In these cases if you have a file you wish to analyze saved. The kind of information i think you are looking for comes from reverse engineering.
first things first, you can download sysinternalssuite from a great guy at microsoft who released a series of tools for quick and dirty sysadmin tasks.
most relevant to your case (which is i guess malware analysis) are the following tools specifically:
- procmon - shows live changes to the system and what started them
- tcpview - shows all tcp connections, where theyre from, where theyre going, and status
- Sysmon - get some early boot logging going.
- procexp - this will show a detailed version of task manager, with stress values and child processes all in one. one of my favorites for malware.
so the idea here is you will create a VM with the same OS (if possible) as your client computer. and let this thing loose inside it.
before you begin, you install the vm, no virus software, and get the sysinternals tools.
also you want some form of reverse engineering debugger.
- IDA - the king of this area, very feature rich, they have a free version, but its older
- ollydb - a free debugger with less features, but still does the job well
- immunity db - similar to ollydb
these programs will show you the machine code of whatever file you attach them to. you can even step through the execution of the malware one code line at a time.
Basic methodology is as follows:
- allow the malware to run wild by itself and use sysinternals to gather some information on the malware and what its doing where in the system, where it tries to connect to, and what kind of processes it creates.
- attach a debugger to the malware and run: there will be alot of information, this is why the recon phase is so important, it narrows the scope of what you are looking for. you use this information to try to find the specific areas in the malware that are of particular interest. i.e. copying itself, changing system registries or files, making services on the pc, opening ports etc...
this is a basic overview of how analysis of a black box is done (black box = unknown entity). any additional information also helps this process, knowing the exact malware type also helps you know where to look with these tools for specifics. since those heuristics are already known they should be able to give you search material to find more information on where to look.