REnigma is an advanced semi-automated malware analysis tool designed to give enterprise network defenders a safe, effective, and efficient environment to manually execute and inspect malware behavior. Originally developed at the Johns Hopkins University Applied Physics Laboratory (JHU/APL) with funding from the United States Government, REnigma uses advanced Virtual Machine Record and Replay technology to capture everything that happens inside of a virtual machine at nearly full speed and perfectly replay execution down to the instruction level. With this capability, analysts can easily capture second stages, defeat advanced packers, extract IOCs from memory, and much more. This talk will cover how REnigma works, how REnigma is deployed within an enterprise environment, and give a demonstration of REnigma analyzing malware.

Speaker: Jim Stevens, Co-Founder Deterministic Security, LLC