auto-analyze

name	auto-analyze
description	Use when the user runs 'auto_analyze @<sample_name>', 'analyse this sample', 'traffic_analyze @<sample>', 'fakenet @<sample>', or 'analyse the capture <pcap>'. Handles everything: deploy.ps1 for IDA+x64dbg debug run, fakenet_capture.ps1 for network capture run, FakeNet HTML report reading, WireMCP PCAP analysis. Full static+dynamic+network malware analysis workflow end-to-end.

Auto-Analyze

Triggered by:

• auto_analyze @<sample_name> — full debug analysis (IDA + x64dbg)
• analyse this sample — same as above
• traffic_analyze @<sample_name> — network capture run (FakeNet)
• fakenet @<sample_name> — same as above
• analyse the capture <pcap_path> — WireMCP PCAP analysis only

---

Stage 0 — Deploy (debug run)

If the [OK] Both MCP servers are up banner has NOT been printed yet, run deploy.ps1 first:

cd D:\sourcecode\vibe\Module_connection
.\deploy.ps1 -Sample <sample_path>

What deploy.ps1 does (7 steps)

Step	Action
1	Reverts E:\OS_VMware\Tiny10\Data\Lab.vmx to snapshot Cleanstate
2	Starts the VM
3	Polls vmrun checkToolsState every 5 s (max 180 s), then waits 10 s to settle
4	Copies sample to C:\Users\raviel\Desktop\<name>.exe (always renamed to .exe) as raviel / 280305
5	Launches x32dbg.exe or x64dbg.exe in guest with -interactive -activeWindow + sample as argument
6	Opens IDA Pro with -A -S<start_mcp.py> <sample> — auto-analysis + MCP plugin startup
7	Health-checks IDA MCP (180 s) and x64dbg MCP (120 s) with JSON-RPC initialize probe

PE architecture detection

Reads e_lfanew+4 (Machine field): 0x014C → 32-bit, 0x8664 → 64-bit, unknown → 32-bit default. Override: .\deploy.ps1 -Sample <path> -Arch 32

IDA MCP startup (start_mcp.py)

idc.auto_wait()                           # blocks until auto-analysis finishes
idc.load_and_run_plugin("mcp-plugin", 0) # starts HTTP server on localhost:13337

Plugin: C:\Users\KHANG\AppData\Roaming\Hex-Rays\IDA Pro\plugins\mcp-plugin.py

Config

Variable	Value
vmrun.exe	E:\VMware pro\vmrun.exe
VM directory	E:\OS_VMware\Tiny10\Data
Snapshot	Cleanstate
Guest drop path	C:\Users\raviel\Desktop\
x64dbg	C:\Users\raviel\Desktop\Tools\x64dbg\release\x64\x64dbg.exe
x32dbg	C:\Users\raviel\Desktop\Tools\x64dbg\release\x32\x32dbg.exe
IDA Pro	E:\Backup\windows_tool\IDA Pro 8.3\ida64.exe
Guest user	raviel / 280305
IDA MCP	http://localhost:13337/mcp
x64dbg MCP	http://192.168.80.166:12345/

Expected output

[OK] Both MCP servers are up.
     Sample   : evil.exe  (32-bit)
     Guest    : C:\Users\raviel\Desktop\evil.exe
     IDA MCP  : http://localhost:13337/mcp
     x64dbg   : http://192.168.80.166:12345/

---

Stage 1 — Verify connections

mcp__ida-pro-mcp__check_connection
mcp__ida-pro-mcp__get_metadata

If get_metadata returns {"module": ""} — IDA has no binary loaded. Stop.

x64dbg probe:

curl -s -X POST http://192.168.80.166:12345/ \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"claude","version":"1.0"}}}'

---

Stage 2 — Static Analysis (IDA Pro MCP)

Follow Phase 1 from mcp-malware-analysis skill. Do not skip steps.

Step 2.1 — Fingerprint

• mcp__ida-pro-mcp__get_metadata — hashes, base address, size
• mcp__ida-pro-mcp__get_entry_points — entry point
• mcp__ida-pro-mcp__list_imports offset=0 count=0 — check for decoy IAT
• mcp__ida-pro-mcp__list_strings offset=0 count=0 — packer strings

Step 2.2 — Execution graph

• mcp__ida-pro-mcp__decompile_function on entry point
• mcp__ida-pro-mcp__get_callees on each function
• If empty → obfuscated → use mcp__ida-pro-mcp__get_xrefs_to on import addresses
• Identify: gate function, decoy path, real path, shellcode loader

Step 2.3 — Anti-sandbox gate

Decompile gate. Document every check (RAM, CPU, timing, PEB, process list, CPUID, registry).

Step 2.4 — Decryption routine

Decompile shellcode loader + cipher sub. Extract keys with mcp__ida-pro-mcp__read_memory_bytes.

Step 2.5 — Breakpoint target list

BP1: gate return          IDA=0x??????
BP2: shellcode call site  IDA=0x??????
BP3: post-VirtualAlloc    IDA=0x??????
BP4: post-decrypt         IDA=0x??????

---

Stage 3 — Dynamic Analysis (x64dbg MCP)

All calls use tools/call wrapper:

curl -s -X POST http://192.168.80.166:12345/ \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<tool>","arguments":{...}}}'

Step 3.1 — ASLR adjustment

module_get_main → runtime_addr = static_addr - static_base + runtime_base. Recalculate every restart.

Step 3.2 — Breakpoints

Software BPs on outer loader. Hardware BPs inside shellcode (type: hardware) — software BPs patch 0xCC and trigger anti-debug.

At each BP: register_get_batch, eval_expression for stack slots.

Step 3.3 — Dump payload

After decrypt BP, before execution transfers:

# tool: dump_memory_region
# output_path: C:/Users/raviel/Desktop/payload_stage<N>.bin
# as_raw_binary: true

MZ first two bytes = embedded PE. Otherwise PIC shellcode.

Step 3.4 — API hash tracing

Read stack frame slots after resolution. Identify with symbol_from_address.

Step 3.5 — Parse embedded PE

Headers → section layout → import directory → .rdata strings → capability map.

---

Stage 3 → Stage 4 Transition

After completing Stages 2 and 3, evaluate whether network IOCs were recovered. If any of the following are missing, automatically proceed to Stage 4 without asking:

Check	Missing = go to Stage 4
C2 domain or IP address	No domain/IP identified in strings, .rdata, or resolved API calls
Network API usage	No WinHttp*, InternetOpen*, WSAConnect, connect, send/recv imports or resolved hashes
Encrypted C2 config	.data section contains encrypted blob with no plaintext URL/IP recovered
Payload network capability	Import table shows network DLLs (wininet, ws2_32, winhttp) but no plaintext endpoints
Dynamic analysis incomplete	Sample exited, crashed, or anti-sandbox gate blocked execution before network code ran

If all network IOCs were recovered (plaintext C2 domain/IP, protocol, User-Agent confirmed) — skip Stage 4 and go directly to Stage 7 (Report).

If any are missing — state clearly: "C2 not recovered — starting FakeNet network capture" then proceed to Stage 4.

---

Stage 4 — Network Capture (FakeNet-NG)

Run when C2 not recovered in Stage 3, or triggered directly with fakenet @<sample>.

cd D:\sourcecode\vibe\Module_connection
.\fakenet_capture.ps1 -Sample <sample_path>
# Optional: -CaptureSecs 180  (default 300 s)

What fakenet_capture.ps1 does (8 steps)

Step	Action
1	Reverts VM to Cleanstate
2	Starts VM
3	Waits for VMware Tools (max 180 s) + 10 s settle
4	Copies sample to guest as <name>.exe
5	Launches FakeNet: cmd /c cd /d <fakenet_dir> && fakenet.exe -f <stop_flag>
6	Waits 8 s for FakeNet to initialize, launches sample free-running (no debugger)
7	After CaptureSecs, creates stop flag file on host, copies to guest — FakeNet self-terminates and writes PCAP + HTML. Waits 30 s for flush.
8	fn_find.ps1 locates newest packets_*.pcap and report_*.html, copies both to captures\<sample>_<timestamp>.pcap and captures\<sample>_<timestamp>_report.html

FakeNet stop mechanism — -f flag

FakeNet's -f <filepath> polls for that file and self-terminates when found — running its full shutdown handler (PCAP flush, HTML report generation, NBI summary print). This is the only working approach. All remote kill methods fail due to vmrun session isolation:

Approach	Why it fails
taskkill /IM fakenet.exe via runProgramInGuest	Different session from FakeNet's interactive window
taskkill /F	Hard-kills without flush — no PCAP, no HTML
VBScript SendKeys ^c	AppActivate can't reach interactive session
schtasks /it	UAC split-token blocks access to interactive session
WMI Terminate()	Same session isolation
GenerateConsoleCtrlEvent	Different session, no effect

FakeNet file outputs

File	Location in guest	Copied to host
PCAP	fakenet3.3\packets_<timestamp>.pcap	captures\<sample>_<timestamp>.pcap
HTML report	fakenet3.3\report_<timestamp>.html	captures\<sample>_<timestamp>_report.html

Expected output

[OK] Capture complete.
     Sample    : evil.exe
     Duration  : 300 s
     PCAP      : D:\sourcecode\vibe\Module_connection\captures\evil.exe_20260504_143022.pcap
     HTML      : D:\sourcecode\vibe\Module_connection\captures\evil.exe_20260504_143022_report.html

---

Stage 5 — Read FakeNet HTML Report

Read the HTML report before diving into the PCAP — it contains FakeNet's pre-digested NBI (Network-Based Indicators) summary organized by process.

Open the HTML report:

start <host_html_path>
# or read raw content:
Get-Content <host_html_path> -Raw

What the HTML report contains

Section	What to look for
Per-process NBI table	Each process that made network connections listed by PID + name. Focus on non-Windows processes — svchost.exe, services.exe are noise.
Protocol per connection	dns, http, https, tcp — the protocol FakeNet intercepted
Domain names	Listed under DNS entries — these are the real C2 domains. FakeNet resolved them all to its own IP.
Destination IPs	Ignore 192.0.2.x (FakeNet's RFC 5737 listener). Note any unexpected RFC1918 IPs.
SSL encrypted	Yes = TLS connection — check the SNI for the domain name
Query type + domain	A, AAAA, HTTPS record types — DGA domains have random-looking names

Reading the NBI table — what matters

Process: malware.exe (PID 1234)
  Protocol: http
    Method: POST
    URI: /gate.php
    Host: c2domain.evil
    User-Agent: Mozilla/4.0 (custom UA)

This is the C2 beacon. Extract: domain, URI, User-Agent, HTTP method, any POST body.

Process: malware.exe (PID 1234)
  Protocol: dns
    Query Type: A
    Domain: randomlooking123abc.com

This is a DGA domain. Note the full domain name.

Windows OS noise to ignore in report

These processes/domains are always present — not malware:

• svchost.exe → ctldl.windowsupdate.com, slscr.update.microsoft.com, www.msftconnecttest.com
• svchost.exe → wpad.localdomain (proxy discovery)
• svchost.exe → DESKTOP-5SA0936.local (mDNS)
• svchost.exe → 239.255.255.250:1900 SSDP/UPnP
• msedge.exe → any Microsoft/Bing domains (if Edge is open in snapshot)

---

Stage 6 — PCAP Analysis (WireMCP + tshark)

WireMCP tools: mcp__wiremcp__analyze_pcap, mcp__wiremcp__check_ip_threats, mcp__wiremcp__extract_credentials

analyze_pcap fails on large PCAPs (stdout maxBuffer exceeded). Use tshark directly:

$tshark = 'D:\Application\wireshark\tshark.exe'
$pcap   = '<host_pcap_path>'

# Packet count + duration
& $tshark -r $pcap -q -z io,stat,0

# All unique IPs
& $tshark -r $pcap -T fields -e ip.src -e ip.dst 2>$null |
  ForEach-Object { $_ -split "`t" } | Where-Object { $_ -match '^\d+\.\d+\.\d+\.\d+$' } | Sort-Object -Unique

# DNS queries (real C2 domain lookups)
& $tshark -r $pcap -Y 'dns.flags.response == 0' -T fields -e dns.qry.name 2>$null |
  Where-Object { $_ -ne '' } | Group-Object | Sort-Object Count -Descending

# Protocol hierarchy
& $tshark -r $pcap -q -z io,phs

# Non-Windows HTTP
& $tshark -r $pcap -Y 'http.request and not (http.host contains "microsoft" or http.host contains "windowsupdate" or http.host contains "msftconnect" or http.host contains "wpad" or http.host contains "live.com")' `
  -T fields -e ip.dst -e http.host -e http.request.method -e http.request.uri -e http.user_agent 2>$null

# TLS SNI (C2 over HTTPS)
& $tshark -r $pcap -Y 'tls.handshake.type == 1' -T fields -e ip.dst -e tls.handshake.extensions_server_name 2>$null | Sort-Object -Unique

# Beacon detection — connection timing to specific IP
& $tshark -r $pcap -Y 'ip.dst == <ip> and tcp.flags.syn == 1 and tcp.flags.ack == 0' `
  -T fields -e frame.time_relative -e tcp.dstport 2>$null

Threat intelligence

mcp__wiremcp__check_ip_threats(ip=<external_ip>)

Run for every non-RFC1918, non-192.0.2.x IP. RFC1918: 10.x, 172.16-31.x, 192.168.x.

Credential extraction

mcp__wiremcp__extract_credentials(pcapPath=<host_pcap_path>)

FakeNet simulation context

• 192.0.2.x = FakeNet's own listener (RFC 5737 documentation range) — not a real C2 IP
• All destination IPs in TCP connections point to FakeNet's listener — ignore them
• Focus on DNS domain names and HTTP request content (URI, User-Agent, body) — these are real
• Windows OS noise domains: windowsupdate.com, msftconnecttest.com, wpad.localdomain, login.live.com

C2 signal table

Signal	Meaning
DNS query for random-looking domain	DGA-based C2
HTTP POST with non-browser User-Agent	C2 beacon or exfil
Periodic TCP connections at fixed interval	C2 heartbeat
Large outbound vs small inbound volume	Data exfiltration
TLS with no SNI to non-RFC1918 IP	Direct IP C2

If PCAP shows only Windows OS noise

Sample detected sandbox and went dormant. Check anti-sandbox gate behavior with deploy.ps1 debug pass first.

---

Stage 7 — Report

Write to <sample_name>_Analysis_Report.md in D:\sourcecode\vibe\Module_connection\.

Structure:

1. Sample Identification (hashes, arch, packer, base addresses)
2. Executive Summary (malware type, capabilities, evasion — 3-5 bullets)
3. Static Analysis (execution flow diagram, gate checks, decryption algorithm + key bytes)
4. Dynamic Analysis (ASLR slide, resolved API table, payload PE fingerprint, capabilities confirmed)
5. Network Analysis (C2 IPs/domains, protocols, beacon interval, data exfil, URLhaus hits)
6. Artifacts (dump paths on VM desktop, PCAP + HTML paths on host)
7. Detection (YARA rule, host IOCs, network IOCs — domains, IPs, URIs, User-Agent)
8. Classification (family, type, compile timestamp)

Network Analysis section template:

## Network Analysis

### Capture details
- Tool     : FakeNet-NG 3.3 (simulated network)
- Duration : <N> s
- PCAP     : <host_pcap_path>
- HTML     : <host_html_path>

### DNS queries (non-Windows)
| Domain | Query type | Count | Likely purpose |
|--------|-----------|-------|----------------|
| ...    | A         | 5     | C2             |

### C2 candidates
| Domain / IP | Protocol | Port | Beacon interval | URLhaus |
|-------------|----------|------|-----------------|---------|
| ...         | HTTP     | 80   | ~60 s           | CLEAN   |

### HTTP traffic (non-Windows)
| Process | Method | Host | URI | User-Agent | Body summary |
|---------|--------|------|-----|-----------|--------------|
| ...     | POST   | ...  | /   | custom    | base64 blob  |

### Data volumes
| Endpoint | Sent | Received | Notes |
|----------|------|----------|-------|
| ...      | 12KB | 2KB      | exfil |

### Credentials / tokens
NONE / <list>

### C2 status
CONFIRMED / SUSPECTED / NOT RECOVERED

---

Hard rules

• Never run the sample without BPs set — map statically first.
• Hardware BPs only inside shellcode.
• Dump payload before execution transfers, not after.
• Recalculate all addresses from module_get_main.base after every restart.
• Never run FakeNet and x64dbg simultaneously — separate passes.
• Read the HTML report before the PCAP — NBI summary is pre-digested.
• Focus on DNS domain names in PCAP — destination IPs are FakeNet's listener.
• If C2 not recovered: mark NOT CAPTURED, note FakeNet step needed.