Hello and welcome back.
In this video, we are going to use xdbg to debug the program, the malware, and we are going to analyze
to look for the evidence of unpacking.
And then after that, we will use Process Hacker to try to dump the memory.
So let's begin. Since we saw in PEStudio that it is a 32-bit program, we use the 32-bit version of x32dbg.
Then set the Options > Preferences. Uncheck System Breakpoint and uncheck DLL Callbacks, and
just leave the Entry Breakpoint. Click Save.
We then open the malware.
Select All Files.
And you will see that it has hit the entry point.
Now we put a breakpoint on VirtualAlloc: BP
VirtualAlloc. Press Enter and confirm that the breakpoint has been set.
Double-check here under the Breakpoints tab.
VirtualAlloc.
Now we will run.
And then it hit our breakpoint.
So we will continue to step.
It will jump to VirtualAlloc.
And now it is going to push the parameters to the stack in preparation to execute VirtualAlloc.
Now it is going to call VirtualAlloc and return the allocation of memory in the EAX register.
Step over,
and this is the memory that has been allocated.
So we right-click on this and Follow in Dump.
And you can see here it is currently blank.
And we want to see what the permissions are, so we can right-click and Follow in Memory Map.
So currently it is Readable and Writable.
Next, we will run again to see if we hit VirtualAlloc the second time.
And it has hit VirtualAlloc a second time.
Now we will step over again.
As before, it will jump again to VirtualAlloc.
And now it's going to push the parameters to the stack,
and it is going to call VirtualAlloc a second time.
So we will keep an eye on EAX. Step over,
and this is the second allocation of memory.
So now we will right-click this
and Follow in Dump, Dump 2.
And we come down here to Dump
Number 2. This is the second location in memory which has been allocated for unpacking.
If we go back to the earlier memory that was allocated, you see that the malware has unpacked something
there.
Now the second one is over here.
So let us run and see what happens to this.
But before that, let us go to the Memory Map and see what permissions have been set.
So you right-click on this memory, Follow in Memory Map.
And this time, this new allocation is set to ERW, meaning Executable, Readable, and Writable.
So now let us run and see what happens down here.
As you can see, it has unpacked itself into memory.
And as you can take a look here, this is the magic byte for a PE header. And for double confirmation,
we can see the string:
"This program cannot be run in DOS mode."
So this is confirmation that it has unpacked the executable,
another executable, inside this memory location.
So now we can try to dump this memory.
So for that, we will use Process Hacker.
So we now open our Utilities, open Process Hacker.
And scroll down to look for the ransomware. Over here.
Double-click on it and take a look at its memory.
Let's expand this.
Now we want to go to this memory location:
0x36, followed by four zeros.
So if we scroll down, we can see over here,
Read,
Write,
Executable.
So if we double-click on this, we can confirm that indeed there is a PE header over there, and we can
compare it with what we saw in our x32dbg.
The PE header and this address.
So now we can dump this.
So click on Save, and you can dump it in our folder over here.
We can call it
ransomware_dump.
Click Save.
So we have now successfully unpacked the EXE executable that was found in memory.
So in the next video, I will show you how to open the file for analysis using Ghidra.
Thank you for watching.