Analysing malware in a real environment (non-virtual environment)

Question

I have analysed malware previously using Cuckoo Sandbox, however, I've seen that some malware won't run as they detect they are actually running in a virtual environment (they implement some anti-virtualisation techniques). So what I was thinking is running the malware in a real environment instead and then rolling back to the clean state using a clean copy of the system. I just want to check the following:

1. Is this the proper way to analyse malware which implements anti-virtualisation techniques or there are other ways that usually are followed?
2. Is there a specific program that is widely used by malware analysers to retain a copy of the clean system state, and re-install it? (I am interested in Windows malware only)

Answer 1

1. Yes this is an approach that is commonly used.

2. Faronics Deep Freeze is an interesting software to do erase changes on reboot, but is itself subject to detection. Clonezilla is a good imaging tool and is quite simple to use. The best setup I have seen is booting an image from RAM using Intel AMT, this makes the imaging process much faster.

Answer 2

The answer is complete for the questioner's #2, but let's dig a little-deeper into #1.

There are other ways to analyze malware which implements anti-virtualization, vm-detection, sandbox detection, and sandbox evasion techniques. However, does the malware also include environmentally-keyed detection or evasion techniques, such as the ones outlined here -- https://www.vmray.com/blog/sandbox-evasion-techniques-part-4/ -- (aka context-aware malware aka environment-sensitive)?

Cuckoo is an excellent sandbox for features and behavior extraction, so it's not always wise to jump to windbg or other classic bare-metal debugging (although sometimes it is wise to do this). If the built-in cloaking solution for Cuckoo, vmcloak, can prevent the malware from detecting or evading it then you still get all of the benefits of Cuckoo.

Some of these can be elicited early-on during static analysis or even during simple Yara triage. There are also advanced ways of performing Yara triage that will catch malicious processes in-the act, such as Godaddy's procfilter -- https://github.com/godaddy/yara-rules/blob/master/features/virtualbox_detection.yara

If you use dynamic analysis to elicit the sandbox detection, evasion, or context-aware malware techniques, be sure to know your limitations. makin is a good starting framework to determine those anti-debugging capabilities.

A lot of this depends on your goal with malware. What do you want to know about them; what questions do you have? Do you need to extract Proactive Threat Indicators for internal-only blacklists or will you be sharing them? Do you need to deconfig RATs that are operating on systems in your network? For example, a focus on nation-state RATs might warrant a jump to the -- https://github.com/ctxis/CAPE -- tool or similar.

If you want a simple solution to scaling sandbox-based automation with stealth functionality that surpasses vmcloak, check out -- drakvuf.com

I am definitely interested in more of the bare-metal techniques (especially the AMT RAM cloner!) spoken to by @ekse in the primary answer. These are also very-valuable! However, just because you have bare metal doesn't mean that context-aware malware techniques such as time bombs, logic bombs, and specifically-targeted malicious logic won't be an additional problem -- you'll have to account for them!