Malware Analysis

4 posts

• 2026-04-01

  DFIR Lab - REvil/Sodinokibi Ransomware Incident Response

  Digital forensics and incident response lab investigating a REvil/Sodinokibi ransomware attack, covering initial access, privilege escalation, lateral movement, credential theft, and encryption using Splunk log analysis and malware analysis techniques.

  DFIRMalware Analysis 5 min read
  →
• 2026-04-01

  Volatility Memory Analysis: Hunting .NET Malware

  Memory forensics exercise using Volatility to hunt for .NET malware, hidden processes, injected code, suspicious drivers, and Meterpreter/Mimikatz/Emotet indicators in a Windows 10 memory dump.

  DFIRMalware AnalysisMemory Forensics 7 min read
  →
• 2026-03-29

  Hunting PowerShell / .NET Malware

  Endpoint hunting lab using Sysmon logs and PowerShell to trace .NET malware execution, MSBuild abuse, certutil downloads, and SILENTTRINITY C2 activity.

  Threat HuntingMalware Analysis 8 min read
  →
• 2026-03-11

  AgentTesla Infostealer: Static & Dynamic Analysis

  Analysis of an AgentTesla sample delivered via phishing. Covers unpacking, C2 extraction, and detection opportunities.

  Malware Analysis 2 min read
  →