Speakeasy

Speakeasy is an open source Windows malware emulation framework from Mandiant. Its main goal is "high resolution emulation of the Windows operating system for dynamic malware analysis for the x86 and amd64 platforms." It runs user-mode executables and DLLs, kernel-mode drivers, and shellcode.

Speakeasy does not run the real Windows DLLs. Python handlers model the Windows APIs, and the sample interacts with an emulated file system, network, and registry. As a sandbox, this gives less noise than a full system: "the only activity that can be recorded is either written by the malware author, or statically compiled within the binary." Each API call, file operation, and network request goes into a JSON report. When a sample needs an API or a part of the system that Speakeasy does not model, the run can stop early or go a different way. For these samples, use a full system sandbox such as VMRay.

Speakeasy is licensed under the MIT license. The source is at github.com/mandiant/speakeasy, and the Python package is speakeasy-emulator. For background, see the Mandiant blog post Emulation of Malicious Shellcode With Speakeasy.

How the add-on uses Speakeasy

The add-on installs Speakeasy as a Python package in IDA's Python environment and runs the speakeasy command as a separate process.

Speakeasy is the default backend for isolated system emulation. The add-on starts Speakeasy with its GDB server and connects IDA's remote GDB debugger to it. It also tells Speakeasy to treat all modules and API functions as present. When the sample calls an API that Speakeasy does not model, the call returns 1 and the session continues.

For sandbox integration, select Malware Analysis > Sandbox > Speakeasy (isolated system emulator) > ...run sandbox. The add-on runs the sample in Speakeasy with memory tracing and code coverage turned on, then shows the report in the trace view. To show a report that you made before, select ...load existing report (.json). The emulation_timeout setting limits the run time. For the steps, see Detonate a sample in Speakeasy.

For automated unpacking, set default_debugger to speakeasy. The unpacker then starts Speakeasy through the isolated system emulator and runs its heuristics on the emulated process.

For a different emulator that runs the real Windows DLLs, see Sogen.