Lab 3-3

1) What do you notice when monitoring this malware with Process Explorer?

The Malware launches a process called Lab03-03.exe, this process then spawns an svchost.exe process and kills itself.

2) Can you identify any live memory modifications?

Yes. Looking at the Strings in Disk and Memory they are completely different. Strings in the disk:

Strings in Memory:

3) What are the malware’s host-based indicators?

The Malware creates a file called practicalmalwareanalysis.log in the Current Directory. There are no signs of persistency.

4) What is the purpose of this program?

Looking at the content of practicalmalwareanalysis.log, we can assert that this is a Keylogger.