Nowadays finished unpacking.
We can dump this into a file so we can use Process Hacker to do that.
So let's open process Hacker go to flair and under here under the utilities look for process Hacker
Over here click Yes.
To open it and then look for this Emotet.
Here.
Here it is.
So double click on Emotet.
And then open the memory tab and look for this address.
Three D followed by four zeros.
3D followed by four zeros and you will see the permission.
Here is read write executable.
If we double click on this.
You will see the IMG header, the same thing that we are seeing down here.
All right.
So that confirms that this is the correct place to dump.
So to dump it, we select left.
Click on this right click save.
Then we'll dump it into the folder for our malware malware course.
We can close our Ida.
Now, we don't need Ida any longer.
Don't save.
And then here we can give it a name.
We can call it method Dump
and then click on Save.
All right, so now we can close all this, but we want to make sure you remember the address because
this is the base address.
Three D followed by four zero.
So let us rename our file.
You can be the base address at the bank.
So we will.
So we will not forget.
So you right click here and rename it.
And the back here put the base address three D followed by four zeros, which is the base address.
3D1, two, three, four zeros.
All right.
So now we can close everything.
Close this.
And we can also stop and.
And then over here we can repair the headers, the section, headers and unmap it.
The Unmapping technique I've already shown you in the previous lesson.
So the technique is the same.
So we use Pebbair to do it.
So we go to pebbair.
Open this pebbair.
Before you do anything, make a copy of this.
Copy and paste it here as a backup.
Then use this to open in Pbair.
All right, so now you see everything is okay.
Except you need to unmap your session headers.
So to unwrap it, the raw address and the virtual address should be the same.
So let's fix that now.
This one should be e followed by three zero.
It's.
This one should be F followed by three zero.
And this last one should be 13, followed by three zero.
Okay, so you see, everything is correct except for the data.
But anyway, we will do calculation to make sure it's correct.
So I'm going to open the programmer calculator.
Now we are going to calculate.
Whether the raw size is correct.
This one is easy.
Three zeros.
So set as hex input.
E.
If you take E three zeros, minus one, three zeros, we should get the raw size.
So E three zeros -1000
equals D30.
So this one should be D followed by three zeros.
Next one is F three zeros minus E, three zeros should give you 1000.
There you go.
So this should be 1000.
This one should be 13.
Three zeros minus three zeros.
So 13.
Three zeros, minus F, three zeros.
Minus F three zeros.
That should give you 4000.
So this should be 4000.
So there's a first stage of unmapping.
The second stage of the mapping is to make the raw size same as to make the virtual size, same as the
raw size.
So this one should change to D followed by three zeros.
This one should be 1000.
So let's change that.
This one should be 4000.
And this one should be 600.
All right, So that is done.
Next thing you want to do is to open the optional header.
So now we have unmap it, open the optional header, and then we need to fix the the base address.
We need to fix the base address.
So this base address is the address that we dump it from.
So we dumped it from.
The name of the file.
Just look at the name of the file.
Three D followed by four zeros.
So put this as three D followed by four zeros.
3D four zeros there.
The image is 3D followed by four zeros.
Yes, Correct.
So now we can dump it.
Right click and save executable as.
And then you can call it Emotet.
Underscore unmap.
Imitate dumb and unmap.
Save.
So now we can close everything.
And then we have the unmap file.
So we can now analyze this further with either if we wanted to.
So we open the file.
Let either do its analysis and it is managed to read the file.
All right.
So we have already unmap it.
We have already done the unpacking for Emotet.
So that's all for this video.
Thank you for watching.