Hello and welcome.
In this video I will show you how to use API hooking in, analyzing and reversing malware.
So go and download Panda Bank bin from the resource section and create a folder in the desktop called
malware samples and put it in here.
And then we are going to open Xdebug as administrator and then open panda banker.
So before that in the options preference for Xdebug in the events tab.
Uncheck system, breakpoint and callbacks, leaving only entry breakpoint checked.
Click Save.
Then go and open Pendau Banker.
So click on this and go to the desktop, to the malware course, sample location and change to all files
here.
Click on this and open it.
So now the moment you open, it will break at the entry point.
I'm going to expand it here.
Entry point.
So the timing of API hooking is we are going to set breakpoints on the most common APIs that malware
uses.
So we will start off by putting a breakpoint on virtual lock.
Hit.
Enter breakpoint on Virtualprotect.
It enter virtual analog and virtual protect are used to trap the API that is used when the malware is
trying to unpack code.
That's why we put breakpoints on those two.
Next, there are also anti-analysis which we need to put a breakpoints on.
So the first one is is debugger present?
Hit enter.
And then the other one is create to help.
32.
Snapshot.
So this one is used to enumerate the list of running processes in memory.
Hit, enter.
And then the other one is breakpoint on process.
32 first.
This one is used in conjunction with Create to Help.
32.
Snapshot in order to iterate through the list of running processes.
Hit enter then next one is breakpoint process.
32.
Next This is used in conjunction also with create to help to reduce snapshot in order to iterate through
the list of running processes in memory.
So create to help to reduce snapshot runs with process 32 first and process 32 next in order to list
out the entire running processes in memory.
Next one is create file.
So we got to put a breakpoint on that create file W for the Unicode version, and the other one is create
file A for the SRC version.
Hit enter.
So the create file API is used to keep track of what files are being written to or read and it is also
used for by the malware for checking to see whether you have got any kind of anti analysis tools installed
on your system.
So next one is breakpoint on create process internal W.
So this one is to keep track of when the malware is going to execute code which has already unpacked.
Now when a malware is unpacking, it will use Virtualalloc and Virtualprotect and after that it will
use create process internal W to start the unpack code to run it.
So we also put breakpoint on those.
So if you take a look at the breakpoint tab now these are all the breakpoints which I've set.
Virtualalloc create file w Virtualprotect is debugger present create file a create process internal
w create to help 32 snapshot process 32 next and process 32 first.
Now we are ready to run it.
So just hit on run and it hits the virtualprotect and Virtualprotect is going to change the permission
bits for certain region of memory.
And you can actually look at the parameters here and you can refer to mSDN to see what are the meaning
of all these parameters that are being passed to Virtualprotect.
But for this occasion I'm not necessary to discuss it because it's not so important for this particular
malware.
So just hit run, which will allow also the parameters to virtual alloc all over here and Virtualalloc
will allocate space in the memory for unpacking code and here are the parameters to it.
And you can also refer to mSDN or Microsoft by googling to see what the parameters mean.
So I'll just continue with this one running still.
Virtualalloc Virtualalloc.
Click one more time, run with yellow, click again.
Which lock still keep on clicking.
Okay, now it's going to read some files.
So let's click run and see what what file is trying to read.
Okay.
It's looking to see whether you have this program installed and now it's going to check this file.
All right.
Now it's going to check whether you have the Wireshark library installed.
So this is a library used by Wireshark.
So if we continue to run now, it will quit because this is the part of the anti analysis system, this
malware.
So we have to uninstall the library for Wireshark, which is Winpcap, I think, and also Wireshark
itself.
If we don't uninstall it, we won't be able to continue with the analysis.
So just uninstall it.
Go to here and look for Add remove program.
Click add remove.
Click on this one, add remove program and then here in the list of all the files that are installed,
go down and uninstall the last two Winpcap and Wireshark.
So we right click on remove Pcap.
Click on install Winpcap is the is this one and this one IP.
So we need to uninstall winpcap.
So right click uninstall.
Click on install here.
Don't worry, you can always restore it back using the virtual machine restore function later.
Click finish.
Now we uninstall Wireshark, so right click on Wireshark and uninstall.
Click on next and click on Next again.
Click on Uninstall.
So that is ready uninstall itself.
Click on Next again.
Click on finish.
So now it has uninstalled Winpcap and Wireshark.
So now you pass this test.
So Createfile is used to check whether files exists or not.
So in this case we can run again.
And now he is going to use it to help.
32 snapshot Great file earlier was used to check for existence of files.
If a file exists, it means you have installed that anti-analysis program like wireshark for example.
But great to help.
32 snapshot is used to check for what is already running in memory.
That's the difference between great help and great file.
So here it is now checking for whether Wireshark is running in memory, but since we did not start Wireshark
so we can safely continue now it's checking for immunity debugger whether it's open in memory.
They continue running.
Now we're checking for process cycle, but we are not running process cycle.
Checking for Process Explorer.
Click Run checking for Process monitor.
Click Run now Checking for Aida.
Aida Pro.
So I'm not opening Aida Pro in memory now so I can safely continue.
Click Run again.
Now it's checking whether shot is running.
Click run and auto it to X.
They run now is checking if you've got Perl running.
Click run whether Python is running.
Click run again and checking for some files, which is not important.
Just continue running.
Click running.
So now it is checking all this.
If it finds all these type of things, it will quit.
Not important.
So just run.
Run again.
And again.
Run again.
Run.
Okay, Now it's opening this location so we can also open this location.
Maybe it's trying to drop a file there.
So let's go there.
Now we can click on this one, open the run box, and then key in the.
Variable environment path variable called app data.
App Data.
So the symbol is present at the top which refers to this path.
So click.
Okay.
And then now we are app data roaming and then let's see what's going to happen here next.
So keep on running.
Okay.
And we see something here in the stack.
If we pull this to the left, you can see the full path.
It is trying to drop a file here.
In this location in Appdata roaming so we can go there now and inspect and inspect the location, see
what's what is going to do.
So it might be different for your machine, you know?
So if your machine doesn't say NPM cache, you should follow whatever is shown in your particular case.
For my machine is showing npm cache, so I'm just going to follow it here and cache.
Add an underscore.
Cash, followed by content V2 and then followed by Sha one and then followed by zero one.
Followed by E and C, These are the files that it has dropped.
These three files.
So the next one is going to drop.
There is this file with the ammo extension so we can go here and click and see what happens when we
run.
Okay.
I believe it has dropped the file there.
Let's go and confirm it.
And there you go.
This file has been dropped there.
And now the next file is going to drop in this location is this one.
And it's interesting.
Okay, So let it run and see happen.
Run.
And now we're go inspect the folder and there you go.
Here is.
But at the moment, it's still zero.
That means it hasn't written anything to it.
It has only created the file, but it is still an empty file.
So let's continue to execute and see whether or not it will copy something into it.
So at this point here, we can go run to user code and see whether or not it writes to this file.
So now we run to user code over here.
Okay, we're in user code and let's see what's going to happen.
Nothing yet.
So let's continue to run.
Okay, Virtual lock.
So now let's see what's happening here.
Okay.
It still hasn't written anything to it yet.
But what, you're allocating something.
Let's continue to run.
Okay.
Now it's going to read in my write to the file.
You can see now the parameter is this file.
Okay, now we can go to user code and see.
We just call this API to open this exe file and now we're going to see what it's going to do.
Looks like it's going to right here.
So let's step, step over and now we can press F8, continue to step over.
Okay, Now it's going to right at the moment it is still zero, this one.
And we can see in the stack it's going to write this.
Now we can refer to do this API in mSDN.
This is Microsoft mSDN, and then here you can see the API for write file.
The second parameter is the buffer, which is going to be used for writing into the target.
And this is the target.
The first parameter you can see the description here, buffer is a pointer containing the data to be
written to the file, and the file is the first parameter.
So second parameter is a buffer.
So these are the parameters to write file and you can compare it with the stack, the parameters in
the stack over here.
So the first parameter is the file handle and the second parameter is your buffer.
Now we can follow this right click and follow the word in random.
And you can see here.
So at this address, this is the buffer is going to use to write into the exe file.
The exe file is this file.
Currently it's still zero bytes.
So it's going to take all this and write it into this file.
That is the meaning of the parameters here for this API.
So this one is executable file because there is an MSI magic bytes in the header and also the confirmation
of the string.
This program cannot be run in Dos mode.
So this is an executable file itself.
Okay.
So now we step over this write file.
And run until you close handle.
Step over.
Until it closes the handle.
All right.
So this is close handle is a closed handle for this great file.
So now we go back and inspect the size.
You can see it's 145 bytes kilobytes.
He has copied this buffer into this file.
And you can check what file is this by using hash to check.
So let's get the hash for this file.
Right click and MD5 hash.
And this is the hash MD5.
Copy the hash and then open a notepad.
Open a notepad.
And paste the hash here.
So this one is unknown file.
We just put a question mark for unknown file and then we suspect that this file is actually a copy of
Panda Banker.
So we can go to Panel Backer, get a hash for this as well and define hash.
And we copy the hash and we put it here and see whether they are the same.
All right.
So this is panda banker.
And you can see they are the same file, the hash.
MD5 hash are the same.
So this confirms our suspicion that it has copied itself into a.
Hidden folder.
Hidden directory in this location.
Now for your computer, it might not be the same location, so you might need to change accordingly
based on what you see in your machine.
So I think we will continue with this analysis in the next video.
And thank you for watching.