Best config for Azure VM for Malware Analysis Lab

Question

Does any have an idea or experience, please share the best configuration.

Note: I am looking to build a small testing lab for SOC team.

Appreciated!

Answer 1

at first, you need to create an isolated network if possible to create a controlled area
so please at first network on Azure then

the important thing is what kind of analysis you will do

dynamic analysis or static analysis and what kind of tools you will use

commercial (IDA Pro etc. ) or open source (ollydbg etc.) since these tools have different hw requirements

and the operating system set is important but also the patch levels are much more important

since most patches are released against malware etc.
so you need to prepare mostly unpatched versions of the OS

this means that instead of using premade images

it is better to use custom images so you can use also legacy OS like XP or 7 (without any SP)

I offer you to talk with the malware analysis team and create a tool list (so you can understand the HW requirements ) and again create a OS list for malware analysis testing so you can prepare your test sets

and finally it is important to automate lab creation process since you may need to create difference lab setups for different analysts and also you need to recreate this setups almost everytime when you finalize the test process