Third, besides network environment, it also simulates most common host events to stimulate potential malicious behaviors of a malware. Second, it employs a multi-virtual machine framework to simulate the network environment for malware analysis, so that network behaviors of a malware are stimulated to a large extend. First, it does not rewrite the binary code of analysis file or interfere with its normal execution, so that behavior data are obtained more stealthily and transparently. By modifying the source code of Qemu, Osiris is implemented at the virtual machine monitor layer and has the following advantages. It collects API calls invoked not only by main process of the analysis file, but also API calls invoked by child processes which are created by main process, injected processes if process injection happens, and service processes if the main process creates services. In this paper, we present Osiris system which is a tool to capture behaviors of executable files in Windows system.

To perform behavior based malware analysis, behavior capturing is an important prerequisite.

Process monitor malware analysis