Hello and welcome.
In this video we are going to unpack and analyze Emotet.
You can go and download Emotet Trojan, unzip it and put it in the folder on your desktop.
Malware core Samples folder.
So the first thing we do is we try to open it with either to statically analyze it, create a new project.
And open the Emotet Trojan.
Click okay and you will see it is quite short.
Very few functions and very short main function.
So this indicates that it is probably packed.
You can also confirm by opening with detected easy.
If you open it, detect it easy, you will see that it is a high entropy.
So you can go to fly under the utilities here.
You open detected.
Easy.
And then use the data to open the Emotet Trojan on your desktop.
And although here it does not show the the status as being packed.
But when you look at the entropy.
You will see it's very high, 89%.
And the status here is back.
So this is confirmation that it is back.
So to try to see how it's unpacking itself.
So one of the cores here is the unpacking routine.
Now, in order to find which one's unpacking routine, you should look for the call, which is called
virtual alloc inside it.
So if you go through each one of these, you will find that this is the one which is called virtual
alloc inside it.
As you can see.
So in this routine, you can see that the virtual Alloc API is being pushed to is being moved to Essex
and then later on Essex is being moved to this DWord.
And then later on this driver is moved back to Essex.
And then it is pushed to the stack here.
So this here is actually virtual lock.
Now, normally you don't push something to the stack before the return.
Normally it's pop.
So this is an abnormal epilogue.
So a prolog has got to keep.
But epilogue should have a pop up.
But if you see a push instead, that means it's an abnormal thing.
So this is a trick used by malware authors to confuse the analysts.
So what is trying to do is that when you push this thing, when it returns, it will execute this instruction
on the stack.
Why?
Because when you return, it always returns to what is on top of the stack.
So this is actually calling virtualalloc.
Another abnormality is another push before it.
So when Virtualalloc returns, it will return to this, which is the second thing on the top of the
stack.
And then it will execute this.
And this thing is actually here.
It is trying to execute this after virtual lock return.
And then once this finishes execute, then this will be the real return.
So this will return.
We return.
Let's press escape now.
It will return to this instruction here.
If you press the spacebar this instruction.
41417EEF
press spacebar again.
Okay, so these are the ones we should be looking at.
We should put a breakpoint here.
And this is probably the unpacking code inside here.
And once the code is unpacked, normally, it will jump to it.
So let's look for an abnormal jump.
This is a normal jump.
A jump which goes nowhere.
All of a sudden jumps to register, which is highly suspicious.
So this is probably the jump to the unpack code.
So we put a breakpoint here.
Let's try to open it in debug.
So let's open debug.
32 bit.
And then when the options here preferences and check system breakpoint and RTS callbacks leaving only
the entry breakpoint check.
Then open your emotet.
Go to the desktop malware Core samples.
Select all files.
Select Emotet.
Open.
Now you are at the entry point.
So now we are going to put a breakpoint on.
Najam.
Here.
So this be just before the entire thing gets run, before the.
Unpack code gets run.
So we put F2 here, put a breakpoint and we are going to go there.
So just run to that breakpoint.
Okay.
So now we have got to jump to E6, so just step over it.
You can press F8 to step over it.
And so we are now at the E6, the instruction at E6.