Malware Analysis — Part 3: Setting Up REMnux and INetSim

WARN

This series covers the analysis of malicious software in controlled, isolated environments. All techniques described are for educational and defensive security purposes only. The author accepts no responsibility for damage to hardware, software, data, or systems resulting from following this guide. Never analyze unknown files outside of a properly isolated lab environment as described in this series.

Previous: Part 2 — Setting Up the Windows Analysis VM with FLARE-VM

What Is REMnux?

REMnux is a free, open source Linux distribution purpose-built for malware analysis. Created and maintained by Lenny Zeltser (a well-known figure in the security community), REMnux packages hundreds of analysis tools into a single, pre-configured environment that works out of the box.

Where FLARE-VM gives you a Windows environment for running and analyzing Windows malware, REMnux gives you a Linux platform for:

Static analysis — examining malware files without executing them
Network analysis — capturing, simulating, and analyzing network traffic
Memory forensics — analyzing RAM dumps with Volatility
Document analysis — examining malicious PDFs, Office documents, scripts
Network service simulation — making malware think it has internet access without actually letting it connect

Why do you need both REMnux and FLARE-VM?

Each plays a different role. FLARE-VM is where you run Windows malware and observe its behavior on a Windows system. REMnux sits alongside it, watching network traffic and providing services that malware expects to find (HTTP servers, DNS resolvers, SMTP servers). In a professional analysis environment these two VMs work together constantly — FLARE-VM executes the malware, REMnux observes what it does on the network.

Free or paid? REMnux is completely free: remnux.org

Installing REMnux

REMnux is distributed as a virtual machine image — you don't install an OS and then add REMnux on top. You download a pre-built VM and import it.

Download

Go to remnux.org/#distro and download the OVA (Open Virtualization Archive) file. It's approximately 4–5 GB.

Import into Hyper-V

Hyper-V doesn't natively support OVA files — they're a VMware format. You have two options:

Option A — Convert the OVA (Recommended):

Use StarWind V2V Converter (free) to convert the OVA to a Hyper-V VHDX disk:

Download StarWind V2V from starwindsoftware.com
Open StarWind V2V → Select the REMnux OVA as source
Choose Hyper-V as destination format
Convert — this produces a .vhdx file

Then create a new Hyper-V VM and attach the VHDX as the disk.

Option B — Use VirtualBox as an intermediary:

Import the OVA into VirtualBox first, then export as Hyper-V format. Less elegant but works without third-party tools.

VM Settings for REMnux in Hyper-V

Setting	Value
Name	`REMnux`
Generation	Generation 1 (Linux compatibility)
RAM	4 GB
vCPU	2
Network Adapter 1	`Internal-Lab` (for malware traffic analysis)
Network Adapter 2	`Management` (for host access via SSH)

Why two network adapters? REMnux needs to be on the Internal-Lab switch to see and interact with malware traffic. But you also want to SSH into REMnux from your host machine (for copying analysis results, running commands from your comfortable terminal, etc.) — that's what the Management adapter is for.

First Boot

REMnux credentials:

Username: remnux
Password: malware

Change the password immediately:

passwd

Configure Static IPs

REMnux needs a predictable IP address because you'll configure pfSense and your malware VM to use it as DNS. Set static IPs on both interfaces:

# Edit the network configuration
sudo nano /etc/netplan/01-network-manager-all.yaml

network:
  version: 2
  ethernets:
    eth0:                          # Internal-Lab interface
      addresses:
        - 192.168.1.100/24
      gateway4: 192.168.1.1        # pfSense LAN IP
      nameservers:
        addresses: [127.0.0.1]     # REMnux resolves DNS itself
    eth1:                          # Management interface
      addresses:
        - 10.0.0.100/24            # Choose your management network IP

Apply the configuration:

sudo netplan apply

Verify both interfaces have their IPs:

ip addr show

Tour of REMnux Tools

REMnux comes with an extensive toolkit. Here's a reference for every significant tool category — what each tool is, what it does, and when you'll use it:

Network Simulation and Interception

INetSim (Free, open source)

What it is: Internet Services Simulation Suite — a program that impersonates common internet services on a local machine.

What it does: INetSim listens on dozens of ports and responds to requests using fake but plausible responses. When malware tries to connect to its C2 server, INetSim intercepts the DNS query, returns its own IP, accepts the HTTP connection, and responds with generic content — all while logging everything the malware sent and requested. The malware believes it has internet access and reveals its behavior.

Simulated services include:

HTTP / HTTPS
DNS (resolves everything to INetSim's IP)
SMTP / POP3 (email)
FTP
IRC
TFTP
NTP
Finger / Ident

When you use it: During dynamic analysis whenever you want to observe malware's network behavior without letting it reach the real internet.

Professional alternative: FakeNet-NG (covered in Part 2) serves a similar purpose on Windows. In large analysis environments, analysts may run custom honeypot servers for specific protocols. Inetsim is the community standard for Linux-based simulation.

Wireshark (Free, pre-installed on REMnux)

Running Wireshark on REMnux captures all traffic on the Internal-Lab network from the Linux side — complementary to running it on the Windows analysis VM. Useful for capturing traffic you might miss from within Windows (e.g., traffic from a process that bypasses Windows network monitoring).

Zeek (formerly Bro) (Free, pre-installed)

What it is: A powerful network analysis framework.

What it does: Unlike Wireshark which captures raw packets, Zeek analyzes network traffic and produces structured logs: connection logs, DNS logs, HTTP logs, TLS logs, file extraction logs. These logs are much easier to search and analyze programmatically than raw PCAPs.

When you use it: For systematic analysis of traffic logs, particularly when you have large captures from long-running malware samples.

Suricata (Free, pre-installed)

What it is: A high-performance network IDS/IPS engine.

What it does: Analyzes network traffic against a database of signatures (rules) and fires alerts when malware traffic patterns are detected. Useful for identifying whether a sample matches known malware families by its network behavior.

When you use it: To check captured traffic against known malware signatures and to develop new detection rules.

Static Analysis Tools

YARA (Free, pre-installed)

What it is: A rule-based pattern matching tool originally designed by Victor Alvarez at VirusTotal.

What it does: You write YARA rules that describe patterns (strings, byte sequences, combinations of conditions) characteristic of a piece of malware or a malware family. YARA then scans files and tells you whether they match. YARA rules are the language of the malware detection community — every major security vendor writes them, and thousands of public rules are freely available.

Example of a simple YARA rule:

rule Detects_Suspicious_String {
    meta:
        description = "Detects a suspicious C2 URL pattern"
        author = "your name"
    strings:
        $url = "evil-c2.com" nocase
        $ua = "Mozilla/4.0" nocase
    condition:
        $url and $ua
}

Run it:

yara rule.yar /path/to/suspicious/file

When you use it: For quickly checking whether a sample matches known malware families, and for writing detection signatures based on your analysis findings.

capa (Free, Mandiant)

What it is: A tool that identifies capabilities in executable files.

What it does: Analyzes a PE binary and produces a list of what the program is capable of doing — not just what strings it contains, but what functionality it implements. It maps findings to the MITRE ATT&CK framework and CAPE taxonomy. The output of capa tells you at a high level what a malware sample does before you've done any in-depth analysis.

Example output summary:

+-----------------------------+------+--------------+
| attack-pattern              | MBC  | CAPABILITY   |
+-----------------------------+------+--------------+
| Persist via Run Keys [T1060]|      | registry-set |
| File and Directory Discovery|      | find-files   |
| Process Injection [T1055]  |      | inject-thread|
+-----------------------------+------+--------------+

When you use it: As one of your first analysis steps. capa gives you a roadmap for what to look for in subsequent analysis.

Professional alternative: capa is itself widely used professionally. Manual analysis in IDA Pro or Ghidra reveals the same information with more detail but requires significantly more time.

FLOSS (FLARE Obfuscated String Solver) (Free, Mandiant)

Pre-installed on REMnux. Extracts obfuscated strings from binaries — see Part 2 for the full description. On REMnux you'll run it from the command line:

floss /path/to/sample.exe > floss_output.txt

The output can be very large — redirect it to a file for easier review.

binwalk (Free, pre-installed)

What it is: A tool for analyzing and extracting files embedded in binary firmware or executables.

What it does: Scans a binary file for embedded files and compressed data using signature scanning. Malware sometimes embeds secondary payloads — additional executables, encrypted blobs, configuration files — inside the main binary. Binwalk finds and extracts them.

binwalk -e suspicious.exe

When you use it: When static analysis suggests a file contains embedded data (high entropy sections, unusual file size, strings suggesting embedded content).

file and exiftool (Free, pre-installed)

file identifies file type from magic bytes regardless of extension. exiftool extracts metadata from files. Both are essential for initial triage.

file suspicious.exe
exiftool suspicious.exe

Memory Forensics

Volatility 3 (Free, open source)

What it is: The industry-standard memory forensics framework.

What it does: Analyzes RAM dumps from Windows, Linux, and macOS systems. Can list processes (including hidden ones), dump process memory, examine network connections that existed at the time of the capture, find injected code, extract encryption keys, and recover dozens of other forensic artifacts from memory.

Volatility is covered in depth in Part 9 of this series.

When you use it: After capturing a memory dump from the malware VM during or after dynamic analysis. Memory often contains information not present on disk — decrypted payloads, process injection artifacts, in-memory network configuration.

Professional alternative: Magnet AXIOM and Belkasoft Evidence Center (both paid, ~$1,000+/year) are commercial forensics platforms that include memory analysis. Volatility is itself used professionally and is the foundation many commercial tools are built on.

Scripting and Decode Tools

CyberChef (Free, GCHQ)

What it is: A web-based data transformation and decoding tool maintained by the UK's GCHQ intelligence agency.

What it does: Provides a drag-and-drop interface for chaining together data operations — Base64 decode, XOR, AES decrypt, hex decode, gunzip, regular expression extraction, and hundreds more. Malware analysts use it constantly for decoding obfuscated strings, decrypting embedded payloads, and transforming data between formats.

REMnux runs CyberChef locally — no internet required:

# Open CyberChef in a browser
firefox /opt/CyberChef/CyberChef.html

When you use it: Whenever you have encoded or obfuscated data to decode — base64 strings, XOR-encoded C2 URLs, hex-encoded payloads.

Professional alternative: CyberChef is itself widely used professionally. The only real alternative is writing custom scripts in Python, which is more flexible but slower.

Didier Stevens Tools (Free)

A collection of Python scripts by Didier Stevens — a prominent malware analyst — for analyzing specific file types:

pdf-parser.py — analyzes malicious PDF files
oledump.py — analyzes malicious Office documents (OLE format)
zipdump.py — examines ZIP archives including malformed ones
base64dump.py — extracts and decodes base64 from files
xorsearch.py — searches files for XOR-encoded strings

These are essential for document malware analysis — phishing attachments that are malicious PDFs or Word documents.

# Analyze a malicious PDF
pdf-parser.py --object 1 --raw malicious.pdf

# Analyze a malicious Office document
oledump.py malicious.docm

Python 3 + Libraries (Free, pre-installed)

REMnux comes with Python 3 and common analysis libraries:

pefile — Python library for parsing PE files
yara-python — run YARA rules from Python scripts
cryptography — encryption/decryption operations
scapy — network packet manipulation and analysis

Radare2 (Free, open source)

What it is: A complete reverse engineering framework and disassembler.

What it does: Similar to Ghidra and IDA Pro — disassembles binaries, allows you to examine and modify binary code, has a debugger, scripting support, and analysis capabilities. Has a steep learning curve due to its command-line interface.

When you use it: As an alternative to Ghidra for quick analysis from the command line, or for scripted analysis of multiple samples.

Professional alternative: Ghidra and IDA Pro are the primary tools for interactive analysis. Radare2 is valued for its scriptability and command-line workflow.

Configuring INetSim

INetSim is pre-installed on REMnux but needs configuration before use.

Understanding INetSim's Role

When malware runs in your Windows VM, it will typically attempt to:

Make a DNS query to resolve its C2 server's domain name
Connect to the resolved IP on some port (HTTP, custom protocol, etc.)
Send data to the C2, receive commands back

Without INetSim, pfSense blocks these connections (because you've configured it to block all outbound traffic from the lab). The malware might detect this and behave differently — going dormant, using a backup channel, or not revealing its full behavior.

With INetSim running on REMnux:

pfSense forwards all DNS queries from the lab network to REMnux
INetSim responds to every DNS query with its own IP (192.168.1.100)
The malware connects to INetSim thinking it's connecting to its C2
INetSim accepts the connection, logs everything sent, and responds with generic content
The malware believes it has internet access and reveals its full network behavior

INetSim Configuration

The main configuration file:

sudo nano /etc/inetsim/inetsim.conf

Key settings to configure:

# IP address INetSim will bind to
service_bind_address    192.168.1.100

# IP to return for ALL DNS queries
dns_default_ip          192.168.1.100

# HTTP simulation settings
http_fakemode           yes
http_document_root      /var/lib/inetsim/http/fakefiles

# HTTPS simulation
https_bind_port         443

# Log directory
logdir                  /var/log/inetsim

# Enable all services
start_service dns
start_service http
start_service https
start_service ftp
start_service smtp
start_service pop3
start_service irc
start_service ntp

Configure pfSense to Forward DNS to INetSim

For INetSim's DNS interception to work, pfSense must forward all DNS queries from the lab network to REMnux instead of resolving them normally.

In pfSense web UI:

Services → DNS Resolver → General Settings
Disable the DNS resolver
Services → DNS Forwarder → General Settings
Enable the DNS forwarder
Add a custom option to forward all queries to REMnux:
```
server=192.168.1.100
```

Or alternatively, use pfSense's firewall rules to redirect all DNS traffic (port 53) from the Internal-Lab to REMnux.

Starting INetSim

sudo inetsim

INetSim will display which services it's starting and their status. Leave it running during dynamic analysis sessions.

To view the interaction logs:

ls /var/log/inetsim/
cat /var/log/inetsim/main.log
cat /var/log/inetsim/service.log

The service log shows every connection the malware made — which DNS names it queried, what URLs it requested, what data it sent.

Setting Up SSH Access from Host to REMnux

With REMnux on the Management switch, you can SSH from your Windows host for a more comfortable command-line experience.

On REMnux, verify SSH is running:

sudo systemctl status ssh
sudo systemctl enable ssh  # enable on boot if not already

On your Windows host, connect:

ssh remnux@10.0.0.100    # Use the Management interface IP

Or use Windows Terminal with the SSH profile, or PuTTY (free, classic SSH client for Windows).

For copying files from REMnux to your Windows host:

# From Windows PowerShell
scp remnux@10.0.0.100:/path/to/analysis_results.txt C:\Analysis\

Workflow: How REMnux and FLARE-VM Work Together

Here's how a typical analysis session uses both VMs:

BEFORE EXECUTION:
1. Start REMnux → launch INetSim
2. Start FLARE-VM (from baseline snapshot)
3. Start Wireshark on REMnux (capture Internal-Lab interface)
4. Verify FLARE-VM's DNS resolves to INetSim (ping any domain)

DURING EXECUTION (on FLARE-VM):
5. Start Process Monitor, Process Explorer, Autoruns baseline
6. Execute the malware sample
7. Observe behavioral artifacts in real time

CONCURRENT MONITORING (on REMnux):
8. Watch INetSim logs for network connections
9. Observe Wireshark capture for packet-level detail

AFTER EXECUTION:
10. Stop the malware (terminate process or restore snapshot)
11. Export Process Monitor log, Autoruns diff
12. Stop Wireshark, save PCAP
13. Analyze INetSim logs on REMnux
14. Run Volatility on memory dump (Part 9)
15. Restore FLARE-VM to baseline snapshot

This two-VM workflow is the foundation of professional Windows malware analysis. Every part of this series from Part 7 onward assumes both VMs are running and configured as described here.

Verification Checklist

Previous: Part 2 — Setting Up the Windows Analysis VM with FLARE-VM Next: Part 4 — Safe Sample Acquisition, Triage, and Permissions