Sandbox Analysis — Dynamic Detonation and IOC Extraction

Sandbox analysis fills the gap that static analysis leaves — but it requires preparation. Knowing what to look for before detonation makes the difference between a thorough analysis and a missed C2 because the malware slept for 5 minutes.

Any.run Analysis Workflow

Before submitting to Any.run:
1. Decide: public or private analysis?
   - Public: findings visible to all Any.run users → do NOT submit if the sample
     contains client data, proprietary information, or is a sensitive IR artifact
   - Private: requires paid account → use for sensitive IR cases

2. Configure the analysis environment:
   - OS version: match the target (Windows 10 x64 if the endpoint was Win10)
   - Architecture: x64 for modern malware
   - Enable internet connection: required for C2 communication to be observed
   - Set analysis duration: 120-300 seconds (malware may sleep before connecting)
   - Fake human activity: enable mouse movement simulation to bypass anti-sandbox

3. Run and observe:
   - Watch process tree: what does the malware spawn?
   - Watch network: when does it first call out? To what IP/domain?
   - Watch file system: what does it drop? Where?
   - Watch registry: what persistence keys does it create?

4. Collect results:
   - Screenshot the network connections tab (C2 IPs)
   - Download the IOC report
   - Note the mutex name (if any)
   - Hash any dropped samples

Interpreting Sandbox Network Output

Any.run network tab output format:
────────────────────────────────────────────────────────────
Protocol | Destination          | Port | First seen | Direction
────────────────────────────────────────────────────────────
DNS      | evil.c2.domain.com   | 53   | 00:04      | outbound
HTTP     | 185.220.101.9        | 80   | 00:04      | outbound
HTTPS    | 185.220.101.9        | 443  | 00:05      | outbound

HTTP request detail:
  GET /jquery-3.3.1.min.js HTTP/1.1
  Host: 185.220.101.9
  User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
  Cookie: __utmz=<base64>

IOC extraction from sandbox output:
  C2 IP: 185.220.101.9
  C2 Domain: evil.c2.domain.com (DNS query)
  URI: /jquery-3.3.1.min.js
  User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
  Protocol: HTTP C2 (Cookie-encoded commands)
  → Cobalt Strike HTTP beacon (default profile)

Cobalt Strike Configuration Extraction

# Extract Cobalt Strike beacon configuration from a binary
# Tool: 1768.py (SentinelOne) — most comprehensive

python3 1768.py update.exe

# Example output:
# Cobalt Strike Beacon Configuration
# ====================================
# BeaconType: HTTP
# Port: 443
# SleepTime: 60000  (60 seconds)
# MaxGetSize: 1048576
# Jitter: 0
# C2Server: 185.220.101.9,/jquery-3.3.1.min.js
# UserAgent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
# HttpPostUri: /submit.php
# Malleable_C2_Instructions: (encoded transformation logic)
# SpawnTo_x64: %windir%\sysnative\dllhost.exe
# SpawnTo_x86: %windir%\syswow64\dllhost.exe
# PipeName: (empty — HTTP mode, not SMB pipe)
# DNS_Idle: 8.8.8.8
# Metadata: (encoding method)
# BindHost: 
# PipeName: 

# Key IOCs from config:
# - C2: 185.220.101.9:443 /jquery-3.3.1.min.js
# - POST: /submit.php
# - User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
# - Spawn process: dllhost.exe (used for post-exploitation spawning)
# - Sleep: 60s (use for beacon timing detection rule)

Writing a YARA Rule from a Sample

rule Cobalt_Strike_HTTP_Beacon_JSMITH01 {
    meta:
        description = "Cobalt Strike HTTP beacon from IR-2024-089"
        author = "IR Team"
        date = "2024-09-02"
        hash_sha256 = "4a3f7e2c8b1d5e9f3c7a2e6b4d8f1a5c"
        
    strings:
        // Hardcoded User-Agent string from beacon config
        $ua = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUS)"
        
        // C2 URI paths
        $uri1 = "/jquery-3.3.1.min.js"
        $uri2 = "/submit.php"
        
        // Mutex name (extracted from sandbox analysis)
        $mutex = "Global\\XYTYZM"
        
        // Beacon sleep encoding magic bytes (from binary analysis)
        $magic = { 69 68 00 00 00 00 00 00 }
        
    condition:
        uint16(0) == 0x5A4D and  // MZ header (PE file)
        filesize < 5MB and
        (2 of ($ua, $uri1, $uri2, $mutex) or $magic)
}

# Run YARA rule against a directory of samples
yara Cobalt_Strike_HTTP_Beacon.yar /samples/

# Run against memory image (Volatility)
vol.py -f memory.raw windows.yarascan \
  --yara-file Cobalt_Strike_HTTP_Beacon.yar

# Run as a Velociraptor fleet hunt (disk-based)
# Artifact: Windows.Detection.Yara.Process or Windows.Detection.Yara.Files
# Upload the .yar file and deploy fleet-wide

IOC Package from Triage

# Structured IOC package for IR scope expansion
# Generated from: update.exe (SHA256: 4a3f7e2c...)

case: IR-2024-089
analyst: M. Torres
date: 2024-09-02T20:00:00Z
source: update.exe static + sandbox analysis

iocs:
  network:
    - type: ipv4
      value: "185.220.101.9"
      context: "C2 server, confirmed HTTPS beacon"
      confidence: HIGH
    - type: domain
      value: "evil.c2.domain.com"
      context: "DNS query observed in sandbox"
      confidence: MODERATE
    - type: url
      value: "http://185.220.101.9/jquery-3.3.1.min.js"
      context: "Beacon check-in URI"
      confidence: HIGH
  
  host:
    - type: sha256
      value: "4a3f7e2c8b1d5e9f3c7a2e6b4d8f1a5c"
      context: "Initial malware binary"
      confidence: HIGH
    - type: mutex
      value: "Global\\XYTYZM"
      context: "Anti-double-infection mutex"
      confidence: HIGH
    - type: registry
      value: "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\svcupd"
      context: "Persistence key created at execution"
      confidence: HIGH
    - type: file
      value: "C:\\Users\\%USER%\\AppData\\Roaming\\svcupd.exe"
      context: "Malware copy path"
      confidence: HIGH

  behavioral:
    - type: user_agent
      value: "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)"
      context: "Beacon HTTP User-Agent — high fidelity detection"
      confidence: HIGH
    - type: sleep
      value: 60000ms
      context: "Beacon sleep time — use for beacon interval detection"
      confidence: MODERATE

malware_family: "Cobalt Strike HTTP Beacon"
threat_actor: UNKNOWN

Retrieval Practice

A sandbox analysis shows the malware performs no network activity and exits cleanly after 120 seconds with no suspicious behavior. The static analysis showed high entropy and minimal imports. Is the sample benign?

Reveal answer

Not necessarily — this is a likely sandbox evasion. Several malware techniques produce clean sandbox results: (1) VM/sandbox detection: the malware checks for VMware registry keys (HKLM\\SOFTWARE\\VMware), CPUID hypervisor bit, virtual NIC MAC addresses, screen resolution (typical sandbox: 800x600 or 1024x768), or process list (VMware tools, VBoxService). If detected, the sample exits cleanly. (2) Time-based evasion: sleep for longer than the sandbox analysis window (120 seconds is common; some malware sleeps for 5-10 minutes or checks the system clock against a start date). (3) User interaction requirement: waits for real mouse movement or specific user input before executing. (4) Domain/IP-gating: checks a specific infrastructure indicator (a DNS response with a particular value, a specific HTTP response code) before executing payload. Correct response: (a) Re-run in Any.run (interactive) with manual mouse movement and a longer duration (5+ minutes). (b) Try detonating on a real (non-VM) physical test machine if available. (c) If static analysis shows high entropy + minimal imports, the binary IS packed — the sandbox evasion may be the unpacker stub itself. Use Cuckoo with memory analysis mode to capture the unpacked code. (d) Document the sandbox evasion behavior as a finding: the sample is actively anti-analysis, which is itself a malicious indicator.