Hello and welcome.
In this lab practical, I would like you to try to analyze this on your own first.
This can be downloaded from the resource section.
The file is "Lab 1 - .NET - Trojan.zip".
The password to unzip it is "crackinglessons.com".
So please pause the video and give it a try first, and then watch the rest of this video after you have
tried to analyze it.
So I will try to analyze it first using the dynamic analysis, that is, to execute it and analyze it using
Process Hacker and Process Monitor, as well as Wireshark.
And then after that, only I will try to analyze it.
Static analysis.
Okay.
I hope you have given it a try.
After unzipping this file, you will have a folder.
I will put mine on the desktop, and within the folder is a file, the malware itself, "dotnet-malware.bin".
The first thing we can do is to try to get the hash for this file and look it up in VirusTotal.
So to get the hash of this file, you can right-click on this,
and then click on "HashMyFiles". And over here you will see MD5.
Just right-click,
copy MD5,
open up your browser, and head over to VirusTotal.
Just click on "Search", and then right-click and paste the hash in this box and hit enter.
And VirusTotal will give you the results.
59 out of 69 search engines.
Virus
search engines have detected this file, and the name of it is a Trojan.
Generally, you can see it is a kind of stealer,
information stealer, a spyware.
So now we know.
So that's quite helpful.
Next thing you want to do is confirm that this is a .NET executable.
So before we proceed further, let us make a copy of this and then rename it
to something simpler.
Maybe we will call it—we will change the executable as well because we want to run it.
We will call it an EXE with the EXE extension.
And for the name itself, we can just call it "netmalware". Speaking—
yes.
Don't execute it yet.
Open "Detect It Easy" and scan to make sure it is a .NET executable.
So look for your Utilities folder in the left folder.
And then
look for "Detect It Easy".
Click on the three dots and navigate to the location of the "netmalware.exe" file,
which is on the desktop.
Click on it to open and let it scan the file.
It has detected it as a
.NET Framework executable, and the compiler is VB.NET, and it doesn't appear to be packed.
But this is not reliable.
Part of it could still be packed.
So now we confirm that it is a .NET.
Later in the second stage of the analysis, we will open it with dnSpy.
But in this video, I want to do the dynamic analysis first.
In the second part of the video, we will do the static analysis where we will open it with dnSpy.
To analyze it,
we need to run it.
But before we run it, let's fire up a few programs.
Now make sure that you have disabled the internet for this virtual machine because we don't want to
accidentally cause it to reach out to the command and control server, or worse still, to spread to other
computers on your network
if it is a worm. So disable your network, and then over here we will fire up a few programs, starting
with Process Monitor.
So click on "Process Monitor". Click "Yes".
And then over here you can filter.
So we are going to filter out the name of this malware because otherwise it will show everything that
is running in the operating system.
So click on "Filter", and then here in the first drop-down list, select "Process Name", and then here leave
it as is.
And here, type in this name: "netmalware.exe", and then click on "Add", click "Apply", and immediately you
will see nothing shows up because it is filtering—filtering out only this.
At the moment,
we don't need for it to capture anything yet, so we can temporarily pause it.
So let's click on—hit on the "Pause" button.
Okay, so now the next thing is we want to run Process Hacker to see whatever additional processes that
the malware might spawn.
So to launch Process Hacker, go to FLARE here, and then the Utilities, look for Process Hacker over
here and run it.
Click on "Yes".
And one more tool we need is Wireshark to capture the network traffic.
So same thing in the same folder as in FLARE is under "Net".
Look for "Wireshark" and launch it.
Click
"Yes". Wireshark is now running, and then look for "Local Area Connection" and double-click on it.
And then over here we are going to filter out the HTTP traffic.
So just type in "HTTP" and hit enter.
So this is to check if it is connecting to any C2 servers, command and control servers.
So now we have set up our tools ready to detonate the malware inside this virtual machine.
So we have got Process Monitor to monitor the process, the malware process when it runs.
We have got Wireshark to capture the traffic, network traffic, if any.
And we also have Process Hacker to see if our process, the malware process, will spawn any additional
children processes when it is running.
In the next video, we will continue to run the malware itself, so I'll see you in the next one.