Hello and welcome back.
Let's continue.
Now, notice here that I actually follow this in the user code to track the exact point in which he
writes to the file.
But this is not really necessary.
But this is just a demonstration.
Now, if you are not able to get hold of this API like I have here, you can actually put a breakpoint
at the start of this analysis to put a breakpoint.
You just have to type BP and then here, write file like this, then hit enter and like this.
And then the breakpoint will be set and you can check it here, write file.
So this is one alternative for you to trap this breakpoint, right?
Since I already managed to analyze that part, I don't need it.
But you might want to do that to make it easy for you to follow this.
Let's continue.
So we continue running create file.
Still reading the file.
Create file.
Still reading.
So he's probably checking that it has already got the file that it has dropped.
Click continue to continue to run.
Okay, just click.
Continue.
Click file.
Click.
Run again.
Continue running, F9.
Okay, so now it's hit our new breakpoint.
Create process internal W, That means now it's going to probably run this program that it has dropped.
So we should go and open this program now.
We with our xdebug.
So to do that, we go to this location for this X copy the file path, and now we are going to use our
xdebug to open it.
So paste the path here.
Hit enter and then we are going to open it now.
Click, click, open.
And now it has hit our breakpoint and we are going to set some additional breakpoints here, the same
like we did for the stage one analysis earlier.
Okay.
But we don't have to set all the same breakpoints we did earlier.
We only need to set a few.
For example, the first one is breakpoint on virtual lock hit enter.
And breakpoint on.
Create process.
Internal w hit enter.
Breakpoint on create file w
enter.
And then breakpoint on create.
To help.
32.
Snapshot.
Hit enter.
Let's check the list of breakpoints.
So these are the four breakpoints that I've set.
Now you only need this for.
Okay, so now we hit F9 to run.
So we hit Virtualalloc.
Okay, now we click F9 to run.
We'll lock F9 again.
F9 again.
Run again.
Still bachelor.
Yes.
Now opening the this reading whether it's their cling run again and so the way it goes to the create
process internal it is not checking for any analysis any longer because it has already done that in
the first stage.
So now probably it's going to write into the memory of this process called SBC host and run this so
we can open process hacker to track it.
So go to flair go to utilities.
And open process hacker.
Process.
Hacker.
Run as administrator.
Be sure you run an administrator.
And now we keep track of this, which we're actually analyzing now.
This is file.
And if you spawn a new process called SPC host soon.
So let's follow so we can now run to user code.
And probably add some more break points.
Okay.
So let's put a few break points here.
First one is we are going to write.
Right process, breakpoint and right process memory.
So right process memory is where a malware tries to be stealthy by hiding itself into another separate
process which is already running or about to start.
So in this case, I believe he's going to hijack the SBC host process by writing into its memory.
So that's why we need to put a breakpoint here.
And now the other breakpoint is empty.
Right?
Virtual memory.
So we are putting this breakpoint for the same reason.
Okay.
The next one is empty resume thread.
So breakpoint on empty resume thread.
Now in process hijacking.
What it does is it will create a process and then it will write to the memory of that process and then
it will resume that process.
So when the process is first created, it is in a suspended state.
That's why it needs to call resume, resume thread to restart it.
So as you can see, it has already created this process but in a suspended state.
So that's why we need to put a breakpoint here and to resume track so that we can know when it is about
to start that thread.
Now, the other additional one you can breakpoint that you can put is create remote thread breakpoint
on create remote thread.
So this is another way a malware tries to to start another thread outside of itself after it has hijacked
the that process.
So we can put a breakpoint there if you want, just hit enter.
So now we have this additional process.
Write process memory.
Uh, great remote track.
Right.
Virtual memory and resume track.
All right.
So let us now continue.
Okay.
Let us run now.
Write process memory.
Okay, so now we can see over here, this is the parameter to write process memory.
Now, if we take this, take a look at the mSDN documentation for write process memory.
You can see that the second parameter is the base address.
We can refer to this parameter to write process.
Memory is here and this is the base address of the target that is writing to which is SPC.
Host.
So we can go to process hacker and analyze the memory for this at this base address.
The base address is zero x ten, followed by four zeros.
So we can open SPC host here and then go to its memory here and look for ten this one and you can see
the permission is read, write and executable.
That means this confirms that this malware is trying to hijack this SPC host by writing to this location
in memory.
So we can now click on this and open it and you see the size 148kB.
You can double click on it and see at the current moment is still zero.
It hasn't written yet because it hasn't called this this API yet, but it is about to do so.
And we can also predict what data is going to write to it.
If you check the parameter for write process memory, the third parameter is the buffer that is going
to use for writing into the the base address.
So the third parameter, let's look at the third parameter here.
Third parameter is this one, two, three.
So we can right click this and follow the follow the in current dump and here is the location and looks
like it's an executable file.
It's an executable binary, it has got an IMG magic magic bytes.
And this sentence here, this program cannot be run endorsement.
So this is what is going to inject into the SVC host using this API.
So this is how we can hook APIs to analyze malware.
So now we can continue to run.
Okay.
Still writing to process memory.
Ronnie.
Still writing process memory.
Keep an eye on the bottom left corner here to see what is actually happening.
F9 again to run.
F9.
He's still writing.
All right.
Now it's going to create a remote threat.
And if you go back to the process.
Hacker.
I will click on this.
It has already written this content here.
Now, if you continue to run, it's going to create a remote thread.
And here you go, see that and they resume track is part of the great remote track.
So now we are ready to dump the contents of memory.
So actually, now close this.
Come here.
And we want to dump this.
Now, note that for my computer, the SPC host base address is ten, followed by four zeros.
For you it might be eight, it might be zero eight, followed by four zeros, or it could be zero C
followed by four zeros.
What I'm saying is that it will not be the same for you, so yours might be a different base address.
So in this case, we are going to select this right click.
Service.
And then we are going to dump it in here.
And since for my case, the base address is this one.
So I'm going to rename it here
with the.
Address where it came from, which is then followed by four zeros, zero x ten is x one, two, three,
four and extension bin.
Click save.
All right.
So we have managed to dump the SBC process from memory.
Okay.
So we managed to use the technique of API hooking in order to reverse and analyze malware through two
stages.
The first stage was the original file where we hooked several APIs.
And then once that API has dumped a file in the data roaming Appdata roaming folder, we use Xdebug
to open it and then we add additional APIs.
We hook additional APIs and then trace it until it hijacks the SVC host process in memory and write
to it.
And then just before it's going to run that process, we manage to dump the host memory into a file,
and that file is now in our desktop over here, this one.
So this is how we can use the technique of API hooking.
And if you wanted to, you could go on analyze this further.
So basically these are the skills you will need to have to reverse engineer malware, the ability to
attach breakpoints on important APIs that are commonly used by malware is one of the techniques and
essential skills of a malware analyst.
So that's all for this video.
Thank you for watching.