Examkin

Question

Difficulty: HardMalware Types and Indicators of Compromise

During a targeted forensic investigation of a compromised server, an investigator examines volatile memory artifacts using a memory analysis framework. The analysis reveals an injected memory section within the address space of a legitimate lsass.exe process possessing PAGE_EXECUTE_READWRITE memory permissions. Further inspection reveals shellcode executing directly out of unmapped RAM with no corresponding executable file present on the disk or file modification recorded. Which of the following malware classifications best describes this threat?

  1. Fileless malwareAnswer
  2. B
    Self-propagating worm
  3. C
    Trojan backdoor
  4. D
    Logic bomb

Answer

Fileless malware is the correct classification because the threat operates directly within volatile RAM and injected process memory without leaving a persistent binary file on disk.
Fileless malware resides exclusively in volatile memory (RAM) or piggybacks onto legitimate host processes through injection techniques, evading traditional disk-based detection mechanisms.

Step-by-Step Solution

1
Analyze host indicators of compromise (IoCs)
Identified shellcode executing within PAGE_EXECUTE_READWRITE unmapped memory of a legitimate process (lsass.exe) with zero disk footprint.
Recognizing memory-only execution indicators helps distinguish non-persistent or injected threats from traditional disk-based payloads.
2
Evaluate malware propagation and storage vectors
The absence of stored executables, file modifications, or standalone malicious binaries rules out traditional disk-borne installers and Trojans.
Fileless threats leverage existing system processes (living off the land) or direct memory injection to evade disk-based antivirus detection.
3
Select the matching malware classification
Confirm Fileless malware as the accurate diagnosis.
Fileless malware specifically matches the profile of residing strictly in volatile memory.

Key Concept

Fileless malware and memory injection indicators of compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic