Practical Malware Analysis

Lab 3-3 Solutions

Short Answers

1. The malware performs process replacement on svchost.exe.

2. Comparing the disk image of svchost.exe with its memory image shows that they are not the same. The memory image has strings such as practicalmalwareanalysis.log and [ENTER], but the disk image has neither.

3. The malware creates the log file practicalmalwareanalysis.log.

4. The program performs process replacement on svchost.exe to launch a keylogger.

Detailed Analysis

For this lab, we begin by launching Process Explorer and procmon. When procmon starts, the events stream by quickly, so we use File ▸ Capture Events to toggle event capture on and off. (It’s best to keep event capture off until all dynamic analysis programs are started and you’re ready to execute the program.) ...