Stop Reversing Everything: A 30-Minute Windows Malware Triage Workflow

If your team spends three hours stepping through x64dbg for every unflagged executable dropped on an endpoint, you don’t have a triage process—you have a backlog. Reverse engineering is an expensive, low-throughput discipline that should be reserved for novel implants, bespoke C2 protocols, and targeted threat actors, not routine commodity loaders.

Most incident response teams don’t fail because they lack disassemblers; they fail because they lack a disciplined triage gate. You need a fast, repeatable 30-minute protocol to extract high-fidelity Indicators of Compromise (IOCs), contain the immediate threat, and determine whether a sample warrants full static disassembly or belongs in the archive.

Phase 1: Static Surface Mapping (Minutes 0–5)

Never run an unknown binary immediately, but don’t spend twenty minutes staring at its import table either. Your goal in the first five minutes is simple: determine if the file is packed, assess its intent, and check if threat intelligence platforms have already solved this puzzle for you.

Start by querying the binary’s cryptographic hashes (SHA256, md5, and imphash) against VirusTotal or your local threat intel platform using vt-cli or a Python script:

vt file <SHA256_HASH> --fields total_votes,last_analysis_stats,popular_threat_classification

If VT returns a clear consensus (e.g., 48/70 detections identifying it as Stealc or AgentTesla), your primary job shifts from identification to IOC extraction. If the sample is clean or sparse, pivot immediately to local static analysis.

Fire up PEStudio or run capa from Mandiant via command line against the target binary:

capa.exe -v sample.exe_

capa maps binary capabilities directly to the MITRE ATT&CK framework. Look specifically for capability combinations that indicate packing or direct malicious utility:

• High entropy in non-standard PE sections (e.g., section .text or a custom section like .upx with an entropy score $> 7.2$).
• Imports limited to basic kernel functions like LoadLibraryA, GetProcAddress, and VirtualAlloc (a classic hallmark of a custom packer or stager).
• Presence of anti-analysis rules, such as check for debugger via PEB or delay execution via NtDelayExecution.

Next, run FLOSS (FireEye Labs Obfuscated String Solver) rather than standard GNU strings. Standard strings tools dump thousands of useless system library calls; FLOSS automatically decodes stack strings and tight XOR loops:

floss.exe --min-len 6 sample.exe_ > decoded_strings.txt

Scan decoded_strings.txt for user-agent strings, IP addresses, domains, registry key paths, and PowerShell execution arguments (-enc, -w hidden, -nop).

Phase 2: Controlled Detonation and Telemetry Capture (Minutes 5–20)

Static analysis gives you hints; dynamic execution gives you truth. Transfer the sample to an isolated, non-domain-joined Windows Virtual Machine equipped with a host-based host host-isolation switch or host-only network adapter.

Before executing the malware, stage your monitoring environment:

1. Launch Process Monitor (Procmon) and immediately apply a pre-saved filter (Ctrl+L): set Operation is Process Create, Operation is WriteFile, or Operation is RegSetValue. Exclude noise like SearchIndexer.exe and Procmon.exe.
2. Launch Process Hacker / System Informer to monitor memory allocations and process trees in real time.
3. Start FakeNet-NG on the host or an adjacent gateway VM (like REMnux running INetSim) to log all network requests, fake DNS resolution, and capture HTTP/HTTPS payloads locally without dropping live traffic onto the public internet.

Execute the binary from an elevated command prompt. Observe the initial process behavior for 90 seconds.

C:\Triage\Tools> start sample.exe_

Watch for common execution patterns in System Informer:

• Process Hollowing / Injection: Does sample.exe spawn a legitimate Windows process like svchost.exe, conhost.exe, or RegAsm.exe, suspend it, and inject code into its address space? (Look for processes running with no command-line arguments or from non-standard directories).
• Child Shell Executions: Did the binary invoke cmd.exe or powershell.exe to run discovery commands like net group, whoami /all, or vssadmin delete shadows?
• Persistence Setup: Filter Procmon for HKCU\Software\Microsoft\Windows\CurrentVersion\Run or files created inside C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

If the malware terminates immediately without spawning network connections or child processes, it detected your environment. Check if FakeNet-NG logged a failed TLS connection to a hardcoded C2 IP or if the malware looked for specific sandbox artifacts (e.g., drive sizes $< 40\text{GB}$, fewer than 2 CPU cores, or running guest agent services like VBoxService.exe).

Phase 3: Stripping the Noise to Extract High-Fidelity IOCs (Minutes 20–25)

By minute twenty, the malware has either executed its payload or halted execution. Now, extract actionable indicators to feed your SIEM, EDR, and perimeter controls.

If the sample injected code into a remote process, use ProcDump to grab the unbacked memory space of the target process without dealing with complex kernel debugging:

procdump.exe -ma <PID_OF_INJECTED_PROCESS> injected_dump.dmp

Run FLOSS or string searches against the uncompressed memory dump file (injected_dump.dmp). Memory dumps bypass initial packers, revealing unencrypted C2 URLs, user agents, configuration files, and ransomware extortion notes in cleartext.

Filter your FakeNet-NG logs to extract network indicators:

• DNS Requests: Identify the resolution targets for fallback domain generation algorithms (DGAs) or hardcoded primary domains.
• HTTP Headers: Document unique HTTP User-Agents, custom URI paths (e.g., /api/gate.php?v=12), and non-standard host headers.
• Direct IP Beacons: Note raw TCP connections over ports 443, 8080, or non-standard ports like 6667 (IRC) or 4444 (Metasploit default).

For host indicators, compile a clean list containing:

• Dropped Payload Hashes: Hashes of binaries written to %TEMP%, %APPDATA%, or %PUBLIC%.
• Registry Modifications: Created values under Run keys or custom service creations (HKLM\SYSTEM\CurrentControlSet\Services).
• Scheduled Tasks: Tasks created via schtasks.exe /create or COM interfaces.

Phase 4: The Reversing Gate—The 30-Minute Decision Tree (Minutes 25–30)

You have reached minute 25. You possess a list of behavioral indicators, process execution chains, network signals, and static strings. Now you must answer the core operational question: Is this sample worth reverse engineering?

Use this strict decision tree to make your call:

                      +-----------------------------+
                      | Is the binary's behavior   |
                      | fully explained by static/  |
                      | dynamic IOCs?               |
                      +--------------+--------------+
                                     |
                    +----------------+----------------+
                    |                                 |
                 [ YES ]                           [ NO ]
                    |                                 |
                    v                                 v
   +---------------------------------+  +-------------------------------+
   | CLOSE TRIAGE:                   |  | Did the sample fail execution |
   | 1. Publish IOCs to SIEM/EDR     |  | due to anti-analysis/packing? |
   | 2. Isolate impacted endpoint    |  +---------------+---------------+
   | 3. Archive sample               |                  |
   +---------------------------------+         +--------+--------+
                                               |                 |
                                            [ YES ]           [ NO ]
                                               |                 |
                                               v                 v
                                    +--------------------+  +----------------------+
                                    | Is this an active  |  | Escalation required: |
                                    | targeted incident  |  | Binary exhibits      |
                                    | on high-value asset|  | unknown evasion,     |
                                    +---------+----------+  | custom proto, or     |
                                              |             | zero-day behavior.   |
                                     +--------+--------+    +----------+-----------+
                                     |                 |               |
                                  [ YES ]           [ NO ]             |
                                     |                 |               |
                                     v                 v               v
                             +---------------+  +--------------+  +------------+
                             | ESCALATE TO   |  | DISCARD /    |  | ESCALATE   |
                             | ADVANCED RE   |  | LOW PRIORITY |  | TO RE      |
                             +---------------+  +--------------+  +------------+

Stop and Document If:

1. It is Known Commodity Malware: The dynamic analysis exposed standard configuration formats or known signatures (e.g., RedLine Stealer dropping its SQLite theft module, AsyncRAT persistence). You have extracted the C2 infrastructure and persistence keys. Reversing this provides zero marginal benefit to the incident outcome.
2. The Scope is Contained: The IOCs extracted during dynamic execution generated a 100% match hit across your EDR logs, confirming the threat was blocked at the perimeter or caught on execution before host modification occurred.
3. The C2 Protocol is Standard: The payload communicates via standard HTTPS using clear JSON/HTTP POST parameters visible in your traffic captures.

Escalate to Deep Reverse Engineering If:

1. Execution Stalled, but Target Value is High: The malware successfully detected your virtual environment, anti-debugging tricks defeated your automated sandbox, and the sample was retrieved from a Tier-0 asset (e.g., Domain Controller, PKI server, executive endpoint).
2. Custom / Encrypted C2 Channels: The binary successfully communicated with an external IP over raw TCP or an encrypted HTTPS stream where keys are dynamically derived via a proprietary algorithm, leaving you unable to read command payloads.
3. Novel Evasion / Zero-Day Exploitation: The static analysis maps to zero known YARA rules, Virustotal scores are 0/70, and the initial access vector involved direct process injection via unmanaged code or undocumented direct system calls (Syscall stubs).

Document your triage output in a standardized block: include the initial hash, executed command lines, network beacons, persistent artifacts, and your final disposition call (“Contained / Commodity” vs. “Escalated to Reverse Engineering”). Hand the sample to the RE team only when accompanied by this output; if you hand them a raw .exe with a note saying “looks suspicious,” you haven’t triaged anything.