CREST CREST Malware Analysis & Reverse Engineering 2

Question 1

What is a 'dropper' in malware terminology?

Accepted Answer

A first-stage malware component that installs additional malware payloads

Answer

A dropper is initial-stage malware whose primary function is to install or download and execute a secondary, more capable malware payload.

Question 2

Which command-and-control (C2) technique uses DNS requests to exfiltrate data and receive commands?

Accepted Answer

DNS tunneling

Answer

DNS tunneling encodes C2 commands and exfiltrated data within DNS query and response records, evading network controls that allow DNS traffic.

Question 3

In process injection, what is the purpose of the 'CreateRemoteThread' Windows API call in malware?

Accepted Answer

Injecting and executing code within another process's memory space

Answer

CreateRemoteThread allows malware to create a thread in a remote process, enabling code injection into legitimate processes like explorer.exe to evade detection.

Question 4

What does 'living off the land' (LotL) mean in the context of modern malware and red team operations?

Accepted Answer

Using built-in OS tools (PowerShell, WMI, certutil) to perform malicious actions without dropping custom malware files

Answer

LotL attacks abuse legitimate, built-in OS utilities to execute malicious actions, making detection harder because no novel malware binaries are introduced.

Question 5

When analyzing network traffic from malware in a sandbox, what characteristic indicates Domain Generation Algorithm (DGA) activity?

Accepted Answer

High volume of failed DNS lookups for algorithmically generated nonsense domain names

Answer

DGA malware generates many pseudo-random domain names, querying them until it finds one the attacker has registered, producing large numbers of NXDOMAIN responses.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST CREST Malware Analysis & Reverse Engineering 2