GCIA Malware Analysis and Behavioral Analysis 3

Question 1

Which tool is commonly used on Windows to monitor registry, file system, and process activity during dynamic malware analysis?

Accepted Answer

Process Monitor (ProcMon)

Answer

Sysinternals Process Monitor captures real-time file system, registry, and process/thread activity, making it essential for behavioral analysis.

Question 2

A malware binary's strings reveal 'VirtualProtect', 'LoadLibraryA', and 'GetProcAddress' but few other imports. What does this import pattern suggest?

Accepted Answer

The binary is packed or uses dynamic API resolution

Answer

Minimal imports combined with memory-manipulation APIs suggests the malware resolves additional API addresses at runtime to evade static analysis.

Question 3

During process hollowing analysis, which action occurs AFTER the attacker creates a suspended legitimate process?

Accepted Answer

The attacker unmaps the legitimate process's memory and maps malicious code

Answer

Process hollowing unmaps the target's code section with NtUnmapViewOfSection and then writes malicious code in its place before resuming the thread.

Question 4

An IDS alert fires on traffic containing 'GET /search?q=aW5mb3N0ZWFsZXI=' to a known-bad IP. What should an analyst suspect about the query parameter?

Accepted Answer

Base64-encoded C2 command or data

Answer

Base64 encoding in HTTP parameters is frequently used by malware to obfuscate commands or stolen data passed to C2 infrastructure.

Question 5

What is the primary difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines the binary without executing it; dynamic analysis observes runtime behavior

Answer

Static analysis inspects code, strings, and structure without execution, while dynamic analysis runs the sample and observes its actual behavior.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Malware Analysis and Behavioral Analysis 3