Building a Professional Malware Analysis Lab with FLARE-VM

⚠️ Security Warning: This guide is intended for security researchers, malware analysts, and penetration testers operating in controlled, isolated environments. Never perform malware analysis on production systems or networks. Always follow organizational policies and legal guidelines.

Table of Contents

1. Introduction
2. Lab Architecture Overview
3. Prerequisites
4. Step 1: Provisioning the Windows VM
5. Step 2: Hardening the Analysis Environment
6. Step 3: Installing FLARE-VM
7. Step 4: Post-Installation Configuration
8. Snapshot Strategy & Safe Analysis Workflow
9. Troubleshooting Common Issues
10. Conclusion & Next Steps

Introduction

Malware analysis requires a dedicated, isolated, and reproducible environment to safely examine malicious code without risking contamination of production systems. FLARE-VM, developed by Mandiant, is a free, open-source Windows-based security distribution that automates the installation of essential reverse engineering and malware analysis tools [[2]].

This guide walks you through building a production-ready malware analysis lab using:

• VirtualBox/VMware for virtualization
• Windows 10 as the guest OS
• FLARE-VM for toolchain automation
• Group Policy for security hardening

By the end, you’ll have a clean, snapshot-ready VM optimized for dynamic and static malware analysis.

Lab Architecture Overview

┌─────────────────────────────────────┐
│         HOST MACHINE                │
│  (Your daily driver - secured)      │
└────────────┬────────────────────────┘
             │ Host-Only Network
             ▼
┌─────────────────────────────────────┐
│     MALWARE ANALYSIS VM             │
│  • Windows 10 (60+ GB disk)         │
│  • FLARE-VM toolchain               │
│  • Defender/Updates disabled        │
│  • Host-only networking             │
└────────────┬────────────────────────┘
             │ (Optional) Isolated LAN
             ▼
┌─────────────────────────────────────┐
│     OPTIONAL: REMNnux VM            │
│  • Linux-based analysis tools       │
│  • Network monitoring (Wireshark)   │
│  • Safe sample repository           │
└─────────────────────────────────────┘

🔒 Critical Principle: Your analysis VM should never have internet access during active malware execution. Use host-only or NAT networking with strict firewall rules [[7]].

Prerequisites

Before beginning, ensure you have:

Component — Requirement — Notes

Hypervisor VirtualBox 7+, VMware Workstation Pro/Player, or Hyper-VEnable nested virtualization if needed

Host OS Windows 10/11, Linux, or macOS16+ GB RAM recommended

Disk Space 80+ GB free60 GB for VM + overhead for snapshots

Internet Temporary connection Required only for initial setup and tool downloads

Admin Rights On host and guest VM Required for Group Policy and PowerShell execution

Username No spaces/special characters FLARE-VM requirement [[15]]

Step 1: Provisioning the Windows VM

1.1 Download Windows 10 ISO

1. Visit the official Microsoft download page: 👉 https://www.microsoft.com/en-us/software-download/windows10ISO
2. Select Download tool now to get the Media Creation Tool
3. Run the tool as Administrator and choose:

• ✅ Create installation media for another PC
• ✅ ISO file (save to your host machine)

1.2 Create the Virtual Machine

Using your hypervisor of choice:

# Example: VirtualBox CLI (optional automation)
VBoxManage createvm --name "MalwareLab-Win10" --register
VBoxManage modifyvm "MalwareLab-Win10" --memory 4096 --cpus 2
VBoxManage storagectl "MalwareLab-Win10" --name "SATA" --add sata
VBoxManage storageattach "MalwareLab-Win10" --storagectl "SATA" \
  --port 0 --device 0 --type hdd --medium win10_analysis.vdi --size 65536

Recommended VM Settings:

• RAM: 4 GB minimum (8 GB preferred)
• CPU: 2+ cores
• Disk: 60+ GB dynamically allocated VDI/VMDK
• Network: Bridged or NAT only for initial setup (switch to host-only later)
• Shared Folders: ❌ Disabled (prevents accidental host contamination)
• Clipboard/Drag-and-Drop: ❌ Disabled

1.3 Install Windows 10

1. Attach the Windows 10 ISO to the VM’s virtual DVD drive
2. Boot the VM and follow Windows Setup
3. During OOBE (Out-of-Box Experience):

• Create a local account (e.g., analyst)
• Skip Microsoft account linkage
• Disable Cortana, telemetry, and advertising ID
• Install Guest Additions/VMware Tools for improved integration

Step 2: Hardening the Analysis Environment

🛡️ Goal: Prevent Windows security features from interfering with malware execution or tool installation.

2.1 Disable Windows Defender via Group Policy

FLARE-VM requires Tamper Protection and real-time scanning to be disabled [[15]].

# Open Local Group Policy Editor
gpedit.msc

Navigate to: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus

Policy — Setting — Purpose

Turn off Microsoft Defender Antivirus✅ Enabled Disables entire Defender suite

Turn off real-time protection✅ Enabled Prevents on-access scanning

Configure local setting override✅ Enabled Allows GPO to override local settings

💡 Alternative: Use community scripts like windows-defender-remover for non-Pro editions lacking gpedit.msc [[15]].

2.2 Disable Windows Updates

Prevent automatic updates from altering your analysis environment:

# Via Group Policy
Computer Configuration → Administrative Templates → 
Windows Components → Windows Update → Configure Automatic Updates
→ Set to: Disabled

2.3 Configure Execution Policy

Allow PowerShell script execution for FLARE-VM installation:

# Run as Administrator
Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force

# Verify settings
Get-ExecutionPolicy -List

2.4 Final Pre-Installation Checklist

# Quick validation script
$checks = @{
    "Windows Version" = (Get-WmiObject Win32_OperatingSystem).Caption -match "Windows 10"
    "PowerShell Version" = $PSVersionTable.PSVersion.Major -ge 5
    "Disk Space (GB)" = (Get-PSDrive C).Free/1GB -gt 50
    "Defender Disabled" = -not (Get-MpComputerStatus).RealTimeProtectionEnabled
    "Username Valid" = $env:USERNAME -notmatch "[\s!@#$%^&*()]"
}

$checks.GetEnumerator() | ForEach-Object {
    $status = if ($_.Value) { "✅ PASS" } else { "❌ FAIL" }
    Write-Host "$($_.Key): $status"
}

✅ Pro Tip: Take a clean snapshot now labeled BASE-Win10-Hardened before proceeding.

Step 3: Installing FLARE-VM

3.1 Download the Installer

From an Administrator PowerShell session in your VM:

# Download install.ps1 to Desktop
$installerPath = "$([Environment]::GetFolderPath('Desktop'))\install.ps1"
(New-Object Net.WebClient).DownloadFile(
    'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
    $installerPath
)

# Unblock the script (critical for execution)
Unblock-File -Path $installerPath

3.2 Execute Installation

# Navigate to Desktop
Set-Location -Path "$([Environment]::GetFolderPath('Desktop'))"

# Run installer with password parameter
.\install.ps1 -password "YourAdminPassword"

# Optional: CLI-only mode for automation
.\install.ps1 -password "YourAdminPassword" -noWait -noGui

Installer Parameters Reference [[15]]:

Parameter — Description

-password <String>Required for reboot resilience via Boxstarter

-customConfig <Path>Use your own config.xml for package selection

-noGuiSkip interactive GUI; use defaults

-noWaitSkip pre-install confirmation prompt

-noChecks⚠️ Skip validation (not recommended)

3.3 What Gets Installed?

FLARE-VM leverages Chocolatey and Boxstarter to deploy 100+ tools, including:

🔍 Static Analysis

• Ghidra, IDA Free, Binary Ninja (community), dnSpy, PEStudio

🔬 Dynamic Analysis

• x64dbg, Process Monitor, Process Explorer, API Monitor, RegShot

🌐 Network & Memory

• Wireshark, Fiddler, Volatility, Rekall

🧰 Utilities

• 7-Zip, Notepad++, HxD, Python 3, pip, Visual C++ Redistributables

📦 Customization: Edit config.xml before installation to include/exclude packages or modify environment variables [[15]].

Step 4: Post-Installation Configuration

4.1 Switch to Host-Only Networking

Immediately after installation completes:

1. Power off the VM
2. In hypervisor settings, change network adapter to Host-Only or Internal Network
3. Power on and verify no internet connectivity:

Test-Connection google.com -Count 1 -Quiet  # Should return False

4.2 Create Analysis Snapshot

# Label your clean state
# Hypervisor-specific:
# VirtualBox: VBoxManage snapshot "VM-Name" take "FLARE-VM-CLEAN"
# VMware: vmrun snapshot "VM-Path" "FLARE-VM-CLEAN"

✅ Snapshot Naming Convention:

[TOOLCHAIN]-[OS]-[STATE]
Example: FLARE-VM-Win10-CLEAN-20260411

4.3 Configure Sample Handling Workflow

# Create isolated directories
New-Item -Path "C:\MalwareSamples" -ItemType Directory -Force
New-Item -Path "C:\AnalysisReports" -ItemType Directory -Force

# Set restrictive permissions (optional)
$acl = Get-Acl "C:\MalwareSamples"
$acl.SetAccessRuleProtection($true, $false)  # Disable inheritance
Set-Acl "C:\MalwareSamples" $acl

🔐 Sample Handling Best Practices [[11]]:

• Store samples in password-protected ZIPs (infected password convention)
• Never execute samples directly from shared folders
• Hash all samples (SHA256) before analysis: Get-FileHash sample.exe -Algorithm SHA256

Snapshot Strategy & Safe Analysis Workflow

Recommended Snapshot Chain

BASE-Win10-Hardened
│
├─► FLARE-VM-CLEAN          ← Start analysis from here
│   │
│   ├─► SAMPLE-XYZ-EXEC     ← After executing sample
│   │   │
│   │   └─► SAMPLE-XYZ-POST ← After memory dump/artifact collection
│   │
│   └─► TOOL-UPDATE-2026Q2  ← After updating analysis tools

Safe Analysis Checklist

- [ ] VM network set to host-only/internal
- [ ] Host firewall confirmed active
- [ ] Snapshot taken pre-execution (`Revert Point`)
- [ ] Sample hashed and logged
- [ ] Monitoring tools running (ProcMon, Wireshark, RegShot baseline)
- [ ] Analysis duration limited (e.g., 10-min execution window)
- [ ] Post-analysis: Revert to clean snapshot

🔄 Golden Rule: Always revert to a known-clean snapshot before analyzing a new sample.

Troubleshooting Common Issues

❌ Installation Fails at Package X

# Check logs in order of relevance:
Get-Content "$env:VM_COMMON_DIR\log.txt" -Tail 50
Get-Content "$env:PROGRAMDATA\chocolatey\logs\chocolatey.log" -Tail 100
Get-Content "$env:LOCALAPPDATA\Boxstarter\boxstarter.log" -Tail 50

Common Causes [[15]]:

1. Network timeout downloading tools → Retry installation
2. Defender re-enabled → Re-verify GPO settings
3. SHA256 hash mismatch in package → Update VM-Packages repo

❌ PowerShell Execution Policy Errors

# If scope conflict occurs:
Set-ExecutionPolicy Unrestricted -Scope CurrentUser -Force

# Verify effective policy:
Get-ExecutionPolicy -List | Where-Object {$_.ExecutionPolicy -ne 'Undefined'}

❌ FLARE-VM GUI Doesn’t Launch

• Ensure .NET Framework 4.7+ is installed
• Run PowerShell as Administrator
• Check Windows Event Viewer for .NET runtime errors

🆘 Still stuck? Search FLARE-VM Issues or subscribe to the mailing list: email subscribe to flare-external@google.com [[15]].

Conclusion & Next Steps

You now have a professional-grade malware analysis lab featuring:

✅ Isolated Windows 10 VM with hardened security settings ✅ Automated deployment of 100+ reverse engineering tools via FLARE-VM ✅ Snapshot-based workflow for repeatable, safe analysis ✅ Clear procedures for sample handling and contamination prevention

Recommended Next Steps

1. Practice with benign samples: Start with theZoo or MalwareBazaar (use caution)
2. Add REMnux: Deploy a complementary Linux VM for network analysis and safe sample storage [[10]]
3. Automate reporting: Integrate tools like capa, strings, and peframe into PowerShell analysis scripts
4. Join the community: Contribute to VM-Packages or share custom config.xml presets

📚 Further Reading:

• Mandiant’s FLARE-VM Documentation [[2]]
• Practical Malware Analysis Lab Setup [[11]]
• Network Isolation Strategies for Malware Labs [[13]]

⚖️ Legal Notice: FLARE-VM and associated tools are provided under the Apache 2.0 License. You are responsible for complying with all applicable laws and licenses when downloading, installing, or using analysis tools and malware samples. By proceeding with malware analysis, you acknowledge that you have authorization to examine the samples in your jurisdiction and for your intended purpose [[15]].

Last Updated: April 2026 | FLARE-VM v3.x Compatible