GREM Memory Forensics & Runtime Analysis 3

Question 1

What distinguishes 'Process Doppelgänging' from process hollowing as a defense evasion technique?

Accepted Answer

Process Doppelgänging uses NTFS transactions to load malicious code so the file appears as a legitimate clean file to security tools

Answer

Process Doppelgänging exploits NTFS transactions to create a transacted file containing malicious code, create a section from it, roll back the transaction, then launch a process from the section—leaving no file on disk.

Question 2

Which Volatility plugin helps identify kernel-level rootkits by detecting hooks in the System Service Descriptor Table (SSDT)?

Accepted Answer

ssdt

Answer

The `ssdt` plugin compares the current SSDT function pointers to the expected values in ntoskrnl.exe, flagging any entries that point outside the legitimate kernel module range.

Question 3

When a malware sample suspends a thread and modifies its CONTEXT structure to redirect execution (SetThreadContext), what injection technique is being used?

Accepted Answer

Thread Execution Hijacking (Suspend-Inject-Resume)

Answer

Thread Execution Hijacking suspends an existing thread, writes shellcode into the process, overwrites EIP/RIP in the thread's CONTEXT via SetThreadContext, then resumes the thread.

Question 4

What memory forensics artifact can reveal the original filename of malware that has been renamed or deleted from disk?

Accepted Answer

The \Device\HarddiskVolume path stored in the VAD node's FileObject for memory-mapped sections

Answer

The VAD node associated with an image section retains a pointer to the file object, which stores the full NT device path of the original file even after it is renamed or deleted on disk.

Question 5

During sandbox analysis, a malware sample calls VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread targeting explorer.exe. What technique is most likely being employed?

Accepted Answer

Classic remote thread injection (DLL or shellcode injection)

Answer

The sequence VirtualAllocEx → WriteProcessMemory → CreateRemoteThread is the canonical three-API footprint of classic DLL or shellcode injection into a remote process.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Memory Forensics & Runtime Analysis 3