CREST CREST Malware Analysis & Reverse Engineering 2 — Questions and Answers
Question 1: What is a 'dropper' in malware terminology?
- Malware that exfiltrates files to an attacker
- A first-stage malware component that installs additional malware payloads (Correct answer)
- A tool that drops firewall rules
- Ransomware that drops ransom notes
Correct answer: A first-stage malware component that installs additional malware payloads
A dropper is initial-stage malware whose primary function is to install or download and execute a secondary, more capable malware payload.
Question 2: Which command-and-control (C2) technique uses DNS requests to exfiltrate data and receive commands?
- HTTP beaconing
- DNS tunneling (Correct answer)
- ICMP covert channel
- SMTP C2
Correct answer: DNS tunneling
DNS tunneling encodes C2 commands and exfiltrated data within DNS query and response records, evading network controls that allow DNS traffic.
Question 3: In process injection, what is the purpose of the 'CreateRemoteThread' Windows API call in malware?
- Creating a new user account remotely
- Injecting and executing code within another process's memory space (Correct answer)
- Connecting to a remote C2 server
- Creating a remote desktop session
Correct answer: Injecting and executing code within another process's memory space
CreateRemoteThread allows malware to create a thread in a remote process, enabling code injection into legitimate processes like explorer.exe to evade detection.
Question 4: What does 'living off the land' (LotL) mean in the context of modern malware and red team operations?
- Malware that targets agricultural systems
- Using built-in OS tools (PowerShell, WMI, certutil) to perform malicious actions without dropping custom malware files (Correct answer)
- Exfiltrating data to cloud storage services
- Malware designed for air-gapped environments
Correct answer: Using built-in OS tools (PowerShell, WMI, certutil) to perform malicious actions without dropping custom malware files
LotL attacks abuse legitimate, built-in OS utilities to execute malicious actions, making detection harder because no novel malware binaries are introduced.
Question 5: When analyzing network traffic from malware in a sandbox, what characteristic indicates Domain Generation Algorithm (DGA) activity?
- Repeated connections to the same hardcoded IP
- High volume of failed DNS lookups for algorithmically generated nonsense domain names (Correct answer)
- Use of HTTPS for all C2 communications
- Connections only to Tor exit nodes
Correct answer: High volume of failed DNS lookups for algorithmically generated nonsense domain names
DGA malware generates many pseudo-random domain names, querying them until it finds one the attacker has registered, producing large numbers of NXDOMAIN responses.
Question 6: What is the significance of finding 'persistence mechanisms' when analyzing malware?
- It indicates the malware only runs once
- It shows how the malware survives system reboots, critical for full removal and understanding attacker access duration (Correct answer)
- It means the malware has no network capabilities
- It indicates the malware was authored by a nation-state
Correct answer: It shows how the malware survives system reboots, critical for full removal and understanding attacker access duration
Persistence mechanisms (registry Run keys, scheduled tasks, services) ensure malware restarts after reboot; identifying them is essential for complete remediation.
CREST CREST Malware Analysis & Reverse Engineering 2
What is a 'dropper' in malware terminology?