Real-Time Interactive Malware Analysis with VMRay: Manual Investigation & Incident Response Guide

While automated malware analysis handles the majority of samples at scale, incident responders frequently need to investigate suspicious files, URLs, and code snippets manually. VMRay's interactive analysis feature complements automated analysis by providing real-time, hands-on control of the analysis environment through a VNC viewer interface.

This guide shows incident response teams how to use interactive analysis to scrutinize phishing URLs, explore malware applications, download and execute suspicious files, and identify indicators of compromise (IOCs) that automated systems might miss.

Interactive Analysis: Complementing Automated Malware Detection

VMRay's analysis platform operates in two modes: automated and interactive. Automated analysis is ideal for high-volume screening—submitting hundreds or thousands of samples for rapid verdict generation. Interactive analysis is ideal for focused investigation—when you need to manually scrutinize a specific threat.

When to Use Interactive Analysis: Incident responders typically use interactive analysis when:

• A suspicious file or URL has raised a cautionary flag during investigation

• Automated analysis results are inconclusive (verdict: Suspicious)

• You need to explore specific capabilities of a phishing page or malware

• You need to download files or code from a sample for deeper analysis

• You need to classify malware behavior (what does this malware actually do?)

• You need to identify specific IOCs (C2 servers, exfiltration targets, etc.)

Key Advantage: Interactive analysis gives you human judgment in the loop. An analyst can make decisions that automated systems can't: click specific links, explore hidden directories, interact with UI elements, and understand the attacker's intent.

Submitting Samples for Interactive Analysis

Submitting a sample for interactive analysis is straightforward and similar to standard submissions, with one key difference: you explicitly enable the interactive mode.

Step 1: Access the Submission Dialog From the VMRay dashboard, click on the sample submission section. Select the sample type (in this example, "URL to analyze"). Paste your suspicious URL or upload your file.

Step 2: Enable Interactive Mode On the submission page, you'll see two options: "Automated analysis" (checked by default) and "Interactive analysis" (disabled by default). To use interactive analysis, you must enable the interactive setting.

Important Note: Enabling interactive mode disables the automated user interaction feature. This is intentional—when a human analyst is controlling the environment via VNC, you don't want automated browser automation clicking links on its own.

Step 3: Submit the Sample Click Submit to send the sample for interactive analysis. You'll be redirected to the dashboard.

Step 4: Wait for Analysis to Start Your sample appears in the analysis queue at the top of the dashboard. Within moments (depending on infrastructure load), the analysis begins.

VNC Viewer Interface: Real-Time Control & Interaction

Once your interactive analysis starts, you'll see the VNC viewer—a real-time remote desktop viewer that lets you control the analysis environment as if you were sitting at the keyboard.

What the VNC Viewer Shows: The VNC viewer displays the desktop of the sandboxed environment where your sample is being analyzed. For URL analysis, this is a full web browser (typically running in an isolated Windows environment). For file analysis, you see the Windows desktop with the file opened/executed.

Your Control: You have full mouse and keyboard control. You can:

• Click links and buttons — Navigate the phishing page, explore the malware UI

• Enter text — Type into login forms (to observe behavior)

• Download files — If the page offers a download, download it

• Execute files — Run downloaded executables to observe behavior

• Explore directories — Look for hidden folders, configuration files, etc.

• View system resources — Open Task Manager to see network connections, process names, resource usage

Real-Time Behavior Monitoring: While you're interacting with the sample via VNC, VMRay is simultaneously monitoring all behavior: network connections, file operations, registry changes, process creation, and more. Everything you do is recorded and will appear in the final analysis report.

Phishing Investigation Workflow: Real-World Example

The most common use case for interactive analysis is investigating phishing URLs. Here's a real example: an analyst receives a malicious URL flagged as suspicious. Using interactive analysis, they can examine the phishing page in detail.

Step 1: The Phishing Page The victim sees a login screen designed to mimic a popular social media website. The page looks authentic—it has the correct logo, color scheme, and layout. But it's actually hosted on the attacker's infrastructure.

Step 2: Manual Scrutiny The analyst can use the VNC viewer to interact with the phishing page. They can:

• Examine the page source code (right-click → View Page Source)

• Check the URL bar to confirm the domain (is it really the legitimate company's domain?)

• Look for SSL certificate information (is it a valid certificate for that domain?)

• Explore links on the page to see where they lead

• Look for open directories or file uploads

Step 3: Advanced Exploration The analyst might type test credentials into the login form to observe what happens. When they click "Login," the form submits to an attacker-controlled server, and VMRay monitors this network connection. The analyst can see the C2 server's IP, hostname, and the data transmitted.

Step 4: IOC Identification From this interactive analysis, the analyst identifies IOCs:

• Phishing domain: attacker-phishing-site.com

• C2 server IP: 192.168.1.100

• Form submission endpoint: /login.php

These IOCs can be added to blocking rules, SIEM detections, and threat intelligence feeds.

File Execution & Dynamic Analysis During Interactive Investigation

Interactive analysis isn't limited to URLs. You can also use it to manually execute and observe malware behavior. This is particularly useful when automated analysis results are inconclusive.

Workflow: Submit a suspicious executable for interactive analysis. When the VNC viewer opens, you'll see the Windows desktop. You can:

Option 1: Automated Execution The malware might auto-execute when you open the file. You'll observe it running in real-time via VNC and can see its behavior (window pops up, files created, network connections established).

Option 2: Manual Execution If the file doesn't auto-execute, you can manually run it from the desktop. Right-click the file, select "Open" or "Execute," and observe what happens.

Exploration During Execution: While the malware is running, you have full control to:

• Open Task Manager to see process names, network connections (netstat), and resource usage

• Navigate to system directories to see if the malware created files

• Check the Registry for persistence mechanisms

• Monitor network activity to identify C2 communication

Download & Execute Additional Payloads: If the malware downloads secondary payloads, you can download those files and execute them manually to understand the attack chain. Each stage is monitored and recorded.

Real-Time Behavior Monitoring & Report Generation

Throughout your interactive session, VMRay continuously monitors all system activity. When you disconnect from the VNC viewer (or when the session times out), the analysis ends and VMRay generates a comprehensive report.

What Gets Monitored: Every action during your interactive session is recorded:

• Network connections: Every DNS query, HTTP request, TCP/UDP connection

• File operations: Files created, modified, deleted, read by the malware

• Process creation: Any processes spawned by the sample or your actions

• Registry modifications: Changes to Windows Registry (persistence, configuration)

• DLL injection: If the malware injects code into other processes

• User actions: Your clicks, keystrokes, file downloads—all captured in context

Report Generation: When the analysis completes, you're automatically redirected to the full VMRay analysis report. This report includes:

• Reputation verdict: Is this known to be malicious?

• VTI scoring: VMRay's threat scoring based on observed behavior

• Behavioral indicators: Network connections, file operations, registry changes

• Indicators of Compromise (IOCs): Specific domains, IPs, hashes to block

• MITRE ATT&CK mapping: How does the malware align with known attack techniques?

VTI Scoring & Reputation Engine Integration

After your interactive analysis completes, VMRay combines your manual findings with automated analysis results. The VTI (VMRay Threat Identifier) scoring system evaluates what was discovered.

VTI Scoring in Action: In the phishing URL example, the VTI scoring engine noted that:

• The URL uses the same favicon as a legitimate company (visual impersonation)

• The page is hosted on a CMS and web hosting service (generic infrastructure = suspicious)

• The domain was recently registered (typical for phishing campaigns)

• Form submission goes to attacker infrastructure (credential harvesting detected)

Combining these indicators, the VTI scoring engine assigns a malicious verdict with high confidence.

Reputation Engine: The reputation engine flagged the URL as malicious based on known malicious hashes, domains, and IPs. If you encountered this URL, millions of other security professionals have likely already analyzed it.

IOC Identification & Malware Classification Workflow

The ultimate goal of incident response is identification, classification, and remediation of threats. Interactive analysis supports all three.

IOC Identification: During interactive analysis, you identify specific indicators that can be blocked or monitored:

• Domains: Malicious C2 servers, phishing hosts, payload delivery servers

• IP Addresses: Backend infrastructure used by attackers

• File Hashes: MD5, SHA-256 of malware binaries

• Email addresses: Command and control contacts, attacker infrastructure

• URLs: Specific phishing pages, payload delivery URLs

Malware Classification: Interactive analysis helps you classify malware by capability:

• Is it a Remote Access Trojan (RAT)? (command and control communication observed)

• Is it an infostealer? (data exfiltration to attacker servers observed)

• Is it ransomware? (encryption, ransom note displayed)

• Is it a worm? (self-propagation attempted)

This classification is critical for determining incident severity and response priority.

Frequently Asked Questions