Question for Dynamic Analysis
• What files are manipulated/created by this malware?
• What in the registry is manipulated by this malware?
• How does the malware persist?
• What additional processes does it create?
• Does it try to communicate over the network? Any useful network-based signatures for this
malware?
• What do you notice when monitoring this malware with Process Explorer? Is there any live
memory modification?
• What are the malware’s host-based indicators?
• Draw a behavior graph for this malware using ProcDot
• What would you guess is the purpose of this malware?