Setting Up INetSim (Fake Internet Simulator) for Malware Analysis

Introduction

INetSim (Internet Services Simulation Suite) is a powerful tool used in malware analysis to simulate common internet services. It allows security analysts to analyze malware behaviour in a controlled environment without exposing real networks. In this guide, we will configure INetSim on REMnux to act as a fake internet, ensuring that any DNS or HTTP requests from FLARE VM are redirected to the simulated environment.

Before proceeding, follow these links to complete the initial steps.

link 1: https://medium.com/@devaaravindlutukurty/setting-up-a-private-network-for-malware-analysis-with-flare-vm-and-remnux-562d9c228e0f

link 2: https://medium.com/@devaaravindlutukurty/setting-up-virtualbox-host-only-network-for-malware-analysis-and-how-it-helps-27933595d14a

Step 1: Installing and Configuring INetSim

Starting INetSim

To begin, start INetSim by running the following command on REMnux:

To begin, start INetSim by running the following command on REMnux:

By default, INetSim will listen only on localhost (127.0.0.1), meaning it won’t accept connections from external machines like FLARE VM.

Modifying INetSim Configuration

To allow external connections, we need to edit the INetSim configuration file.

1. Open the configuration file in a text editor:

• sudo nano /etc/inetsim/inetsim.conf

1. Locate the service_bind_address setting and modify it to listen on all network interfaces:

• service_bind_address 0.0.0.0

1. Set a default DNS response to REMnux’s IP address (10.0.0.3 in this setup):

Remnux IP Address

• dns_default_ip 10.0.0.3

1. Save and exit (CTRL + X, then Y, then ENTER).

Restarting INetSim

Now, restart INetSim to apply the changes: Upon successful startup, INetSim will simulate multiple internet services:

Step 2: Configuring FLARE VM to Use INetSim

Now that INetSim is running, we need to configure FLARE VM (Windows malware analysis VM) to route all DNS queries through INetSim.

1. Open Control Panel on FLARE VM.
2. Navigate to Network and Sharing Center > Change Adapter Options.
3. Right-click Ethernet, then select Properties.
4. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
5. Under the General tab, select Use the following DNS server addresses.
6. Set the Preferred DNS server to 10.0.0.3 (REMnux IP address).

Network adapter IP4 settings

Click OK to save the changes.

Step 3: Testing the Fake Internet Simulation

Now, whenever malware on FLARE VM attempts to connect to an external URL, it will be redirected to the INetSim fake internet simulator, preventing it from reaching real external domains. This setup allows analysts to:

• Capture malware-generated DNS requests.
• Analyze HTTP, FTP, SMTP, and other service requests.
• Extract network-based indicators of compromise (IOCs) safely.

Conclusion

By configuring INetSim and FLARE VM in a private network, security analysts can safely observe malware behaviour and extract useful IOCs. This setup is essential for conducting malware research without exposing real infrastructure to potential threats.