GCIA Malware Analysis and Behavioral Analysis 2

Question 1

During dynamic analysis of a suspicious binary, you observe it calling CreateRemoteThread targeting explorer.exe. What technique is most likely being used?

Accepted Answer

Remote thread injection

Answer

CreateRemoteThread is the classic Windows API used for remote thread injection, where code is injected into another process's address space.

Question 2

A malware sample queries HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run during execution. What persistence mechanism is it likely establishing?

Accepted Answer

Registry Run key persistence

Answer

The Run key under HKLM or HKCU causes listed programs to execute automatically at system startup, making it a common persistence location.

Question 3

In a network capture from an infected host, you see HTTP POST requests every 60 seconds to a domain with a high entropy name like 'xkqzmvprtbl.com'. What C2 technique does this suggest?

Accepted Answer

Domain generation algorithm (DGA)

Answer

High-entropy, algorithmically generated domain names are characteristic of DGAs, where malware generates many potential C2 domains to evade static blocklists.

Question 4

When analyzing a packed executable, you find the original entry point (OEP) after the unpacking stub executes. What is the primary purpose of finding the OEP?

Accepted Answer

To dump the unpacked code for static analysis

Answer

Once execution reaches the OEP, the malware is fully unpacked in memory, allowing analysts to dump a clean copy for static analysis.

Question 5

A malware sample uses VirtualAllocEx followed by WriteProcessMemory and then CreateRemoteThread. Which attack technique does this sequence describe?

Accepted Answer

Classic process injection (shellcode injection)

Answer

This three-API sequence — allocate memory in target, write shellcode, execute via remote thread — is the canonical classic shellcode injection pattern.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Malware Analysis and Behavioral Analysis 2