo/storage/analyses/1/memory.dmp windows.malfind vol3 -f /opt/cuckoo/storage/analyses/1/memory.dmp windows.netscan

undefined

Key Concepts

核心概念

Term	Definition
Dynamic Analysis	Executing malware in a controlled environment to observe runtime behavior including system calls, network activity, and file operations
Sandbox Evasion	Techniques malware uses to detect virtual/sandbox environments and alter behavior to avoid analysis (sleep timers, VM checks, user interaction checks)
API Hooking	Cuckoo's method of intercepting Windows API calls made by the malware to log function names, parameters, and return values
InetSim	Internet services simulation tool that responds to malware network requests (HTTP, DNS, SMTP) within the isolated analysis network
Process Injection	Malware technique of injecting code into legitimate processes; detected by monitoring VirtualAllocEx and WriteProcessMemory API sequences
Behavioral Signature	Rule-based detection matching specific sequences of API calls, file operations, or network activity to known malware behaviors
Analysis Package	Cuckoo module defining how to execute a specific file type (exe, dll, pdf, doc) within the guest VM for proper behavioral capture

术语	定义
Dynamic Analysis	在受控环境中执行恶意软件，观察其运行时行为，包括系统调用、网络活动和文件操作
Sandbox Evasion	恶意软件用于检测虚拟/沙箱环境并改变行为以逃避分析的技术（如睡眠计时器、虚拟机检测、用户交互检测）
API Hooking	Cuckoo拦截恶意软件发起的Windows API调用的方法，用于记录函数名称、参数和返回值
InetSim	互联网服务模拟工具，在隔离分析网络中响应恶意软件的网络请求（HTTP、DNS、SMTP等）
Process Injection	恶意软件将代码注入合法进程的技术；通过监控VirtualAllocEx和WriteProcessMemory API序列可检测该行为
Behavioral Signature	基于规则的检测方式，匹配特定的API调用序列、文件操作或网络活动，以识别已知恶意软件行为
Analysis Package	Cuckoo模块，定义如何在客户虚拟机中执行特定文件类型（exe、dll、pdf、doc），以正确捕获行为

Tools & Systems

工具与系统

Cuckoo Sandbox: Open-source automated malware analysis system providing behavioral reports, network captures, and memory dumps
InetSim: Internet services simulation suite providing fake HTTP, DNS, SMTP, and other services for isolated malware analysis networks
FakeNet-NG: FLARE team's network simulation tool that intercepts and redirects all network traffic for analysis
Suricata: Network IDS/IPS integrated with Cuckoo for real-time signature-based detection of malicious network traffic
Volatility: Memory forensics framework used to analyze memory dumps captured during Cuckoo analysis

Cuckoo Sandbox: 开源自动化恶意软件分析系统，可提供行为报告、网络捕获和内存转储
InetSim: 互联网服务模拟套件，为隔离恶意软件分析网络提供伪造的HTTP、DNS、SMTP等服务
FakeNet-NG: FLARE团队开发的网络模拟工具，可拦截并重定向所有网络流量以进行分析
Suricata: 网络IDS/IPS，与Cuckoo集成用于实时检测恶意网络流量的特征匹配
Volatility: 内存取证框架，用于分析Cuckoo分析过程中捕获的内存转储

Common Scenarios

常见场景

Scenario: Analyzing a Multi-Stage Dropper

场景：分析多阶段投放器

Context: Static analysis reveals a packed executable with minimal imports and high entropy. The sample needs sandbox execution to observe unpacking, payload delivery, and C2 establishment.

Approach:

Submit sample to Cuckoo with extended timeout (600 seconds) to capture slow-acting behavior
Review process tree for child process creation (dropper spawning payload processes)
Identify dropped files in %TEMP%, %APPDATA%, or system directories
Extract dropped files and compute hashes for separate analysis
Map network connections to identify C2 infrastructure contacted after initial execution
Check for persistence mechanisms (Run keys, scheduled tasks, services) in registry modifications
Compare behavioral signatures against known malware families

Pitfalls:

Using insufficient analysis timeout causing the sandbox to terminate before second-stage payload executes
Not configuring InetSim to respond to DNS and HTTP requests, preventing the malware from progressing past C2 check-in
Ignoring sandbox evasion detections; if the sample exits immediately, it may be detecting the virtual environment
Not analyzing dropped files separately; the initial dropper may be less interesting than the final payload

背景：静态分析发现一个加壳可执行文件，导入项极少且熵值很高。需要通过沙箱执行来观察其脱壳、载荷交付和C2建立过程。

方法:

向Cuckoo提交样本并设置延长超时时间（600秒），以捕获慢动作行为
查看进程树，寻找子进程创建（投放器生成载荷进程）
识别在%TEMP%、%APPDATA%或系统目录中释放的文件
提取释放的文件并计算哈希值，以便单独分析
梳理网络连接，识别初始执行后联系的C2基础设施
检查注册表修改中的持久化机制（Run键、计划任务、服务）
将行为特征规则与已知恶意软件家族进行对比

注意事项:

分析超时时间不足，导致沙箱在第二阶段载荷执行前终止
未配置InetSim响应DNS和HTTP请求，导致恶意软件无法完成C2校验步骤
忽略沙箱规避检测；若样本立即退出，可能是检测到了虚拟环境
未单独分析释放的文件；初始投放器可能不如最终载荷有分析价值

Output Format

输出格式

DYNAMIC ANALYSIS REPORT - CUCKOO SANDBOX
==========================================
Task ID:          1547
Sample:           suspect.exe (SHA-256: e3b0c44298fc1c149afbf4c8996fb924...)
Analysis Time:    300 seconds
VM:               win10_x64 (Windows 10 21H2)
Score:            8.5/10

PROCESS TREE
suspect.exe (PID: 2184)
  └── cmd.exe (PID: 3456)
      └── powershell.exe (PID: 4012)
          └── svchost_fake.exe (PID: 4568)

FILE SYSTEM ACTIVITY
[CREATED]  C:\Users\Admin\AppData\Local\Temp\payload.dll
[CREATED]  C:\Windows\System32\svchost_fake.exe
[MODIFIED] C:\Windows\System32\drivers\etc\hosts

REGISTRY MODIFICATIONS
[SET] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\Windows\System32\svchost_fake.exe"
[SET] HKLM\SYSTEM\CurrentControlSet\Services\FakeService\ImagePath = "C:\Windows\System32\svchost_fake.exe"

NETWORK ACTIVITY
DNS:    update.malicious[.]com -> 185.220.101.42
HTTP:   POST hxxps://185.220.101[.]42/gate.php (beacon)
TCP:    10.0.2.15:49152 -> 185.220.101.42:443 (237 connections)

BEHAVIORAL SIGNATURES
[!] [4/5] injection_createremotethread: Injects code into remote process
[!] [4/5] persistence_autorun: Modifies Run registry key for persistence
[!] [3/5] network_cnc_http: Performs HTTP C2 communication
[*] [2/5] antiav_detectfile: Checks for antivirus product files

DROPPED FILES
payload.dll    SHA-256: abc123... Size: 98304  Type: PE32 DLL
svchost_fake.exe SHA-256: def456... Size: 184320 Type: PE32 EXE

DYNAMIC ANALYSIS REPORT - CUCKOO SANDBOX
==========================================
Task ID:          1547
Sample:           suspect.exe (SHA-256: e3b0c44298fc1c149afbf4c8996fb924...)
Analysis Time:    300 seconds
VM:               win10_x64 (Windows 10 21H2)
Score:            8.5/10

PROCESS TREE
suspect.exe (PID: 2184)
  └── cmd.exe (PID: 3456)
      └── powershell.exe (PID: 4012)
          └── svchost_fake.exe (PID: 4568)

FILE SYSTEM ACTIVITY
[CREATED]  C:\Users\Admin\AppData\Local\Temp\payload.dll
[CREATED]  C:\Windows\System32\svchost_fake.exe
[MODIFIED] C:\Windows\System32\drivers\etc\hosts

REGISTRY MODIFICATIONS
[SET] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\Windows\System32\svchost_fake.exe"
[SET] HKLM\SYSTEM\CurrentControlSet\Services\FakeService\ImagePath = "C:\Windows\System32\svchost_fake.exe"

NETWORK ACTIVITY
DNS:    update.malicious[.]com -> 185.220.101.42
HTTP:   POST hxxps://185.220.101[.]42/gate.php (beacon)
TCP:    10.0.2.15:49152 -> 185.220.101.42:443 (237 connections)

BEHAVIORAL SIGNATURES
[!] [4/5] injection_createremotethread: Injects code into remote process
[!] [4/5] persistence_autorun: Modifies Run registry key for persistence
[!] [3/5] network_cnc_http: Performs HTTP C2 communication
[*] [2/5] antiav_detectfile: Checks for antivirus product files

DROPPED FILES
payload.dll    SHA-256: abc123... Size: 98304  Type: PE32 DLL
svchost_fake.exe SHA-256: def456... Size: 184320 Type: PE32 EXE

analyzing-malware-behavior-with-cuckoo-sandbox

Original

Translation

Analyzing Malware Behavior with Cuckoo Sandbox

使用Cuckoo Sandbox分析恶意软件行为

When to Use

适用场景

Prerequisites

前置条件

Workflow

工作流程

Step 1: Submit Sample to Cuckoo

步骤1：向Cuckoo提交样本

Submit via command line

Submit via command line

Submit with specific analysis timeout (300 seconds)

Submit with specific analysis timeout (300 seconds)

Submit with specific VM and analysis package

Submit with specific VM and analysis package

Submit via REST API

Submit via REST API

Submit URL for analysis

Submit URL for analysis

Check task status

Check task status

Step 2: Monitor Execution in Real-Time

步骤2：实时监控执行过程

Watch Cuckoo analysis log

Watch Cuckoo analysis log

Monitor analysis task status

Monitor analysis task status

Access Cuckoo web interface for live screenshots and process tree

Access Cuckoo web interface for live screenshots and process tree

Navigate to http://localhost:8080/analysis/<task_id>/

Navigate to http://localhost:8080/analysis/<task_id>/

Step 3: Analyze Process Activity

步骤3：分析进程活动

Parse Cuckoo JSON report programmatically

Parse Cuckoo JSON report programmatically

Process tree analysis

Process tree analysis

Step 4: Review Network Activity

步骤4：审查网络活动

Network analysis from Cuckoo report

Network analysis from Cuckoo report

DNS resolutions

DNS resolutions

HTTP requests

HTTP requests

TCP connections

TCP connections

Extract PCAP for deeper Wireshark analysis

Extract PCAP for deeper Wireshark analysis

PCAP location: /opt/cuckoo/storage/analyses/1/dump.pcap

PCAP location: /opt/cuckoo/storage/analyses/1/dump.pcap

Step 5: Examine File System and Registry Changes

步骤5：检查文件系统与注册表变更

File operations

File operations

Dropped files with hashes

Dropped files with hashes

Registry modifications

Registry modifications

Step 6: Review Signatures and Scoring

步骤6：查看特征规则与评分

Behavioral signatures triggered

Behavioral signatures triggered

Overall score

Overall score

Step 7: Extract Memory Dump Artifacts

步骤7：提取内存转储 artifacts

Memory dump is saved at:

Memory dump is saved at:

/opt/cuckoo/storage/analyses/1/memory.dmp

/opt/cuckoo/storage/analyses/1/memory.dmp

Use Volatility to analyze the memory dump

Use Volatility to analyze the memory dump

Key Concepts

核心概念

Tools & Systems