macOS Analysis VM with UTM
Overview
UTM provides QEMU-based virtualization for macOS, supporting both Apple Silicon and Intel Macs. Use it to run Windows or Linux analysis VMs.
Installation
- Download UTM from mac.getutm.app
- Or install via Homebrew:
brew install --cask utm
Creating a Windows Analysis VM
- Download Windows 11 ARM ISO (for Apple Silicon) or x64 ISO (for Intel)
- UTM → Create New VM → Virtualize → Windows
- Allocate 4GB+ RAM, 2+ CPUs, 60GB disk
- Network: Host Only
- Install Windows, then install SPICE Guest Tools
Creating a REMnux VM
- Use x64 emulation on Apple Silicon (slower but functional)
- REMnux is x86_64/amd64 only, so ARM-native installs are not supported
- Configure host-only networking
Limitations on Apple Silicon
- x86 malware samples may need emulation within the VM
- Performance overhead for x64 emulation
- Consider using a dedicated x86 analysis machine for heavy RE work
Snapshot Management
UTM supports snapshots: VM → right-click → Snapshots → New