Question

A SOC analyst receives a suspicious executable flagged by an endpoint agent and needs to prepare a lab environment to perform dynamic analysis. Before detonating the sample, the analyst wants to observe the malware's true network behavior (such as C2 beaconing and DNS lookups) without allowing it to reach or infect production systems or the live internet. Which lab configuration BEST supports safe and effective dynamic analysis of this network behavior?

Accepted Answer

Detonate the sample in an isolated virtual network that uses simulated internet services (INetSim/FakeNet) to capture and respond to the malware's outbound requests

Answer

Run the sample on a physical corporate workstation connected to the production VLAN with host-based antivirus enabled

Answer

Execute the sample on a virtual machine with full, unrestricted internet access so the real C2 server responds naturally

Answer

Analyze the file only with a static string extraction tool and skip execution entirely to avoid any network risk