GREM Memory Forensics & Runtime Analysis 3

Question 1

What distinguishes 'Process Doppelgänging' from process hollowing as a defense evasion technique?

Accepted Answer

Process Doppelgänging uses NTFS transactions to load malicious code so the file appears as a legitimate clean file to security tools

Answer

Process Doppelgänging unmaps the target process image before writing shellcode

Answer

Process Doppelgänging patches the SSDT to redirect system calls

Answer

Process Doppelgänging injects code via Windows Atom tables

Question 2

Which Volatility plugin helps identify kernel-level rootkits by detecting hooks in the System Service Descriptor Table (SSDT)?

Accepted Answer

ssdt

Answer

modules

Answer

driverscan

Answer

callbacks

Question 3

When a malware sample suspends a thread and modifies its CONTEXT structure to redirect execution (SetThreadContext), what injection technique is being used?

Accepted Answer

Thread Execution Hijacking (Suspend-Inject-Resume)

Answer

Process Hollowing

Answer

APC Injection

Answer

Reflective DLL Injection

Question 4

What memory forensics artifact can reveal the original filename of malware that has been renamed or deleted from disk?

Accepted Answer

The \Device\HarddiskVolume path stored in the VAD node's FileObject for memory-mapped sections

Answer

The process token privileges in the EPROCESS structure

Answer

The handle table entries for open mutexes

Answer

The SSDT hook address stored in the KPCR

Question 5

During sandbox analysis, a malware sample calls VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread targeting explorer.exe. What technique is most likely being employed?

Accepted Answer

Classic remote thread injection (DLL or shellcode injection)

Answer

AtomBombing

Answer

Process Doppelgänging

Answer

Heaven's Gate (WoW64 abuse)

Question 6

What is the significance of the 'InLoadOrderLinks' field within the LDR_DATA_TABLE_ENTRY structure when analyzing a memory dump?

Accepted Answer

It links each loaded module into the PEB's loader doubly-linked lists; unlinking it hides a DLL from standard enumeration

Answer

It stores the base address of the first loaded module in kernel space

Answer

It holds the export directory of each loaded DLL

Answer

It records the timestamp when each DLL was loaded

Question 7

Which approach is most effective for detecting a user-mode rootkit that hides processes by unlinking them from the PEB module list and the active process list?

Accepted Answer

Cross-view analysis comparing PEB module lists, VAD regions, and physical memory pool tag scans for EPROCESS structures

Answer

Reviewing Windows Security Event Log entries for process creation (Event ID 4688)

Answer

Examining network connections with netstat and correlating with known process PIDs

Answer

Checking the Windows Registry Run keys for unauthorized startup entries