Hello and welcome back.
In the previous video, we have dumped this from memory, so now we can go and view it from here.
Now note that your address where you dumped from might be different from mine, so just follow yours.
So now we can go and analyze with PE Bear and see whether we need to map it.
So just open FLARE Utilities and fire up PE Bear.
And then just drag the Remcos dump into there.
So now if we take a look at the plots, we can see that everything is in order.
So there is nothing to fix. It's not necessary to do unmapping. So now we can analyze this.
We'll use PE Studio. Go to FLARE, look for PE Studio, and fire PE Studio.
All right.
Taking a look at this, you can see that the entropy is low, 3.922.
So that lends support that we have already successfully unpacked this.
And look at the indicators now, so we can see some of the indicators here.
The file contains another file in the overlay section over here.
So that seems to be another embedded file here.
Take a look at the directories.
Sections, and you see they're all quite low entropy, less than seven, meaning that it is no longer packed.
And see, this is some of the suspicious libraries like connecting to the Internet.
Looking at imports, many imports used by Trojans.
Enumerate service, open username, registry, creating registry, and so on.
Connecting to the Internet, writing process memory, and allocating.
All this is very highly suspicious.
Set Windows Hook for keylogging.
Here's for enumerating the processes which are running in the computer.
Terminate process to stop processes, shell execute, and so on.
Suspicious load library to get external functions. Copying the keyboard data.
Stealing information.
Recording sounds.
And so on.
Look at strings, and you can see some registry keys here as well.
And these two, Event Viewer, and these are typically used for privilege escalation.
And you can see here some scripting languages as well.
Shell scripts.
This one as well.
All are highly suspicious.
Look at that, running VBS, VBScript.
We have managed to unpack successfully and got a lot of information about Remcos.
So this completes our objectives, which is to learn how to unpack the Remcos using x64dbg.
Thank you for watching.
I'll see you in the next one.