Hands-on Malware Analysis (Windows 10/11 compatible) (Udemy.com)

NEW MODULE!!! Fileless Malware and Living-off-the-Land Attacks (September 2026)

This course continues to evolve. The latest module explores fileless malware and Living-off-the-Land techniques, including PowerShell execution, encoded commands, trusted Windows utilities, Script Block Logging, and Event ID 4104.

As with the other modules, you will receive clear theoretical explanations, a guided practical laboratory, and supporting resources (All included in resource section). The emphasis remains on understanding attacker behavior so that it can be investigated, detected, and prevented.

Learn Malware Analysis by Understanding How Malware Works

Malware analysis becomes easier when you understand the behavior behind the evidence.

In this hands-on course, we guide you from fundamental concepts to practical static, dynamic, code, system, and network analysis. You will work with controlled proof-of-concept samples inside an isolated Windows laboratory and observe the artifacts they produce.

Instead of relying only on definitions, you will examine processes, files, registry activity, PowerShell events, network traffic, DLL behavior, persistence mechanisms, obfuscation, and other evidence that analysts use during real investigations.

The course covers:

• Develop controlled proof-of-concept malware samples, for academic purposes.

• Safe malware-analysis laboratory configuration.

• Malware types, infection vectors, and infection stages.

• Static and dynamic análisis.

• Portable Executable fundamentals.

• File identification, fingerprinting, strings, and obfuscation.

• Process monitoring and behavioral análisis.

• Malicious DLLs and DLL execution.

• Keylogger behavior and detection.

• Ransomware behavior, analysis, and recovery concepts.

• Windows shims.

• Fileless malware and Living-off-the-Land techniques.

• PowerShell logging and Event ID 4104.

• Command-and-Control concepts.

• Network traffic análisis.

• Indicators of Compromise.

A Practical, Lab-Driven Course

You will not simply watch slides. Throughout the course, you will follow guided demonstrations and reproduce the analysis process inside your own isolated laboratory.

You will learn how to:

• Observe what a suspicious program changes in Windows.

• Investigate processes and execution chains.

• Analyze suspicious DLL activity.

• Inspect network communications.

• Decode and interpret encoded PowerShell commands.

• Correlate system behavior with Windows event logs.

• Extract useful Indicators of Compromise.

• Convert technical evidence into detection opportunities.

Understand the Source Code Behind the Behavior

The course follows a simple principle:

You cannot effectively analyze behavior that you do not understand.

For this reason, selected proof-of-concept malware source code is provided for controlled academic study. We explain important components and connect the code with the resulting system and network evidence.

The objective is not to weaponize malware. The objective is to help future analysts understand how malicious behavior is implemented, how it appears during execution, and how defenders can identify it.

Included Resources

Depending on the module, the course includes:

· Rams1: A Ransomware malware sample (full code provided for academic purposes).

· DecryptRams1: Software to decrypt files encrypted by Rams1 (full code provided for academic purposes).

· Ransomware Help: A document to assist you if you get infected.

· TotalAware2: A Keylogger that can steal Meta/Facebook credentials and connect to a Command and Control Center (full code provided for academic purposes).

· TotalAware3: A Keylogger written in C++ (full code provided for academic purposes).

· Injector7: Injects malicious code into a legitimate Windows process (full code provided for academic purposes).

· Dll4: A malware sample coded in a DLL (full code provided for academic purposes).

· Dll8: Demonstrates how to use export functions in a DLL (full code provided for academic purposes).

· Practices: A document containing the lab exercises guide.

· Lab Requirements and Quick Guide: A document to help you set up a safe lab for malware analysis.

· Web Resources: A document with web pages we’ll use throughout the course.

· CriticalPatchWin1.0: A malware sample designed to trick users into downloading malware (full code provided for academic purposes).

· Defensive Security Lab Guide: A complete step-by-step document for safely reproducing and analyzing a benign fileless PowerShell execution chain. It covers telemetry configuration, Base64 encoding and decoding, Word macro execution, and correlation of Sysmon Event ID 1, Security Event ID 4688, and PowerShell Event ID 4104.

· Invoke-LabEncodedCommand ps1: A PowerShell helper script for building, running, and decoding a completely benign Base64-encoded command. It safely reproduces -EncodedCommand telemetry while creating a harmless marker file and opening Calculator for verification.

· Sysmon-lab-fileless.xml: A Sysmon configuration file designed to capture detailed process-creation telemetry during the fileless execution lab. It helps identify the WINWORD.EXE → powershell.exe parent-child chain, command-line arguments, process hashes, and other forensic evidence.

All samples and demonstrations are intended exclusively for ethical education, defensive research, and execution within an isolated laboratory.

Why Take This Course?

This course can help you build a practical foundation for further study in:

• Malware analysis.

• Digital forensics and incident response.

• Security operations.

• Threat hunting.

• Windows security.

• Cybersecurity research.

Whether you are beginning your cybersecurity journey or expanding your existing technical knowledge, you will gain practical experience connecting source code, execution behavior, system artifacts, logs, and network evidence.

The course is compatible with Windows 10 and Windows 11 laboratories and is part of the Sanru Online Academy.