EC-Council Certified Ethical Hacker (CEH) v12Malware ThreatsHard
A security incident response team is analyzing a memory dump from a compromised server. They discover a hidden process that is not visible through standard operating system tools and has injected malicious code into a legitimate system process. Which malware attack tool or technique is the team most likely observing?
- APacket Sniffer
- BRootkit Installer
- CProcess Hollowing
- DKeylogger
Show answer & explanationAnswer & explanation
Correct answer: C. Process Hollowing
Process hollowing is a sophisticated injection technique where a legitimate process is started in a suspended state, its original code is unmapped, and malicious code is written into its memory space. The process is then resumed, executing the attacker's code under the guise of the legitimate process, making it difficult to detect with standard tools.
Why the other options are wrong
- A. A packet sniffer captures network traffic and is not directly related to hiding processes or code injection in memory.
- B. A rootkit installer is what *installs* the rootkit, but 'Process Hollowing' describes the specific technique used by the rootkit (or other malware) to hide and execute its code.
- D. A keylogger records keystrokes and operates differently than injecting code into processes for stealth.
Process Hollowing
A code injection technique where a legitimate process is created in a suspended state, its memory is unmapped, malicious code is written into its address space, and then the process is resumed, executing the malicious code.
- Executes malicious code under the guise of a legitimate process.
- Evades detection by standard process monitoring tools.
- Often used by advanced persistent threats (APTs) and rootkits.
Memory trick: Hollowing: The 'hollowed' shell of a good process holds bad code.