Hello and welcome back.
In the previous lesson, some of my students have mentioned that even after they have put the breakpoints
over here and inside, this decreased function over here and run, the breakpoint does not hit because
the program goes into a running state.
So I will explain how to solve that.
So let's press the backspace on your keyboard to go back to the previous code.
So you have put a breakpoint here.
And the problem happens because when the execution comes to here and perform a test, it fails because
the file does not exist.
And even though it does, for some reason it fails.
So it will not enter the the the block of code.
Instead, it will just exceed the block of code and come up here.
So what we want to do is to force it Forced to enter the block of code so that it can come to the RSM
decrypt here, and from the RSM decrypt, it will come here and perform this unpacking and the decryption
of the of the resource.
Resource.
Key.
Source.
That's what we want to do.
So in order to do that we have to reverse this logic by removing the negation operator here.
So in order to remove the negation operator we have to modify the code.
So let's do that now.
We'll select on this right click on this edit instruction.
And then automatically you will see that this three lines is selected because you already right click
on it.
So this is called the Ill instruction intermediate language.
It's a lower level language used in the C sharp and VB.Net frameworks.
So it's like the assembly For dot net.
So what you need to do to reverse the logic is to reverse the buyout rule, to turn it to buyout false.
And you can see here there's a call to the file string exists.
And then after that there's we are true.
So we just have to change this.
So we have to change this to be false.
So left click on this.
And then in here you see a list of possible opcodes.
So just scroll up a bit and you can see there's a false.
Select the BR false to replace it.
Then click okay.
And now you see the negation is gone.
That means when the the program comes here, it will enter this block of code and execute this line.
We will now dump this this new bash code.
We will patch the code.
So to patch it we right click on this assembly here.
This module here and select remove.
When you select remove it will prompt you to save the file.
Click Okay.
Yes.
So to save the file in a different name, we don't want to overwrite the original file.
We click these three dots here and we give it a new name.
Call it dash two.
And then here select all files.
And you can see your first original file is here.
And then now we are going to rename it as dash two.
This will be the patch file.
Click save.
Click okay.
All right.
So now we reload the new file into the NSP file.
Open.
Select all files.
Click on the batch file.
Click open and go back to the place where you put your your breakpoint.
So that was the batch file.
This is a new file.
So your breakpoint will have been lost.
So no worries.
Let's re-insert our breakpoints.
Select this code here.
This module here edit search assemblies.
And then search for read mail.
And that is search.
Okay.
This is the one you want.
Read mail.
That's where we we that's where we were at.
So just double click on that and you will come back to the same place.
So let's let's reinsert our breakpoints.
This one one here.
Click on this.
RSM decrypt and put one more here.
So now we are ready to run.
So when it runs click okay.
Click yes.
If we hit our breakpoint here and then let it let it uh let it run in the second time.
And now it hits our second breakpoint.
So now we're going to step over until it comes to the last line.
Step over, step over.
Were step over, step over, and by the time it reaches here, it will have decrypted the rest of the
resources.
Key resources.
So to see the decrypted bytes, just look down in under London locals here and then right click on array
two and then select Show in Memory.
Memory one.
And you can see there's a header here right.
That means this is a PE executable file.
So we want to dump that.
We just right click here and then select Save Selection and call it dump dot bin.
So from here onwards it's the same as the previous lesson.
So you have saved it.
So you can close this now.
You can stop this and then open this with PE studio.
Use PE Studio.
And open your dump bin and analyze it.
And you can see here that this is a email password recovery program.
And if you go down here to the version you can see it's, uh, by a company called Nero Soft.
So Nero Soft is probably a company which makes email recovery programs.
So from here, we can deduce that this malware developer did not write his own mail, his own mail email
recovery program.
Instead, he took somebody's email recovery program and embedded it, decrypted it, and put it inside
the malware as an as an embedded encrypted resource.
So that's all for this video.
Thank you for watching.