GCIA Malware Analysis and Behavioral Analysis 2

Question 1

During dynamic analysis of a suspicious binary, you observe it calling CreateRemoteThread targeting explorer.exe. What technique is most likely being used?

Accepted Answer

Remote thread injection

Answer

DLL hijacking

Answer

Process hollowing

Answer

AtomBombing

Question 2

A malware sample queries HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run during execution. What persistence mechanism is it likely establishing?

Accepted Answer

Registry Run key persistence

Answer

Service installation

Answer

Scheduled task creation

Answer

Boot sector modification

Question 3

In a network capture from an infected host, you see HTTP POST requests every 60 seconds to a domain with a high entropy name like 'xkqzmvprtbl.com'. What C2 technique does this suggest?

Accepted Answer

Domain generation algorithm (DGA)

Answer

Fast flux DNS

Answer

DNS tunneling

Answer

Sinkholing

Question 4

When analyzing a packed executable, you find the original entry point (OEP) after the unpacking stub executes. What is the primary purpose of finding the OEP?

Accepted Answer

To dump the unpacked code for static analysis

Answer

To identify the compiler used

Answer

To determine the packer version

Answer

To calculate the file hash

Question 5

A malware sample uses VirtualAllocEx followed by WriteProcessMemory and then CreateRemoteThread. Which attack technique does this sequence describe?

Accepted Answer

Classic process injection (shellcode injection)

Answer

Process hollowing

Answer

DLL side-loading

Answer

Reflective DLL injection

Question 6

During behavioral analysis, a sample is observed deleting Volume Shadow Copies using vssadmin.exe. What type of malware behavior does this indicate?

Accepted Answer

Ransomware anti-recovery preparation

Answer

Rootkit installation

Answer

Keylogger initialization

Answer

Botnet enrollment

Question 7

An analyst uses Wireshark and observes a malware sample sending DNS TXT record queries containing base64-encoded data. What exfiltration technique is being used?

Accepted Answer

DNS tunneling

Answer

HTTP tunneling

Answer

ICMP covert channel

Answer

SMTP exfiltration