Practical Malware Analysis

Lab 3-2 Solutions

Short Answers

1. To install the malware as a service, run the malware’s exported installA function via rundll32.exe with rundll32.exe Lab03-02.dll,installA.

2. To run the malware, start the service it installs using the net command net start IPRIP.

3. Use Process Explorer to determine which process is running the service. Since the malware will be running within one of the svchost.exe files on the system, hover over each one until you see the service name, or search for Lab03-02.dll using the Find DLL feature of Process Explorer.

4. In procmon you can filter on the PID you found using Process Explorer.

5. By default, the malware installs as the service IPRIP with a display name of Intranet Network Awareness (INA+) and description of “Depends INA+, ...