Attendee：25; Auditor：5

Course Description

Give attendees a general idea of unknown malware, and then inject and run a sample on the virtual machine. Teach them how to use various free tools with iForensics eDetector for to detect malware, analyze and retrieve the evidence. Then use Magnet AXIOM, the professional forensics software, with simulated sandbox for forensics investigation.

Malware detection and analysis：Explain how to identify a malware by analyzing its behavior in the memory, such as：internet connection, program injection, start-up sequence, whether it’s service, auto-run program, hidden…, etc.
Evidence Collection and Forensics: Using the complete tracing and evidence collection functions of eDetector with other tools to retrieve various samples associated with the malware, such as files and memory blocks. Next, teach the attendees how to conduct a deep investigation with AXIOM or sandbox software to draw the contextual map of malware infection.

Course objectives

Getting a general idea of unknown malware
Collect the evidence using eDetector with the assistance of other tools
Conduct the forensics investigation using Magnet AXIOM, the professional forensics software

Course Outline

General Idea of Unknown Malware
Sample Test of Unknow Ｍalware
Detect Malware with iForensics eDetector
- Install and Start the Server
- Set-up the Server and Install eDetector on the Client
- Detect Malware in the memory
- Dump the memory block and the sample
- Download and Search the Data of Windows Explorer
- Collect and View Evidence
- Other Functions and Disconnect the Server
Collect the evidence using eDetector and other tools
Conduct the forensics investigation using Magnet AXIOM, the professional forensics software, and the Sandbox tool.

Suggested equipment specifications for Attendee

CPU： I5 of 6th Generation and above
RAM： 8GB
Disk Size：500GB and above
Computer with Virtual Machine Software installed

Attendee Prerequisite Skills for the Course

Basic Computer Skills
Know how to use Virtual Machine software
Know how to use Command-line in CMD

CYBERSEC

CYBERSEC EXPO

Cyber Taiwan Pavilion

Quick Links

Contact Information