Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Hands-on Malware Analysis (Windows 10/11 compatible)

Name: Hands-on Malware Analysis (Windows 10/11 compatible)
Rating: 4.5 (549 reviews)

Learn Malware Analysis by Coding Malware (Ransomware, Keyloggers, Injectors, malicious DLL’s, LolBins and more)

Created bySanru online Academy

Last updated 9/2026

English

English [Auto],

What you'll learn

Learn how to analyze, prevent, and code proof-of-concept ransomware. The source code is provided strictly for academic purposes.
Analyze, prevent, and code a keylogger that hides in a legitimate Windows process. Source code is provided strictly for academic purposes.
Analyze, prevent, and code a keylogger that filters and captures Meta/Facebook credentials. Source code is provided strictly for academic purposes.
Analyze, prevent, and code an injector targeting a legitimate Windows process. Source code is provided strictly for academic purposes.
Analyze, prevent, and code a malicious DLL as a proof of concept. Source code is provided strictly for academic purposes.
Set up a safe and isolated test lab for malware analysis.
Differentiate malware types, behaviors, attack vectors, and prevention techniques.
Understand the process malware follows to enter and infect a system.
Learn by doing how payloads, obfuscation, persistence, stealth, and armoring work.
Understand how malware connects to a Command-and-Control server and what this infrastructure does.
You will learn to get Indicators of Compromise (IoC) on infected systems.
Identify and collect Indicators of Compromise (IoCs) from infected systems.
Understand how seemingly legitimate software can trick users into downloading malware.
Detect and capture malware activity on a Windows operating system.
Capture and analyze malicious network traffic.
Understand Windows shims (code included), how they work, and how attackers can abuse them to execute malware.
Set up a safe lab to analyze shim-based attacks and learn how to deal with shim infections.
Understand fileless malware and how Living-off-the-Land attacks abuse legitimate Windows tools.
Analyze encoded PowerShell execution and detect it using Script Block Logging and Event ID 4104.

Course content

14 sections • 65 lectures • 6h 5m total length

Welcome1:55
Engage in hands-on malware analysis for windows 10/11, capturing and analyzing malicious code with 20 practices, reviewable line by line, and access full malware source code for learning.
Course Description2:08
Explore hands-on malware analysis from static to dynamic methods, learn to analyze, prevent, and document ransomware, keyloggers, and malicious DLLs, and set up a safe lab with full resources.

Section presentation and learning objectives1:02
What is malware? Infection Vectors, Why do we perform malware Analysis?3:22
Learn what malware is, how it turns devices into zombies for DDoS and mining, and inspect infection vectors like email, USB drives, phishing, and cross-site scripting for indicators of compromise.
Types of malware, Malware components, Command and Control Center5:31
How Does Malware Get into Your System Prev. methods, Static and Dynamic Analysis6:13
Introduction to Malware Analysis

Section presentation and learning objectives1:12
Set up a safe lab to run malware samples, including ransomware and keyloggers, with Windows 10 and Kali Linux VMs, Axum, VirtualBox settings, and a host-to-linux command-and-control simulation.
Setting up Windows 10 virtual machine8:24
Set up a Windows 10 virtual machine in VirtualBox for malware analysis, mounting the ISO, allocating 9 GB RAM and 50 GB disk, installing guest additions, and disabling protections.
Setting up Inetsim in Kali Linux virtual machine8:07
Install Inet SIM in Kali Linux VM, follow official docs, configure the Ethernet interface and IP/DNS settings, run the simulation, and prepare Windows traffic redirection for the next lesson.
Setting up Inetsim in Windows 10 virtual machine3:14
Set up Inetsim in a Windows 10 virtual machine to redirect post requests from malware samples via a Kali Linux host, using a host-only adapter in VirtualBox for traffic analysis.
VirtualBox settings4:24
Configure virtual box to share folders and enable bi-directional clipboard between host and Windows guest, enable auto mount for permanent shares, and take snapshots before malware experiments.
Bring the Windows Virtual Machine Back Online1:35
Enable the Windows virtual machine's network connection by adjusting settings from host to only, then configure IPv4 to obtain an IP address and DNS server automatically to restore online access.

Section presentation and learning objectives0:51
Portable Executable (PE)7:28
File Type5:31
Identify Windows file types and architectures in a ransomware sample using Rams, CFF Explorer, and online scanners to confirm a 32-bit portable executable with a dot net signature.
Fingerprinting9:29
Explore fingerprinting by generating cryptographic hashes to verify integrity and uniquely identify malware samples. Learn fuzzy hashing with SSD to compare similar binaries and detect modifications.
Strings3:35
Analyze malware strings on Windows 10/11 to uncover functionality, including command and control domains, file names, and APIs, using tools like floss and bintext for static analysis.
Obfuscation11:26
Explore obfuscation techniques used by malware authors. Study encoders such as base64, caesar, xor, kryptos, and packers, and compare packed vs unpacked binaries with cff explorer for keylogger indicators.

Section presentation and learning objectives1:21
Social Engineering and Downloaders3:09
Explore how social engineering tricks users into downloading and executing a Windows patch, create persistence in the startup folder, and use a downloader to install more malware.
Detecting Keyloggers7:26
Learn to catch a keylogger by creating a clean virtual machine baseline, snapshotting before and after malware, then analyze with PE Studio strings and keyboard hooks to reveal keystroke logging.
Detecting keylogger traffic 1/28:47
Catch malware traffic by tracing a keylogger's keystrokes exfiltration to a command-and-control server, using binary analysis with CFF Explorer, strings, HTTP requests, and Wireshark.
Detecting keylogger traffic 2/29:16
Analyze malware traffic with process hacker and process monitor to identify triggering processes, monitor connections to a command and control center, and observe timer-driven activity and file changes.

Section presentation and learning objectives1:06
Explore how attackers hide malware in deals and use remote code injection to infect legitimate Windows processes, including creating a malicious DLL and an injector.
What are DLLs? Imports/Exports/Apis, Introduction to Dll Injection4:44
Dynamic link libraries, or dlls, provide export and import APIs for programs. Learn dll injection, inserting code into running processes to enable persistence and hide malware.
DLL injection tecniques, Understanding Remote Code Injection3:56
Learn remote dll injection in detail: obtain a victim process handle, allocate and write memory, and create a remote thread using LoadLibrary to load a dll, with hands-on code practice.
Coding Remote DLL injection6:46
Coding malware into DLLs3:35
DLLs and malware

Section presentation and learning objectives0:47
DLL analysis with rundll3210:09
Analyze a malicious dll by executing exportable functions with rundll32 to observe behavior, using CFF Explorer to inspect exports and run functions independently.
DLL analysis with x32dbg9:12
At the end of this video you'll find an: UPDATE---> Reaching dll8 entry point.
According to x32dbg last release.
DLL analysis combining x32dbg, rundll32 and procmon6:22
Combine x32dbg, rundll32, and procmon to debug a dll entry point, monitor actions, and reveal a keylogger that creates and writes files.
DLL analysis with Noriben4:40

Section presentation and learning objectives4:10
Explore what a keylogger is, its purpose, attacks, and prevention methods, and examine two proof of concept keyloggers with line by line code explanations.
Keylogger TotalAware3 code review8:19
Explore a proof-of-concept Windows keylogger in a C++ console project, reviewing keystroke capture via GetAsyncKeyState, console hiding, caps lock handling, and ASCII-based mapping.
Keylogger TotalAware2 presentation1:37
Explore the development of a sophisticated keylogger, including a Facebook activity filter, keystroke storage, and a command-and-control communication module, with explanations of delegates and the keyboard listener.
TotalAware2 Facebook spy module 1/26:27
Explore the Total Aware two Facebook spy module, demonstrating a keylogger that captures keystrokes when the active window contains Facebook and writes them to a log using a string builder.
TotalAware2 Facebook spy module 2/26:00
Explore a proof-of-concept malware module that logs keystrokes and posts the log to a command-and-control center, with basic hiding in a Windows form app and unencrypted data.
Delegates in C#6:44
Explore how delegates work in C Sharp, declare a delegate, assign a target method, and invoke synchronously or asynchronously to enable events and callbacks.
TotalAware2 keyboard listener 1/27:49
TotalAware2 keyboard listener 2/27:05
Finish the keyboard listener review by examining the async dispatcher, key down and key up events, windows messages, and C# events and delegates, encouraging study and experimentation before ransomware topics.
Keyloggers

Requirements

Basic computer skills and some knowledge of any programming language are recommended but not required.

Description

NEW MODULE!!! Fileless Malware and Living-off-the-Land Attacks (September 2026)

This course continues to evolve. The latest module explores fileless malware and Living-off-the-Land techniques, including PowerShell execution, encoded commands, trusted Windows utilities, Script Block Logging, and Event ID 4104.

As with the other modules, you will receive clear theoretical explanations, a guided practical laboratory, and supporting resources (All included in resource section). The emphasis remains on understanding attacker behavior so that it can be investigated, detected, and prevented.

Learn Malware Analysis by Understanding How Malware Works

Malware analysis becomes easier when you understand the behavior behind the evidence.

In this hands-on course, we guide you from fundamental concepts to practical static, dynamic, code, system, and network analysis. You will work with controlled proof-of-concept samples inside an isolated Windows laboratory and observe the artifacts they produce.

Instead of relying only on definitions, you will examine processes, files, registry activity, PowerShell events, network traffic, DLL behavior, persistence mechanisms, obfuscation, and other evidence that analysts use during real investigations.

The course covers:

Develop controlled proof-of-concept malware samples, for academic purposes.
Safe malware-analysis laboratory configuration.
Malware types, infection vectors, and infection stages.
Static and dynamic análisis.
Portable Executable fundamentals.
File identification, fingerprinting, strings, and obfuscation.
Process monitoring and behavioral análisis.
Malicious DLLs and DLL execution.
Keylogger behavior and detection.
Ransomware behavior, analysis, and recovery concepts.
Windows shims.
Fileless malware and Living-off-the-Land techniques.
PowerShell logging and Event ID 4104.
Command-and-Control concepts.
Network traffic análisis.
Indicators of Compromise.

A Practical, Lab-Driven Course

You will not simply watch slides. Throughout the course, you will follow guided demonstrations and reproduce the analysis process inside your own isolated laboratory.

You will learn how to:

Observe what a suspicious program changes in Windows.
Investigate processes and execution chains.
Analyze suspicious DLL activity.
Inspect network communications.
Decode and interpret encoded PowerShell commands.
Correlate system behavior with Windows event logs.
Extract useful Indicators of Compromise.
Convert technical evidence into detection opportunities.

Understand the Source Code Behind the Behavior

The course follows a simple principle:

You cannot effectively analyze behavior that you do not understand.

For this reason, selected proof-of-concept malware source code is provided for controlled academic study. We explain important components and connect the code with the resulting system and network evidence.

The objective is not to weaponize malware. The objective is to help future analysts understand how malicious behavior is implemented, how it appears during execution, and how defenders can identify it.

Included Resources

Depending on the module, the course includes:

· Rams1: A Ransomware malware sample (full code provided for academic purposes).

· DecryptRams1: Software to decrypt files encrypted by Rams1 (full code provided for academic purposes).

· Ransomware Help: A document to assist you if you get infected.

· TotalAware2: A Keylogger that can steal Meta/Facebook credentials and connect to a Command and Control Center (full code provided for academic purposes).

· TotalAware3: A Keylogger written in C++ (full code provided for academic purposes).

· Injector7: Injects malicious code into a legitimate Windows process (full code provided for academic purposes).

· Dll4: A malware sample coded in a DLL (full code provided for academic purposes).

· Dll8: Demonstrates how to use export functions in a DLL (full code provided for academic purposes).

· Practices: A document containing the lab exercises guide.

· Lab Requirements and Quick Guide: A document to help you set up a safe lab for malware analysis.

· Web Resources: A document with web pages we’ll use throughout the course.

· CriticalPatchWin1.0: A malware sample designed to trick users into downloading malware (full code provided for academic purposes).

· Defensive Security Lab Guide: A complete step-by-step document for safely reproducing and analyzing a benign fileless PowerShell execution chain. It covers telemetry configuration, Base64 encoding and decoding, Word macro execution, and correlation of Sysmon Event ID 1, Security Event ID 4688, and PowerShell Event ID 4104.

· Invoke-LabEncodedCommand ps1: A PowerShell helper script for building, running, and decoding a completely benign Base64-encoded command. It safely reproduces -EncodedCommand telemetry while creating a harmless marker file and opening Calculator for verification.

· Sysmon-lab-fileless.xml: A Sysmon configuration file designed to capture detailed process-creation telemetry during the fileless execution lab. It helps identify the WINWORD.EXE → powershell.exe parent-child chain, command-line arguments, process hashes, and other forensic evidence.

All samples and demonstrations are intended exclusively for ethical education, defensive research, and execution within an isolated laboratory.

Why Take This Course?

This course can help you build a practical foundation for further study in:

Malware analysis.
Digital forensics and incident response.
Security operations.
Threat hunting.
Windows security.
Cybersecurity research.

Whether you are beginning your cybersecurity journey or expanding your existing technical knowledge, you will gain practical experience connecting source code, execution behavior, system artifacts, logs, and network evidence.

The course is compatible with Windows 10 and Windows 11 laboratories and is part of the Sanru Online Academy.

We are committed to answering course-related questions, maintaining the material, and adding new defensive-analysis modules over time.

Learn safely, analyze methodically, and turn suspicious behavior into evidence.

This course is not intended for anyone seeking to create, weaponize, distribute, or deploy malware against real systems.

Who this course is for:

Beginners who want to build a practical foundation in malware analysis.
Cybersecurity students who want experience beyond theoretical explanations.
Aspiring malware analysts, SOC analysts, threat hunters, and incident responders.
Programmers who want to understand how malicious Windows software behaves.
IT professionals who want to recognize suspicious system and network activity.
Cybersecurity researchers who want to strengthen their knowledge of Windows threats.
Learners interested in static analysis, dynamic analysis, digital forensics, or reverse engineering.

Hands-on Malware Analysis (Windows 10/11 compatible)

What you'll learn

Explore related topics

Course content

Presentation2 lectures • 4min

Introduction to Malware Analysis4 lectures • 16min

Setting up the Lab6 lectures • 27min

Precautions Before Starting Any Lab1 lecture • 3min

Static Analysis6 lectures • 38min

Dynamic Analysis1 lecture • 3min

Hands-on Static and Dynamic Analysis5 lectures • 30min

Malware in DLLs5 lectures • 20min

Analyzing malicious DLLs5 lectures • 31min

Coding Keyloggers8 lectures • 48min

Requirements

Description

Who this course is for: