Welcome back.
In this video, we are going to analyze the dump file with PEStudio and Ghidra.
So let's start off with PEStudio.
Open up PEStudio.
And drag the dump file into it to let PEStudio analyze the dumped file.
And PEStudio is now analyzing.
It looks like
it looks like we got the wrong dump file.
So we need to repeat the process of dumping.
This is not the right PE file,
since there are no libraries and no imports.
And even if you look at strings,
there is nothing much there.
Okay.
So we have to repeat it.
So I'm going to try again.
Open it with x32dbg.
Sometimes it's a matter of trial and error, so it's quite okay.
So we open the malware again.
And then we'll put our breakpoint
on VirtualAlloc.
Run to the first breakpoint.
Step over.
Okay, so now this is the first one. We can Follow in Dump.
All right.
Now we're getting a different address: 0x0022, followed by four zeros, so we can put a note there.
0x0022, followed by four zeros.
One, two, three, four.
Right-click, Follow in Memory Map. It is Readable and Writable.
Now we run again, and it has populated that first memory with some unpacked code, and it has hit VirtualAlloc
a second time.
So let's step over.
Okay, let's run VirtualAlloc now.
And it has allocated some more memory here.
Right-click, Follow in Dump Number 2.
This is the one. Right now
we're going to examine it in Memory Map.
Right-click and Follow in Memory Map,
and you see this one is Executable.
Okay, so we are going to copy this address. Right-click, Copy Value, and put it here.
We have two addresses.
Okay, now we run, and you see it has populated the second one with this unpacked code.
So now we will open Process Hacker.
We open Process Hacker to try to dump,
but this time we are going to dump a different location.
Process Hacker.
Go to our ransomware, go to Memory.
And according to our notes we've written down, we started dumping at 0x0022, followed
by four zeros, which is here.
And then we dump something else.
So now we're going to dump everything starting from here. Right-click, and we are going to Save, and
we are going to overwrite the earlier one.
Yes.
So now we are going to open it with PEStudio.
We'll go to our Utilities folder and fire up PEStudio,
and now we analyze the dump file.
PEStudio.
And see if we get any libraries.
All right.
Probably no, because it doesn't have a header at that location.
So we'll close this now and then we analyze it with a hex editor.
I'll be using 010 Editor.
Right-click, Open With 010 Editor.
Okay.
You see there is no PE header there at the location, so we can search for PE header.
The the magic bytes are 4D 5A. So we search for 4D 5A.
4D 5A.
4D 5A is hex for MZ, and we found a hit here.
There is one here.
Here.
So this is the location where we have a PE header.
There's another one here,
another PE header here.
So it seems there are quite a few.
All right.
So it will take a lot of time to go through all of them to see which is the correct one.
So to save some time, I will cut short and tell you that the second one is the correct one.
But if you are going to try this, you need to go through every one of the headers and then open it in
PEStudio.
So in order to open in PEStudio, we have to delete all the ones which are the wrong ones.
So we select the wrong bytes and delete them.
Hit Delete.
So now we're going to save this.
And then now, once it's saved, we can open PEStudio to analyze it.
So we go to
Utilities and open PEStudio.
So it's actually trial and error. Sometimes it takes a lot of work.
Even a dump file doesn't necessarily contain the correct unpacked code.
So it's a matter of trial and error.
If you find a few MZ headers, you need to try each one of them,
like
how I'm doing here,
until you get the right one.
So the right one is now the second one, and we are trying to analyze it now.
So the new dump file is here.
Let's see if we can get a PE header this time.
Okay.
We have a PE here.
See if we can get any libraries.
If we can get libraries and imports, that means we are correct.
We have already extracted the correct unpacked code. Going to give it some time to finish this analysis.
And it has finished analysis,
and this time I think we are correct.
You can see there are so many libraries and so many API imports.
That means we have correctly unpacked the file.
You see that?
So many.
And then if we go to Strings,
let's see what strings we get.
All right.
You can see there is some kind of Base64 encoding.
Okay, let's scroll down and look for anything else.
It's still being obfuscated with Base64 encoding, and there is some registry key here.
So this is correct.
Much more information than the previous one.
So this is the kind of persistence here.
Scroll down and see what else we have.
And we have an HTTP here, URL.
So that could be the server that it is trying to connect to.
So this is a good sign or Indicator of Compromise, and here could be some kind of message to show the
user.
Maybe it's a ransom note.
Yes, it looks like it.
So let's expand this further.
There you go.
So many URLs. You can see some ransom and probably the ransom note and some URLs here.
Okay.
So this is a positive sign of an Indicator of Compromise.
So it looks like we have dumped the correct unpacked code.
So in the next video, we will show you how to open it in Ghidra if you wanted to use Ghidra
to analyze this.
So thank you for watching.
I'll see you in the next one.