A walkthrough of a dynamic malware analysis lab built with FLARE-VM and REMnux to observe a simulated multi-stage malware sample (walkthrough.exe) in a fully isolated environment. The investigation traces execution, registry-based persistence (via a Run key confirmed across four tools), simulated command-and-control beaconing, secondary payload retrieval, process injection into Notepad.exe, and data exfiltration. Findings are mapped to MITRE ATT&CK and translated into Sigma rules, Splunk SPL, Sentinel KQL, and YARA detections, with the full lab and detection content shared on GitHub.
Table of contents
Why Behavioral Analysis MattersBuilding the Investigation LabInvestigation MethodologyStage 1: Initial ExecutionStage 2: Registry PersistenceGet Allen Ace ’s stories in your inboxStage 3: Command-and-Control CommunicationStage 4: Secondary Payload RetrievalStage 5: Process InjectionStage 6: Data ExfiltrationMapping the Investigation to MITRE ATT&CKFrom Investigation to Detection EngineeringConclusionQuestions this post answers
How can I safely execute and analyze malware without letting it reach the real internet?
Build an isolated lab with two virtual machines connected only over a Host-Only VirtualBox network, using FLARE-VM as the analysis machine and REMnux as the simulated internet. INetSim simulates internet services while FakeDNS redirects all DNS requests to REMnux, letting malware behave naturally without any outbound connectivity to real systems. Developers building malware analysis labs can find similar hands-on security walkthroughs on daily.dev.
What Windows registry key is commonly used for malware persistence via Run keys?
A common persistence technique creates an entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, which runs automatically on user login. In one documented case this was validated independently through Procmon RegSetValue events, Sysmon Event ID 13, Autoruns, and Regshot, with all four sources confirming the same persistence mechanism. Security engineers tracking persistence techniques can follow detection engineering write-ups on daily.dev.
How do analysts detect process injection into legitimate Windows processes like Notepad.exe?
API Monitor can identify the API calls associated with process injection, while Process Explorer reveals which legitimate process was targeted. In a documented multi-stage malware sample, the malicious code injected into Notepad.exe, letting it execute under the context of a trusted, whitelisted Windows process to evade detection. Anyone researching process injection techniques can explore more DFIR case studies on daily.dev.