🎯 Capaian Pembelajaran

Setelah pertemuan ini, mahasiswa mampu:

1. Mengklasifikasikan jenis malware dan karakteristiknya
2. Menjelaskan malware delivery mechanisms dan infection vectors
3. Melakukan static analysis terhadap file mencurigakan
4. Memahami prinsip dynamic analysis dan sandbox environments
5. Mengidentifikasi persistence mechanisms malware
6. Menganalisis C2 communication dan beaconing patterns
7. Menerapkan memory forensics untuk deteksi malware

📋 Agenda Hari Ini

🔬 Apa itu Forensik Malware?

Berbeda dari analisis malware murni:

• 🔗 Chain of custody harus dijaga
• 📝 Dokumentasi harus formal dan admissible
• ⚖️ Output mendukung proses hukum/tribunal militer

Analisis vs Forensik Malware

🎖️ Ancaman Malware bagi Pertahanan

🦠 Klasifikasi Malware

Virus vs Worm

🐴 Jenis-jenis Trojan

🔒 Ransomware

⚔️ APT Kill Chain

Kampanye serangan multi-stage, terkoordinasi, state-sponsored

📨 Malware Delivery Mechanisms

🔍 Static Analysis

📋 File Properties Analysis

Langkah pertama: periksa properti dasar file

🛠️ Tool: PEStudio

Tool gratis untuk analisis file PE (Portable Executable) Windows

🔗 Download: www.winitor.com

📝 Strings Analysis

🛠️ Tool: FLOSS

FireEye Labs Obfuscated String Solver — mengekstrak string biasa dan obfuscated

# Ekstraksi string dasar
floss malware_sample.exe

# Hanya string yang di-decode (obfuscated)
floss --only decoded malware_sample.exe

# Output ke file
floss malware_sample.exe > strings_output.txt

# Dengan minimum length
floss -n 8 malware_sample.exe

🔗 github.com/mandiant/flare-floss

📦 Struktur File PE

┌─────────────────────────────┐
│     DOS Header (MZ)         │  ← "MZ" signature (0x4D5A)
├─────────────────────────────┤
│     DOS Stub                │
├─────────────────────────────┤
│     PE Signature            │  ← "PE\0\0" (0x50450000)
├─────────────────────────────┤
│     COFF File Header        │  ← Machine type, sections
├─────────────────────────────┤
│     Optional Header         │  ← Entry point, image base
├─────────────────────────────┤
│     Section Headers         │
├─────────────────────────────┤
│     .text (code)            │
│     .data (initialized)     │
│     .rdata (read-only)      │
│     .rsrc (resources)       │
└─────────────────────────────┘

📊 Entropy dan Packing

📥 Import Analysis — API Mencurigakan

⚡ Dynamic Analysis

🏗️ Sandbox Environment

┌────────────────────────────────────────────┐
│             HOST MACHINE                    │
│  ┌──────────────────────────────────────┐  │
│  │       ANALYSIS VM (Sandbox)          │  │
│  │                                       │  │
│  │  [ProcMon] [ProcExp] [Wireshark]     │  │
│  │  [FakeNet] [Regshot] [Sysmon]        │  │
│  │                                       │  │
│  │  [Malware Sample] ← Execute here     │  │
│  └──────────────────────────────────────┘  │
│                                             │
│  Network: Host-only / Isolated              │
│  Snapshot: Taken BEFORE execution           │
└────────────────────────────────────────────┘

⚠️ Penting: Ambil snapshot VM sebelum eksekusi malware!

🛠️ Process Monitor (ProcMon)

Memantau file system, registry, dan process activity secara real-time

Filter yang berguna:
─────────────────────────────────────────────────
Process Name  is  malware.exe       → Aktivitas malware
Operation     is  WriteFile         → File creation
Operation     is  RegSetValue       → Registry changes
Path       contains  \Run           → Persistence detection
Path       contains  \Temp          → File drop location

Contoh output persistence:
Time      Process       Operation     Path
10:45:01  malware.exe   RegSetValue   HKLM\...\Run\svchost
10:45:02  malware.exe   CreateFile    C:\Users\...\Temp\payload.exe

🛠️ FakeNet-NG

Contoh output FakeNet-NG:
──────────────────────────────────────────────────
[DNS]  malware.exe query: evil-c2.com → faked
[HTTP] malware.exe GET /gate.php?id=VICTIM001
[HTTP] malware.exe POST /exfil.php (4096 bytes)

✅ Analisis network behavior tanpa koneksi internet nyata

🔗 github.com/mandiant/flare-fakenet-ng

🔗 Persistence Mechanisms

📋 Registry-Based Persistence

⚠️ Malware sophisticated menggunakan multiple persistence sebagai redundancy

📡 Command and Control (C2)

📶 Beaconing Pattern

Contoh Beacon Pattern:
[10:00:00] GET /check?id=abc123 → 200 OK (no cmd)
[10:05:00] GET /check?id=abc123 → 200 OK (no cmd)
[10:10:00] GET /check?id=abc123 → 200 OK {cmd: upload}
[10:15:00] POST /upload (encrypted data)
[10:20:00] GET /check?id=abc123 → 200 OK (no cmd)

Tanpa jitter:  300s, 300s, 300s ← Mudah terdeteksi
Dengan jitter:  285s, 312s, 298s ← Sulit terdeteksi

🔄 Domain Generation Algorithm (DGA)

# Contoh sederhana DGA (edukasi)
def generate_domain(date, seed="malware_seed"):
    date_str = date.strftime("%Y%m%d")
    hash_input = f"{date_str}{seed}"
    hash_result = hashlib.md5(hash_input.encode()).hexdigest()
    return hash_result[:12] + ".com"
# Berbeda setiap hari!

🔀 DNS Tunneling

Cara Kerja:
Malware → DNS Query → DNS Server → C2 Server
                          ↓
C2 Server → DNS Response → DNS Server → Malware

Contoh encoding data dalam DNS query:
Normal:  www.google.com
Tunnel:  SGVsbG8gV29ybGQ=.data.evil-c2.com
         ^^^^^^^^^^^^^^^^^^^
         Base64 encoded stolen data

🧠 Memory Forensics untuk Malware

• 🔓 Unpacked Code — Malware packed ter-unpack di memori
• 👻 Fileless Malware — Hanya berjalan di memori
• 🔑 Encryption Keys — Kunci ransomware mungkin ada
• 💉 Injected Code — Hanya terlihat di memori
• 🌐 Network Connections — Koneksi aktif ke C2

🛠️ Volatility 3 — Malware Plugins

🌳 Deteksi Anomali Process Tree

PID   PPID  Name            Analisis
───── ───── ─────────────── ─────────────────────
748   720   services.exe    ✅ Normal
800   748   svchost.exe     ✅ Normal (parent: services)
1200  2840  svchost.exe     ❌ ANOMALI! (parent: explorer)
2840  1024  explorer.exe    ✅ Normal
4500  2840  WINWORD.EXE     ✅ Normal
4600  4500  cmd.exe         ❌ ANOMALI! (Word→cmd)
4700  4600  powershell.exe  ❌ ANOMALI! (cmd→PS)

🛡️ Anti-Analysis Techniques

💉 Process Injection vs Hollowing

🎯 Indicators of Compromise (IOC)

🗺️ MITRE ATT&CK Framework

Knowledge base taktik dan teknik adversaries — standar de facto

📌 Key Takeaways

1. Static Analysis First — Aman, memberikan gambaran awal kemampuan malware
2. Dynamic Analysis Melengkapi — Mengungkap perilaku runtime di sandbox terisolasi
3. Persistence = Artefak Utama — Registry, tasks, services adalah bukti kritis
4. C2 = Kunci Atribusi — Beaconing, DGA, DNS tunneling untuk identifikasi operator
5. Memory Forensics Kritis — Fileless malware dan injected code hanya visible di RAM
6. MITRE ATT&CK — Standarisasi dokumentasi dan threat intelligence sharing

📅 Pertemuan Berikutnya

• Web application attack vectors (SQL injection, XSS, CSRF)
• Web server forensics (Apache, Nginx, IIS logs)
• Teknik anti-forensik (data hiding, steganography)
• Counter-forensics awareness dan detection

📚 Referensi

1. Sikorski, M. & Honig, A. (2012). Practical Malware Analysis. No Starch Press. Chapter 1-6
2. Ligh, M.H., et al. (2014). The Art of Memory Forensics. Wiley. Chapter 10-15.
3. Casey, E. (2022). Digital Evidence and Computer Crime. Academic Press. Chapter 12.
4. Johansen, G. (2020). Digital Forensics and Incident Response. Packt. Chapter 8-9.
5. MITRE ATT&CK: attack.mitre.org
6. PEStudio: winitor.com
7. FLOSS: github.com/mandiant/flare-floss
8. FakeNet-NG: github.com/mandiant/flare-fakenet-ng

❓ Sesi Tanya Jawab