Welcome back.
In the previous video, we have already set up the tools that we are going to use before we run the
malware.
In this dynamic analysis.
So in this video, we are going to continue.
So note here.
Now we are ready to run.
So we will turn on the capture now, which we have paused earlier and then we if we want, we can also
go to the tools here and look at the process tree, where we can look at the details of the processes
which are running in this operating system, in this virtual machine.
Note that under the command column we can also see the command line that started the process itself
as well as any parameters to it, if any.
All right.
So we can close this for now.
And now we are going to detonate our malware.
So go back to the folder where the malware is found and click on the net malware with the dot ESC extension.
And immediately it starts executing, as you can see.
And if you look here, it doesn't show that it has created any.
Any processes as well.
And if you look at the Wireshark, it also doesn't seem to be trying to communicate out anywhere.
So let us now take a look at the process monitor and see what is happening.
Just open it a little bit.
And since it's a long list.
Scroll down to see what it's currently doing.
So you can scroll all the way to the bottom to see what it is currently doing.
So now here you will see it is trying to read your mails.
Mails dot txt.
Okay, let's scroll up further.
You might see this thing popping up, saying the application was unable to start correctly asking you
to close.
Do not close it.
Just.
Just ignore it.
Continue analysis.
You will see it is also looking for browsers dot txt and then we keep scrolling upwards to look for
more interesting things.
And here is some meals dot txt.
Probably trying to steal some email information.
And here is also some evidence of looking for messages or messaging services as well as email identities
outlook profiles.
Usernames as well.
As well as accounts phishing for accounts, computer names.
And you see Thunderbird here.
It's a mail client.
Mozilla mail client.
Okay.
You do not discover much because probably the malware quit.
So anyway, if the malware had not quit, we could probably have discovered much more information about
what it is trying to steal.
For example, the Firefox and Chrome's passwords as well as other passwords.
So anyway, let us try to look at the strings now to look for the strings in memory.
We can go over to the process hacker and double click on the process and head over to the memory tab
and then click on the strings button and then click okay.
So here we are looking for any kind of Http.
So just scroll down and see if we can find any.
And we found quite a lot of things here straight away.
Pop3 imap password http email password.
Smtp password too.
So this could be what it is trying to steal.
And even looking for this Gmail and Yahoo!
Account passwords.
Login name and password for Google.
And here is evidence that is using PG 11 encryption IP.
And this PG 11 is used by Firefox to encrypt the passwords.
So it appears it might be stealing that Firefox passwords.
And there's SQL three as well, probably trying to access the decrypted passwords for the Chrome Chrome
passwords.
There is also Thunderbird, which is the Mozilla mail client.
So this might be indication that it's trying to steal the mail client password.
Email password.
Okay, let's try to filter for Http to see if we can find any command and control servers.
So just type in Http and click.
Okay.
And it seems nothing showed up.
And that could be because the program quit before it could show it could load any Http servers here.
And we see this reference to nil soft nearest.
This could be a this could be a decryption software suggesting that there might be an embedded exe inside
this malware.
So now we have a good overview of what it is trying to do basically is to steal email and browser passwords.
So next, the next step, we are going to look at the static analysis.
So thank you for watching.
I will see you in the next one.